> ## Documentation Index > Fetch the complete documentation index at: https://docs.meshrouter.app/llms.txt > Use this file to discover all available pages before exploring further. # MESH privacy classes > Four explicit privacy classes per call. The router enforces the class you ask for and refuses to silently downgrade. Every MESH request is classified into one of four privacy classes. The class controls upstream selection, logging behaviour, and the privacy block returned with the response. The router **enforces** the class — it cannot be silently downgraded. The class you ask for is the class served, or you get an explicit error. ## Classes | Class | Label | Meaning | | ---------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `standard_route` | Standard | Broad model access at the best speed and cost. MESH does not store prompts by default. Upstream privacy depends on the selected route. | | `protected_provider_route` | Protected | Sensitive workloads on frontier models. MESH does not store prompts by default and routes only through providers with stronger data-protection guarantees. | | `private_gateway_route` | Private Gateway | Protects requests from MESH-side logging and inspection. If a closed model is selected, that provider still processes the request through a protected route. | | `confidential_runtime_route` | Confidential | Runs eligible models inside a verifiable confidential runtime. No closed external model provider receives plaintext. | ## How to ask for a class Two ways. Both work on `/v1/chat/completions` today. **Preferred — 4-class taxonomy:** ```json theme={null} { "model": "mesh/claude-sonnet-4.6", "messages": [{ "role": "user", "content": "sensitive prompt" }], "privacy": { "class": "protected_provider_route" } } ``` **Legacy — `mode` (still accepted):** ```json theme={null} { "model": "mesh/claude-sonnet-4.6", "messages": [{ "role": "user", "content": "..." }], "privacy": { "mode": "mesh" } } ``` `mode: "standard"` maps to `standard_route`. `mode: "mesh"` maps to `private_gateway_route`. Both legacy aliases continue to work; new code should use `class`. ## bestAvailable Ask MESH to pick the strongest class the requested model actually supports: ```json theme={null} { "privacy": { "bestAvailable": true } } ``` The response tells you which class was selected. Today, a Bedrock-backed model with `bestAvailable: true` lands on `protected_provider_route`. An OpenRouter-backed model whose upstream has not been individually reviewed lands on `standard_route`. ## allowFallbackToLowerClass If you really need a model whose policy can't meet your requested class, opt in to a fallback: ```json theme={null} { "privacy": { "class": "protected_provider_route", "allowFallbackToLowerClass": true } } ``` The router uses the strongest class the model CAN serve. The actual class is in the response. If you didn't get what you asked for, you can refuse client-side. Without this flag, MESH returns HTTP 422 with `privacy_class_unavailable_for_model` instead of serving a weaker class. ## The privacy block on responses Every billable chat completion includes a `privacy` block: ```json theme={null} { "model": "mesh/claude-sonnet-4.6", "privacy": { "class": "protected_provider_route", "label": "Protected", "mesh_stores_prompts": false, "mesh_logs_prompts": false, "training_on_prompts": false, "upstream_disclosed": false, "guarantee": "Uses stricter upstream data-protection requirements. MESH does not store prompts by default and training on prompts is not allowed." }, "usage": { "...": "..." } } ``` `upstream_disclosed: false` is constant. MESH never tells users which upstream provider it routed to — the same model alias may be served from different upstreams over time. The privacy class is the durable guarantee. ## What each class enforces today | Property | Standard | Protected | Private Gateway | Confidential | | --------------------------------- | ------------------ | ------------- | ------------------- | ------------ | | MESH stores prompts | No | No | No | No | | MESH logs prompts | No | No | No | No | | Upstream training on prompts | Unknown by default | No (verified) | No | No | | Model provider receives plaintext | Yes / Unknown | Yes | Yes (closed models) | **No** | | MESH-side runtime can inspect | Yes | Yes | **No** | **No** | | Runtime attestation required | No | No | Optional | **Yes** | | Margin floor (default) | 15% | 20% | 25% | 30% | ## What each class is NOT We make a point of saying what we don't guarantee. * **Standard does not guarantee anything about the upstream's data policy.** It guarantees that *MESH* does not store prompts. The upstream provider may log according to its own policy. * **Protected does not run inference inside an enclave.** It selects an upstream path with verified no-training and no-provider-sharing guarantees. The model provider still processes the request. * **Private Gateway does not protect against the model provider.** It protects against MESH-side operators, logs, and infrastructure. If a closed model is selected, that provider still sees the request through the protected upstream path. * **Confidential is the only class where no closed external model provider receives plaintext.** It requires a MESH-controlled confidential runtime + verified attestation. Today this class is only available for open-weight models on the confidential runtime. ## Why upstream provider names are hidden We choose the upstream that gives the requested class at the lowest cost and best reliability. The same model alias may be served from different upstream paths on different calls. We do not disclose the upstream because: 1. The privacy class is the durable guarantee. The upstream choice is an implementation detail of meeting that class. 