x0ne Engine · Preview · test keys

Confidential-only inference engine.

Your data and your model, encrypted end to end.

x0ne Engine serves AI models inside an Intel TDX enclave, with an NVIDIA H100 GPU in confidential mode. Outside your machine, your data is decrypted there and nowhere else, and only once its hardware proof is verified.

Technical documentation Source code

Runs on Intel TDX, NVIDIA H100 and Google Cloud

Preview 0.2.0-beta.7.

Built so no one can see your data.

  1. 01 / 06

    It starts on your machine.

    A business app, a coding agent, a scheduled job: they all speak the OpenAI-compatible API, to the x0ne relay installed on your machine.

  2. 02 / 06

    Checked before anything is sent.

    The remote machine proves what it runs: an Intel TDX report checked with Intel, NVIDIA's verdict on the GPU, the digests of the image and the model. Without a valid proof, your question stays with you.

  3. 03 / 06

    Encrypted end to end.

    The TLS 1.3 connection is bound to that proof. The host sees times, sizes and IP addresses go by, never the content.

  4. 04 / 06

    Decrypted only inside the enclave.

    The Intel TDX processor encrypts its memory; the H100 GPU, in confidential mode, isolates its own and encrypts what it exchanges with the processor. The model reads your data, the host does not.

  5. 05 / 06

    The answer comes back with a receipt.

    Encrypted the same way, it arrives with a receipt signed inside the enclave: the model, the machine, and its signed statement that your text was neither logged nor mixed with another client's.

  6. 06 / 06

    Sealed from the application.

    With the SDK, your application checks the proof itself and encrypts for the enclave's key alone. The relay passes it on without being able to read it. Streaming: measured once, from Node; in a browser: next step.

What goes out, for example

Encrypted end to end.From request to answer, segment by segment.

Your machine
Applicationagent, job, person
In the clearon your machine; sealed with the SDK
x0ne relaychecks the proof
Encrypted, TLS 1.3over the Internet; the host only sees ciphertext
Confidential enclave, at Google Cloud
Intel TDX CPUencrypted memory
Encryptedbetween CPU and GPU
H100 GPUisolated memory

End to end, from the application to the enclave: that is the goal. With the SDK, it is measured on TDX, one question at a time, and streamed once from Node; in a browser, it is the next step.

The relay checks the Intel TDX proof and NVIDIA's GPU verdict at every session.

Yours, even on someone else's cloud.The host provides the machine. You stay in control.

Unreadable even to the host

Your data is decrypted only inside the enclave, once its proof is verified.

Verified on your side

The relay checks Intel's proof and NVIDIA's verdict on your machine. Nothing is taken on trust.

Your account, your keys

The VM runs in your cloud project and is deleted at the end. The session key leaves from your side.

Open source

The server under AGPL-3.0, the SDK under Apache-2.0.

Goal: the same chain on other clouds, and on your own servers.

The host keeps availability, and sees times, sizes and IP addresses. Today: Google Cloud, Intel TDX, NVIDIA H100.

What is left to do.

These measurements were made with test keys and a test relay. No image is published and no release key is pinned yet: the cloud path does not start from the sources yet.

Goal: end-to-end confidential, a published and signed image, an external audit.

What no enclave protects, such as physical attacks on memory or side channels, is listed in the documentation.

Read the limits

What is new.What changed recently.

All the changes
4 Nov 2026measured on hardware

Qwen3 runs on x0ne Core, our own GPU engine

x0ne Core runs Qwen3 on the GPU with its own kernels, compiled ahead of time, and replays one CUDA graph per generated token.

Read 4 Nov 2026measured on hardware

GPU inference inside the confidential VM

x0ne Core serves the model on the GPU inside the confidential VM, through this Engine: a test run on an H100, not a release.

Read 1 Nov 2026measured on hardware

Sealed answers streamed, VM to SDK, through the relay

The SDK streams a sealed answer from the VM; the relay on your machine passes each frame on unopened. Measured on hardware once.

Read

  1. One command opens the session.

    The confidential VM is created in your Google Cloud account, and deleted at the end of the session.

  2. The proof is checked on your machine.

    Processor, firmware, image, GPU, model: one line per check. The session key leaves only after VERIFIED.

  3. Your applications call it like OpenAI.

    The same API, on your machine. Every answer carries a receipt signed inside the enclave: TDX, the GPU that computed, the model.

$ x0ne-engine cloud up --model qwen3:32b --max-run 45m
x0ne Engine cloud: Google Cloud, project ••••••••
[1/5] Creating x0ne-engine-4ac737 in us-central1-a ... done (42 s)
[2/5] Waiting for boot and GPU setup ... done (0 s)
[3/5] Checking the hardware proof on THIS machine. No question and no session key have been sent yet.
[3/5] Checking the hardware proof on THIS machine. No question and no session key have been sent yet.
attestation document received; checking it on this machine, no question and no session key sent yet
CPU Intel TDX quote genuine, TCB UpToDate / QE UpToDate, TDX module identity matched (Intel PCS, fetched now)
Firm Google-endorsed firmware (MRTD c1ee9c16..., svn 2, signed … CN=GCE-uefi-signer …)
Image x0ne-cvm 0.2.3 (… TEST key, not for release): RTMR1, RTMR2 match the reference; RTMR3 empty; RTMR0 reported
GPU 1 GPU(s), confidential computing on (NRAS token, nonce bound to this session)
Link TLS key and your session config are bound to this quote
Model qwen3:32b, digest 745f026c... matches the catalog
VERIFIED. Limits: x0ne-engine cloud status --limits
[4/5] Releasing the session key to the verified VM ...
verdict VERIFIED; sending the session key over the attested channel
key accepted; waiting for the TD to load the model
[5/5] OpenAI API on http://127.0.0.1:8478/v1
34 min left. Ctrl-C stops the session and deletes the VM.
Your application, for example
$ curl -s http://127.0.0.1:8478/v1/chat/completions \
-H "Authorization: Bearer $(cat "$XDG_RUNTIME_DIR/x0ne-engine/local.key")" \
-H "Content-Type: application/json" \
-d '{"model": "qwen3:32b",
"messages": [{"role": "user", "content": "…"}]}'

127.0.0.1 is your machine's local address: the call does not leave it, and it requires your key. The relay then encrypts it with TLS 1.3, bound to the proof.

Response received on 18 October 2026, excerpt
{
"object": "chat.completion",
"model": "qwen3:32b",
"choices": [ … ],
"usage": { "prompt_tokens": 20, "completion_tokens": 256, … },
"x0ne": {
"receipt": {
"compute_device": "cuda:0",
"execution": { "environment": { "ConfidentialVmWithGpu":
{ "cpu": "IntelTdx", "gpu_mode": "On" } }, … },
"isolation": {
"requests_batched_across_clients": false,
"prefix_cache_shared_between_sessions": false,
"kv_cache_shared_between_requests": false
},
"model_digest_hex": "745f026c…",
"signature_hex": "3e0bec1b…", …
},
"receipt_verified": true
}
}

A use case to protect?

Health data, contracts, code, HR data: let's talk about your case.

contact@x0ne.co Technical documentation