AI Potluck
Infrastructure / Deployment

OpenPCC

Confident Security

OpenPCC is a standard and reference implementation for verifiably private AI inference, modeled on Apple's Private Cloud Compute but vendor-neutral and self-deployable. Each request is encrypted end to end, the serving node attests its TPM and GPU beforehand, and Oblivious HTTP keeps the provider from linking requests to a user. Confident Security maintains the Go client, a C library behind the Python and JavaScript clients, and a separate compute-node repository.

The compute node lives in a second repository, confidentsecurity/confidentcompute, so the declared artifact covers only the client half of the standard. Verified 2026-08-13 via the OpenPCC and Confident-Compute READMEs, the LICENSE body, and the Cloud Security Alliance launch write-up.

Openness

5 high confidence
5.0
license
Apache-2.0(OSI)
source
public(github.com/openpcc/openpcc + spec/whitepaper)
core-gated
ungated

Fully OSI-licensed (Apache-2.0) across the reference implementation and related repos, with the spec and whitepaper public. Confident Security runs a commercial managed service (CONFSEC) on top, but that is an open-core business model around a fully open standard rather than open-core licensing. The compute-node half is published rather than withheld: confidentsecurity/confidentcompute carries the compute_boot, router_com and compute_worker binaries plus the Packer image build, so the part that actually runs the inference is open, and the OpenPCC README frames the project as "deployable on your own infrastructure". CONFSEC remains a managed service Confident Security sells on top, mentioned but not required, which is why nothing in the core counts as gated.

Adoption

2 low confidence
2.0

Launched on 5 November 2025 with a $5M seed (Decibel, Ex/Ante, South Park Commons, Halcyon, SAIF), and carries about 940 GitHub stars - notable for a young infrastructure project - but no production adopters are documented in primary sources. Early stage. The only named consumer is Confident Security’s own CONFSEC managed service, which is the vendor rather than an adopter: neither the README nor the launch write-up names a production deployment, and the launch post closes on an open waitlist rather than on customers. The reference implementation has also gone months without a push, which does not on its own move a level-2 reading resting on reported traction, but is the kind of signal that usually precedes one moving.

  • https://api.github.com/repos/openpcc/openpcc recorded 2026-08-13

    Repository metadata - 948 stars, 31 forks, public and not archived, last push 2026-01-08, description "An open-source framework for verifiably private AI inference"

  • https://cloudsecurityalliance.org/blog/2025/11/13/introducing-openpcc recorded 2026-08-13

    Launch write-up dated 11/13/2025, originally published by Confident Security, announcing OpenPCC as a standard with "a fully-featured Apache 2.0 open-source implementation written in Go" and closing on an open waitlist. It names no adopter or deployment.

Capability

4 medium confidence
4.0

Broad, well-architected confidential-serving stack with attestation plus anonymization that goes beyond plain confidential compute. Not top because it is young, with limited proven scale and no documented production adopters. The itemized scope comes from the repositories rather than from the launch write-up, which is a motivation and standards piece establishing the anonymization scheme against timing, payment and metadata side channels and the Apache-2.0 Go implementation, and nothing more granular. The OpenPCC README carries encrypted streaming, hardware attestation and unlinkable requests over Oblivious HTTP, a transparency verifier with an identity policy, a Go client plus a C library underlying the Python and JavaScript clients, and OpenAI-format completions against an arbitrary tagged model, which is the provider-agnostic claim; the compute-node repository adds the attestation target explicitly, with compute_boot attesting to the TPM, GPU and other hardware before the router starts. One detail does not re-derive: the prototype on Intel TDX and an H100 serving Llama-3 8B on vLLM appears on none of the cited pages, whose worked example runs qwen3:1.7b. The score does not rest on it.

  • https://raw.githubusercontent.com/openpcc/openpcc/main/README.md recorded 2026-08-13

    Technical scope of the reference implementation - "encrypted streaming, hardware attestation, and unlinkable requests"; an OHTTP Gateway operated by the deployment with a third-party OHTTP Relay; a transparency verifier configured with an OIDC identity policy; a Go client plus a C library used as the basis of the Python and JavaScript clients; in-memory services for local development; and OpenAI-format completion requests routed to nodes by model tag.

  • https://raw.githubusercontent.com/confidentsecurity/confidentcompute/main/README.md recorded 2026-08-13

    compute_boot "is responsible for attesting to the TPM, GPU, and other hardware components" before router_com starts, and compute_worker decrypts each request, sends it to the LLM and encrypts the response - the CPU-and-GPU attestation and per-request encryption the band rests on

  • https://cloudsecurityalliance.org/blog/2025/11/13/introducing-openpcc recorded 2026-08-13

    Establishes the standard and the anonymization scheme - OpenPCC "describes a system for inference on private or otherwise sensitive data such that inputs and outputs remain completely hidden from all participants", with an anonymization scheme against API timing, payment and metadata side channels, a whitepaper, and "a fully-featured Apache 2.0 open-source implementation written in Go". It does not itemize TEEs, attestation, transparency logs or client SDKs.

Verified 2026-08-13