NEAR AI Cloud puts private inference in Intel and NVIDIA TEEs

NEAR AI Cloud is now serving open-weight models inside hardware trusted execution environments, with Intel Trust Domain Extensions on the CPU side and NVIDIA GPU enclaves on the compute side. The pitch: nobody — not NEAR, not the host, not the model provider — can read your prompts, and you can check that claim cryptographically instead of taking it on faith.

Key facts

• Every TEE-hosted response is signed by a key generated inside the enclave that, per NEAR's verification docs, never leaves the hardware.
• Attestation reports assert the workload runs on genuine NVIDIA H100/H200 GPUs in confidential-computing mode inside an Intel TDX confidential VM.
• TLS terminates inside the TEE, not at an external load balancer, in both gateway and direct-completions modes.
• The API is OpenAI-compatible at cloud-api.near.ai, per the quickstart — existing SDKs work with a base-URL swap.
• Proxied third-party models (OpenAI, Anthropic, Gemini) are available through the same gateway but explicitly carry no TEE guarantee.

What happened

NEAR AI Cloud has been documenting its private-inference stack for months, but the current push — promoted this week by NEAR Protocol's official channels — puts the TEE architecture front and center as the product's reason to exist. The stack has three layers worth understanding.

First, isolation. Intel TDX creates a confidential virtual machine that seals the workload's memory from the host hypervisor. NVIDIA's confidential-computing mode extends that seal onto H100 and H200 GPUs, so model weights and activations stay encrypted in use. NEAR's private inference guide states the design goal plainly: prompts, weights, and outputs stay hidden from the infrastructure provider, the model provider, and NEAR itself.

Second, termination. In most hosted-AI stacks, TLS ends at a load balancer and the request travels the last hop in plaintext. NEAR terminates TLS inside the TEE in both of its connection modes — the gateway path through cloud-api.near.ai (itself a TEE) and direct per-model endpoints like qwen35-122b.completions.near.ai. An opt-in flag, include_tls_fingerprint=true, binds the TLS certificate into the attestation report so a client can prove its own session ended inside the enclave.

Third, proof. Each enclave generates a signing key at init; the private half never leaves the hardware. Hardware attestation reports — NVIDIA and Intel — bind that key to a specific, genuine TEE configuration, and every inference response is signed. NEAR publishes a verification example repo and a fuller verifier so clients can check the chain themselves.

Why it matters

Private inference has been a policy business: providers promise zero retention and users trust the promise. TEE-based serving shifts the claim from policy to proof — the difference between "we don't look" and "looking is not available to us." Our explainer on confidential AI inference maps the provider field; NEAR's entry matters because it packages attestation as a first-class, documented API feature rather than an enterprise add-on, and it does so for open-weight models — GLM, Qwen, and others in the TEE-hosted catalog — rather than a single proprietary stack.

The honest caveat, and it is not a small one: these are NEAR's claims about its own system. The attestation path is public and reproducible in principle, but we have not independently run the verifier against a production enclave. The guarantee also stops exactly where NEAR says it stops — third-party proxied models are out of scope, and the trust root moves to Intel and NVIDIA's silicon, which is a concentration risk of a different kind. Builders choosing where to run sensitive workloads should read this as "verifiable by design, pending your own verification," not as a settled fact.

Background

TEE inference has been the preserve of smaller confidential-computing specialists — Phala, Oasis, and similar networks we track in our decentralized inference coverage — and of GPU-vendor reference stacks. NEAR is the largest crypto-adjacent ecosystem to put a consumer-grade, OpenAI-compatible API on top of the pattern, and it is explicitly pitching the same unified billing for both enclave-backed open models and proxied frontier models. That combination — one endpoint where the privacy tier is marked per model — is new at this scale, and it sets up a market test: whether builders will pay attention to the TEE flag in a model catalog the way they now check context length and price.

There is also a crypto-mechanics angle, handled matter-of-factly: NEAR documents a staking-for-inference scheme where staked NEAR rewards pay for usage. Whether that changes builder economics depends on rates we have not benchmarked; the verifiable story today is the attestation architecture, not the token layer.

What's next

Watch three things. First, whether NEAR publishes or opens its attestation verifier results for third-party reproduction — that is the step that would move the claims from self-report to checkable fact. Second, whether other OpenAI-compatible providers mark per-model privacy tiers the same way. Third, the EU AI Act compliance calendar is tightening this quarter, and hardware-attested data handling is the kind of control enterprise buyers start asking for in procurement; if that demand shows up, expect more providers to ship attestation APIs rather than policy PDFs.