What is private here

The question

"If I type something private into Solrouter, who can read it?"

On the sealed path, Solrouter's own servers cannot read your prompt or the reply. The prompt is opened only inside sealed hardware: an Intel TDX enclave, and, for Qwen3.5 122B, an NVIDIA H200 GPU enclave. On Qwen3.5 122B no rented machine's operator can read your words at any point. The three smaller open models (GPT-OSS 20B, Qwen3.8 27B, Qwen3-coder 30B) run on rented Nosana GPU nodes, and only there can the node operator read the prompt and reply while the model runs. Web chat at solrouter.com is on the sealed path, and its history stays in your browser. Agent mode, its connectors, and your knowledge base do not get that protection, and the tables below show exactly where each one is readable.

Local proxy modes

private is provider-hosted proxy inference. The SDK encrypts the masked prompt to the Solrouter TEE, then the TEE forwards it to Nosana. The Nosana GPU host can read the prompt and reply. This mode is not full-path E2E.

e2e requires a client-verified TEE key. The current SDK does not verify the TDX quote, so the local proxy returns 503 e2e_model_unavailable. The qwen3.5:122b model runs in an H200 enclave, but it is not eligible for this mode yet.

What is sealed

Here, "sealed" means the client encrypts the prompt to the TEE with X25519 and RescueCipher. The TEE opens it. For Nosana models, the TEE sends prompt text to the GPU node in plaintext; its operator can read it. The SDK does not verify the TEE key quote, so strict E2E is unavailable.

Nothing on this page says "all requests are encrypted", because they are not. Check the row for the surface you use.

Who is who

The matrix shows five parties. You are the sixth: your own device always reads your own words. Here is each party in plain words.

• You. Your browser, or the program that uses the SDK.
• Network observer. Anyone who watches the connection between you and Solrouter. For example, your internet provider or the owner of a public Wi-Fi.
• Solrouter backend. Solrouter's own servers. They check your login, take payment, store your history, and pass messages along.
• CVM cloud host (Phala). The company that owns the physical machine where the sealed computer runs. The sealed computer is a Confidential Virtual Machine (CVM). The processor encrypts its memory, so the machine owner cannot read it. See What is a TEE?.
• H200 GPU TEE host (Phala). The machine that runs Qwen3.5 122B. The model runs in vLLM inside a GPU enclave: an NVIDIA H200 in confidential-computing mode, with the server build pinned by image digest in the attested compose. The host sees only encrypted memory, never your words. Only Solrouter's TDX enclave holds the key to call it.
• Nosana GPU host. The operator of the graphics-card machine that runs one of the smaller open models (GPT-OSS 20B, Qwen3.8 27B, Qwen3-coder 30B). Solrouter rents it from the Nosana network. Solrouter does not control that hardware.
• Solana observer. Anyone who reads the public Solana blockchain. Solrouter posts a receipt there for each encrypted request.

Each cell says what that party can see. The legend under the matrix explains every word.

Who can see what

Rows here describe the sealed path: web chat, the TypeScript SDK with its default settings, or the MCP server's encrypted_chat. Filled cells mark the only places a party can read your words. Every row is Live.

A request touches only one GPU column: the one for the model you chose. On Qwen3.5 122B the Nosana column does not apply, and the other way round.

