Updated October 19, 2026. Reviewed and revised for current information.
Image: Official Privatemode documentation introduction, captured October 19, 2026. The visible architecture and security statements are the provider’s explanation; no API, attestation or security test was performed.
Privatemode AI is a confidential AI service operated by Germany-based Edgeless Systems. It offers a browser chat app and an inference API for open-weights models, with a design centered on protecting prompt and response content during cloud AI processing. Developers can also connect supported coding assistants and applications through its SDK or proxy.
The important distinction is how the connection is made. Privatemode’s client-side SDK and proxy support encryption and remote attestation. Its simpler proxyless endpoint has a different trust model. Buyers should evaluate the integration they will actually use rather than treating every access method as having identical security properties.
How does Privatemode protect AI requests?
According to the encryption documentation, the client encrypts prompt content before transmission. An attested worker decrypts it inside a confidential-computing environment to run inference, then encrypts the response for the client. Hardware-backed memory protection is intended to isolate processing from infrastructure operators. This is not a claim that an AI model computes directly on ordinary application-layer ciphertext.
Remote attestation checks the backend against expected measurements before a protected client sends data. Public source code and reproducible builds provide further verification options. These are provider-described architecture properties, not an independent security certification by GPTOnline.
Security boundaries worth understanding
- Metadata is separate from content: the service can see information needed to route and account for requests, including model identifiers, token usage and timestamps. Its published retention information also covers operational metadata.
- The client device still matters: a compromised computer or tampered client can expose information before encryption. Hardware and trusted-code assumptions also remain part of the threat model.
- The proxyless API has a trade-off: its documentation says it provides memory encryption without client-side remote attestation. For cryptographically verifiable protection against provider access, it directs developers to the SDK or proxy.
- The hosted web app adds trust dependencies: its documentation identifies Edgeless Systems and Cloudflare as part of the trusted computing base for delivery of the browser client. Self-hosting is documented for teams that need a narrower trust boundary.
Read the threat model, proxyless API warning and web app notes before using the service for confidential work. No cloud service should be described as providing absolute security or eliminating every possible exposure.
Features and supported workflows
- Browser chat: try available models in a familiar chat interface. The documentation says chat history is stored locally on the device. File handling depends on the selected model and the app’s current limits.
- Application integration: the API supports OpenAI- and Anthropic-compatible interfaces. JavaScript and TypeScript projects can use the Privatemode SDK; other tools can connect through a local proxy.
- Different model tasks: the current catalog includes chat, embeddings, speech-to-text and an OCR preview. Model availability and supported inputs vary, so consult the current model list rather than relying on an old set of model names.
- Organization administration: the portal manages accounts, usage and billing. Enterprise offerings list options such as SSO, custom SLAs, integration support and custom models.
Possible uses include document assistance, internal knowledge tools, transcription and coding workflows where a team wants a verifiable content-protection design. Output quality still depends on the selected model and task; confidentiality does not establish that an answer is correct.
Pricing, free allowance and billing
As checked on October 19, 2026, the official pricing page lists a no-card Free tier with an initial 5 million chat tokens. Its FAQ also states an additional 1 million tokens each month. Paid self-service access is usage-based, with different rates for model inputs, outputs, cached tokens and other task types. It is not one flat monthly chat subscription.
For example, the page lists gpt-oss-120b at €0.20 per million input tokens and €0.65 per million output tokens, plus VAT where applicable. Other models have different rates, so those figures are not a universal price for the platform. Enterprise pricing is available on request, with optional seat-based arrangements shown in the plan comparison.
The billing documentation says regular pay-as-you-go invoice periods and monthly spending limits follow calendar months. Check your organization’s allowance, rate limits and billing configuration before production use.
Who should evaluate Privatemode?
Privatemode is relevant to developers and organizations that want cloud AI while assessing data confidentiality and verification in detail. The provider states that prompts and responses are processed in the EU and are not used for training. These statements do not automatically make every customer workflow compliant: review the data-processing and retention details, the intended integration and your own obligations.
This overview is based on public documentation. It does not report penetration testing, independent verification of the deployed service, or a guarantee of suitability for a particular regulated use.
