Solana Confidential Compute: Private AI, Verified Onchain

AI becomes more useful with more context. Often, that context is the information we need to protect most: personal conversations, internal documents, proprietary code, or a trading strategy.

Building applications around that information raises two questions: how do you protect it while an AI model works with it, and how can someone independently check the infrastructure doing the work?

Introducing Solana Confidential Compute, an open-source SDK and on-chain verification program built by the Nito (opens in a new tab) team in coordination with the Solana Foundation. It verifies hardware attestations and publishes a record on Solana that applications, agents, and users can inspect.

Nito is bringing this infrastructure to its private AI platform (opens in a new tab). Other developers can use the same building blocks for their own applications. Solana Confidential Compute is available in beta on Solana devnet (mainnet coming soon).

What Solana Confidential Compute does

Confidential computing protects data while it is being processed.

It uses trusted execution environments, or TEEs: hardware-backed environments designed to isolate code and data from the surrounding system, including the host operating system and infrastructure operator.

The hardware can also produce an attestation, a signed report containing evidence about the environment and measurements of the software running inside it.

Solana Confidential Compute brings verification of that evidence onchain. Its verification program checks the report and creates a public record that other applications can consult.

The AI computation happens offchain. Solana holds the verification record. Publishing that record does not require publishing the conversation or the private inputs.

How it works

1. A machine inside a confidential VM generates a signing key. The key exists only inside that hardware.
2. The hardware signs a report that binds the key to a recent Solana slot.
3. Solana Confidential Compute’s onchain program verifies the report. It records the key, the hardware type and an expiry date.
4. The machine signs the answers it produces with that key. Anyone receiving an answer can check the signature, then look up the key’s record on Solana.

Why Solana

Solana is the best ecosystem to build on-chain AI products. It’s fast and cheap enough for AI apps and agents to use all day, and it’s where many AI agents with wallets already live. With Solana Confidential Compute, the proof sits on the same chain as those agents and programs, so they can check that an answer came from a verified TEE before they act on it.

Solana Confidential Chat

Confidential Chat is a private AI platform that runs open-weight models inside confidential hardware.

For encrypted chats, the user’s device encrypts the prompt, and the protected environment decrypts it. The response is encrypted before returning to the device. Nito’s gateway relays the encrypted messages without the keys to read their contents.

Nito verifies its confidential hardware with Solana Confidential Compute, which publishes a record that any application can check.

The broader opportunity extends beyond chat: personal assistants working with sensitive context, tools processing confidential business information, and agents whose strategies need to remain private.

Try Solana Confidential Chat (opens in a new tab). If you’re a developer, you can start building with Confidential Chat here (opens in a new tab).

What else you can build with Solana Confidential Compute

Any Solana program can use the same record for a wide variety of use cases, including but not limited to:

• an AI judge for prediction markets or insurance claims, where the contract pays out only on a ruling signed by a verified machine;
• trading agents whose orders execute only if they came from the verified model;
• AI governance decisions, accepted only from a verified model.

Start building

Solana Confidential Compute is open source and in beta on Solana devnet (mainnet coming soon). It includes an SDK and an onchain verification program for Intel TDX and AMD SEV-SNP attestations, with NVIDIA GPU attestation in progress. It hasn’t been audited yet, so use it for development for now.

The Nito team, including engineers who joined from Switchboard, built Solana Confidential Compute in coordination with the Solana Foundation.

Start building with Solana Confidential Compute (opens in a new tab)