Notes

• H200 GPU TEE host, encrypted. Qwen3.5 122B runs in vLLM inside an NVIDIA H200 GPU enclave on Phala. The host sees encrypted memory, not your words, on every request. The server build is pinned by image digest in the attested compose, and only Solrouter's TDX enclave holds the key to call it.
• Nosana GPU host, readable. GPT-OSS 20B, Qwen3.8 27B, and Qwen3-coder 30B run there in plaintext for the length of one request. Solrouter rents the machine and does not control it. The request is not linked to your identity. Pick Qwen3.5 122B if no rented operator should be able to read your words.
• Knowledge-base documents. Files are split and embedded on the server as plain text, not encrypted at rest. Sealed chat does not search them. Whether the deployed app isolates collections per user is not determined.
• Files. Web chat inlines plain-text files into the sealed prompt, so they get the same protection as your words. Images and documents are refused in sealed chat. The SDK sends the text prompt only.
• Web chat history. Stored in your browser's IndexedDB and never sent to the server, so it does not sync across devices. The backend keeps only the chat row: the title "New Chat", the model, and timestamps. Recent turns and remembered facts reach the enclave inside the sealed prompt.
• Web searches is the encrypted agent path: a REST call to /agent with encryptedPrompt, Live for REST and Soon for the SDK. Search runs through SearXNG inside the enclave, which then queries public engines. Those engines receive the search text.
• The enclave logs the first 50 characters of each reply. Who can read that log is not determined.

Standard path

This is Agent mode and its connectors, /agent calls with a plain prompt, and the SDK with encrypted: false or reasoning: 'braid'. Normal web chat and guest chat do not use it. There is no client-side encryption, so the backend and the model node read your words. Status: Live.

• The GPU column describes the Nosana-hosted models (GPT-OSS 20B, Qwen3.8 27B, Qwen3-coder 30B). Qwen3.5 122B is served from inside an H200 GPU enclave whose host cannot read your words on any path. The Solrouter backend reads your words on this path either way.

• Chat history, at rest. Agent mode messages are stored encrypted with AES-256-GCM under a key the backend holds. That protects against a stolen database copy, not against Solrouter, which also reads the prompt on the way in.

• Connectors. In Agent mode the backend calls Notion or GitHub with your connected token, reads what comes back, and passes it to the model node with your prompt.

On this path attachments and knowledge-base files reach the backend and the model node in plaintext. Documents upload to Cloudflare R2 through a short-lived link, and the backend extracts their text. Live search and the web_search tool use Brave, with DuckDuckGo and Wikipedia as fallbacks, so those services receive the search text.

Where your words are readable

The strip below follows one sealed request from your device to the Solana receipt. Tinted zones hold your words in readable form. Grey zones hold only ciphertext or a hash. Of the two GPU zones, only the Nosana one exposes your words to the machine's operator, and only when you picked one of the smaller models.

In words

• Your device: your words are readable here. Your browser or program scrambles them before they leave.
• Network: ciphertext only. A watcher sees size and timing.
• Solrouter backend: ciphertext only. It checks your login, bills you, and passes the blob along.
• TDX CVM: your words are readable here, inside memory that the processor encrypts. The machine owner cannot open it.
• H200 GPU enclave (Qwen3.5 122B): your words are readable here, inside GPU memory that the hardware encrypts. The machine host cannot open it.
• Nosana GPU node (smaller models): your words are readable here while the model runs. Solrouter does not control this machine. The request is not linked to you.
• Solana: hash only. A receipt proves a request happened and names the model. It does not hold your words.

What we keep

Retention periods are not published. Each row states what is stored, in what form, who holds the key, and how to remove it. Rows are Live unless marked.

Guest chat is sealed like signed-in chat. It stores no chat rows on the server; the conversation stays in your browser.

Short answers

• "Can Solrouter read my prompt?" In web chat, through the SDK, or through the MCP server's encrypted_chat, no. In Agent mode or with encrypted: false, yes.
• "Can Solrouter read my history?" Sealed chat history, no: it stays in your browser. Agent mode history, yes: it is stored under a key the backend holds.
• "Can Solrouter read my memory?" No. Only your wallet can unlock it.
• "Can Solrouter read my uploaded documents?" Yes. They are stored as plain text and plain files.
• "Can anyone else read my prompt?" On Qwen3.5 122B, no one: the model runs inside a GPU enclave. On the smaller Nosana-hosted models, the node operator could, while the model runs. No one else.
• "Is my wallet address public?" It is not on the Solana receipt. Solrouter's backend knows it.

Next