AI Potluck
Contribute
Back to Gap Map Infrastructure / Deployment

OpenPCC

Confident Security
source available / Overall score: 2.8

OpenPCC is a standard and reference implementation for verifiably private AI inference, modeled on Apple's Private Cloud Compute but vendor-neutral and self-deployable. Each request is encrypted end to end, the serving node attests its TPM and GPU beforehand, and Oblivious HTTP keeps the provider from linking requests to a user. Confident Security maintains the Go client, a C library behind the Python and JavaScript clients, and a separate compute-node repository.

The compute node lives in a second repository, confidentsecurity/confidentcompute, so the declared artifact covers only the client half of the standard.

Openness

2 high confidence
2.0
license
Apache-2.0(OSI, the openpcc reference client and SDKs)+FSL-1.1-ALv2(the confidentcompute compute node, converting to Apache-2.0 later)
source
public(github.com/openpcc/openpcc + confidentsecurity/confidentcompute + spec/whitepaper)
core features withheld
no

The OpenPCC reference client and SDKs are Apache-2.0, but the compute node that actually runs inference, published separately as confidentcompute, is under the Functional Source License FSL-1.1-ALv2. That license forbids competing uses until each version converts to Apache-2.0, and the compute node is half of the standard, so the product as released is source-available. Confident Security sells a managed service, CONFSEC, built on the same standard.

Adoption

2 low confidence
2.0

OpenPCC has drawn early interest as a GitHub project, but no primary source names an outside production deployment. The only consumer identified is Confident Security's own CONFSEC service, the vendor rather than an adopter, and the reference implementation has had no recent commits.

  • https://api.github.com/repos/openpcc/openpcc recorded 2026-08-13

    Repository metadata - 948 stars, 31 forks, public and not archived, last push 2026-01-08, description "An open-source framework for verifiably private AI inference"

  • https://cloudsecurityalliance.org/blog/2025/11/13/introducing-openpcc recorded 2026-08-13

    Launch write-up dated 11/13/2025, originally published by Confident Security, announcing OpenPCC as a standard with "a fully-featured Apache 2.0 open-source implementation written in Go" and closing on an open waitlist. It names no adopter or deployment.

Capability

4 medium confidence
4.0

OpenPCC's reference implementation covers encrypted streaming, TPM and GPU hardware attestation, unlinkable requests over Oblivious HTTP, a transparency verifier, and provider-agnostic model routing through Go and C-based clients. It is not scored higher because the project is young, with no documented production adopters and no proven scale beyond its own reference deployment.

  • https://cloudsecurityalliance.org/blog/2025/11/13/introducing-openpcc recorded 2026-08-13

    Establishes the standard and the anonymization scheme - OpenPCC "describes a system for inference on private or otherwise sensitive data such that inputs and outputs remain completely hidden from all participants", with an anonymization scheme against API timing, payment and metadata side channels, a whitepaper, and "a fully-featured Apache 2.0 open-source implementation written in Go". It does not itemize TEEs, attestation, transparency logs or client SDKs.

  • https://raw.githubusercontent.com/confidentsecurity/confidentcompute/main/compute-images/README.md recorded 2026-09-29

    The compute-images README describes the hardened node image, "The `compute-base` image is the hardened base image used for the CONFSEC compute worker", with dm-verity, dm-crypt, dm-integrity, SELinux and IMA, where the "hardened security measures including SELinux enforcing, ima appraisal, dm-verity are only active at instance provisioning time".

  • https://raw.githubusercontent.com/confidentsecurity/confidentcompute/main/README.md recorded 2026-09-29

    The Confident-Compute README says compute_boot "is responsible for attesting to the TPM, GPU, and other hardware components" and compute_worker "is responsible for decrypting the request, sending it to the LLM, and encrypting the response".

  • https://raw.githubusercontent.com/openpcc/openpcc/main/README.md recorded 2026-09-29

    The OpenPCC README scopes the reference implementation as "enforcing privacy with encrypted streaming, hardware attestation, and unlinkable requests", uses Oblivious HTTP so "compute providers cannot learn about individual user actions", configures a "transparency.DefaultVerifierConfig()" verifier, and routes requests with a tag "to route request to compute nodes that are running the specified model".

Verified 2026-09-29, except some scores, still awaiting re-confirmation