Confidential AI for GitLab Self-Hosted (opens in new tab)
Privatemode AI enables GitLab Duo Self-Hosted to provide modern coding agents without exposing source code to GitLab, a cloud provider, or an AI operator. It uses confidential computing and remote attestation to keep prompts, code, and completions encrypted even during inference, avoiding both the compliance risks of public AI services and the operational burden of running private GPU infrastructure. ## The productivity gap for regulated teams - GitLab Duo supports more than autocomplete, including: - Merge request reviews - Cross-file refactoring - Test generation and execution - Agentic workflows running in CI - These features normally require sending source code and prompts to an external model provider. - For organizations handling regulated software or proprietary intellectual property, that data transfer may violate contracts, regulations, or internal policy. ## Why self-hosting is difficult - Affected sectors include finance, healthcare, defense, government, and critical infrastructure. - Requirements may come from NIS2, DORA, GDPR, BaFin, BSI C5, healthcare rules, and broader data-sovereignty expectations. - Public AI SaaS is often unacceptable because code leaves the organization. - Private-cloud or VPC services reduce exposure but still require trusting the cloud and service operators with plaintext. - Running models internally preserves privacy but requires expensive GPUs, specialized staff, and ongoing model operations, while often lagging behind frontier models. ## Confidential computing as the solution - Confidential computing uses hardware-based trusted execution environments (TEEs) to encrypt data while it is being processed. - The architecture relies on technologies such as: - AMD SEV or Intel TDX for CPU protection - NVIDIA Confidential Computing for GPU protection - AES-256 encryption for data in transit and at rest - Remote attestation verifies that approved code is running inside the TEE before any data is sent. - Prompts, source code, context, and completions are decrypted only inside the protected environment. - The operator and underlying cloud provider cannot inspect the data through normal system or infrastructure access. ## Privatemode AI - Privatemode, developed by Germany-based Edgeless Systems, provides confidential inference through an OpenAI-compatible API. - Its client-side proxy manages encryption and remote attestation transparently. - Existing tools and SDKs using the standard `/v1` API can work without major changes. - The current highlighted coding model is Kimi K2.6 with a 256K context window; Kimi K3 and GLM are expected to follow. - The service is presented as production-ready and already used by public-sector, financial, defense, and regulated-industry organizations. - Its post-quantum-safe cryptography is intended to protect against “harvest now, decrypt later” attacks. ## GitLab Duo integration - GitLab Duo Self-Hosted connects to a self-hosted AI Gateway. - The Gateway forwards requests to the Privatemode proxy as an OpenAI-compatible endpoint. - The proxy: - Encrypts requests before they leave the organization’s network - Verifies the remote TEE through attestation - Forwards only after verification succeeds - Developers continue using Duo features such as Code Suggestions, Chat, Code Review, and agentic workflows without changing their experience. The recommended approach for regulated organizations is to combine GitLab Duo Self-Hosted with a confidential-computing provider such as Privatemode. This provides modern AI coding capabilities while replacing contractual privacy promises with hardware-enforced protection, without requiring the organization to operate its own LLM infrastructure.