2. Routing decisions change as new providers come online and as policies evolve. Pinning to an upstream would lock customers to a single implementation. 3. We never let a vendor name on the response imply a stronger guarantee than the class we earned. Admin and debug surfaces can include upstream identity. Public `/v1/chat/completions` and `/v1/models` responses never do. ## Margin floors Each class has a configurable minimum margin in basis points. Routing below the floor returns HTTP 503 with `margin_floor_violated`. | Class | Default floor | Env var | | ---------------------------- | ------------- | ------------------------------------------ | | `standard_route` | 15% | `MESH_MIN_MARGIN_STANDARD_BPS=1500` | | `protected_provider_route` | 20% | `MESH_MIN_MARGIN_PROTECTED_BPS=2000` | | `private_gateway_route` | 25% | `MESH_MIN_MARGIN_PRIVATE_GATEWAY_BPS=2500` | | `confidential_runtime_route` | 30% | `MESH_MIN_MARGIN_CONFIDENTIAL_BPS=3000` | ## Class-specific markup (billing) In addition to the floors above, PG and Confidential calls are charged at a higher MARGIN RATE than the default `MESH_MARGIN_BPS=3000` (30%). This covers Nitro compute, attestation overhead, and the stricter SLOs that go with the stronger guarantee. | Class | Default margin rate | Env var | | ---------------------------- | ----------------------- | -------------------------------------- | | `standard_route` | 30% (`MESH_MARGIN_BPS`) | `MESH_MARGIN_BPS=3000` | | `protected_provider_route` | 30% (`MESH_MARGIN_BPS`) | `MESH_MARGIN_BPS=3000` | | `private_gateway_route` | 50% | `MESH_MARGIN_PRIVATE_GATEWAY_BPS=5000` | | `confidential_runtime_route` | 60% | `MESH_MARGIN_CONFIDENTIAL_BPS=6000` | A PG call therefore typically costs the user \~1.5× the equivalent Protected call on the same model, before any per-call infrastructure add-ons (KMS reads, vsock round-trip). The exact user-facing total is in the `usage.cost` field of the response and in the signed receipt. Loss-leader behaviour is opt-in via `MESH_ALLOW_LOSS_LEADER=true` and intended only for limited promotional windows. ## Routes that currently exist | Class | How many catalogue models qualify | How | | --------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Standard | All 88 | Default for every model. | | Protected | 45 | All Bedrock-backed routes. AWS Bedrock terms guarantee no provider data sharing and no training. | | Private Gateway | 0 | The PG dispatch path is fully built — chat handler → Nitro parent → enclave round-trip — together with class-aware billing (50% margin by default) and a runtime gate that requires `NITRO_PARENT_URL` + `nitroParentFetch` + `defaultNitroConfig.enabled` together. The policy claim itself stays deferred until TWO additional pieces land: (a) client-side prompt encryption so the API handler never holds plaintext, and (b) a non-mock vsock transport so an operator pointing `NITRO_PARENT_URL` at a default parent boot can't get zero-confidentiality echoes. Both are deliberate spec-level decisions: where the encryption boundary lives, and how production operators are prevented from a mock-default footgun. | | Confidential | 1 (Llama 3 8B on the confidential runtime) | The catalogue ships one open-weight model whose policy claims `supportsConfidentialRuntime: true` — `mesh/llama-3-8b-confidential`, served via `provider: 'confidential_enclave'`. The runtime gate additionally requires `defaultNitroConfig.enabled` AND `defaultNitroConfig.attestationEnforced` AND a non-mock parent transport. Without attestation enforcement the gate refuses with `503 privacy_class_runtime_unavailable`. | ### Runtime gate For runtime-dependent classes (PG, Confidential), the router checks TWO things: 1. **Static eligibility** — the upstream policy claims it (`supportsPrivateGateway: true` / `supportsConfidentialRuntime: true`, surfaced via `allowedPrivacyClasses`). 2. **Runtime availability** — the deployment has the infra wired. This reads `defaultNitroConfig` (in `@mesh/economics`), the SAME constant that controls whether the actual dispatch path runs through the Nitro parent + enclave. There is one source of truth; the privacy gate and the dispatch eligibility can never disagree. Both must hold for a per-request PG / Confidential call to succeed. If only the policy side holds, the router returns `503 privacy_class_runtime_unavailable` — distinct from the `422 privacy_class_unavailable_for_model` you'd get if the upstream policy itself can't back the class. ## Signed receipts Every response carries an Ed25519 receipt covering: * Request ID * Model alias (user-visible name, never the upstream) * Privacy class served * Token counts in/out * Cost in USD * Timestamp * Public-key signer ID The receipt does **not** include prompt or response content. Receipts are verifiable offline against the published signer public key — see [attestation](/reference/attestation) for the verification path. ## Errors | Status | Code | Meaning | | ------ | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 422 | `privacy_class_unavailable_for_model` | Requested class is not earnable by the selected model. Pass `allowFallbackToLowerClass: true` to accept a downgrade, or pick a different model. | | 503 | `privacy_class_runtime_unavailable` | Requested class is in-policy for this model but the runtime infrastructure (Nitro / attestation) is not currently wired on this deployment. Try again later, request a weaker class, or set `allowFallbackToLowerClass: true`. | | 503 | `margin_floor_violated` | Selected route is below the configured margin floor for the served class. Set `MESH_ALLOW_LOSS_LEADER=true` to bypass. |