The regulated-team dilemma
Developers want AI coding agents. Compliance teams often forbid sending source code to any third-party model provider. Standing up a private GPU cluster solves the privacy problem but brings scarce hardware, specialized operators and models that lag the frontier by months. Many regulated organizations simply do nothing and fall behind.
GitLab Duo Self-Hosted can now use Privatemode as its model provider. Privatemode runs state-of-the-art models inside confidential-computing hardware so prompts, source code and completions remain encrypted end-to-end, including during inference. Developers keep the same Duo features; the difference is that code never leaves an encrypted boundary that even the service operator cannot read.
Why contracts are not enough
AI coding assistance has moved past autocomplete. Agents review merge requests, refactor across files, generate and run tests, and drive multi-step flows as CI jobs. Every one of those features sends prompts and source code to a model. For banks, medical-device vendors, defense contractors and public-sector teams, that single fact can breach IP protections, data-processing agreements and sector rules.
NIS2, DORA, GDPR, BaFin supervision, BSI C5 and healthcare data rules all raise the bar on third-party risk and data sovereignty. GitLab Self-Hosted exists so code never has to leave a trusted perimeter. Adding AI should not quietly undo that guarantee.
Public SaaS is off the table. VPC or private-cloud services still hand plaintext to the operator and the underlying cloud provider; a contract is a promise, not a cryptographic guarantee. Running your own models keeps code private but is expensive and always behind the best available models.
Confidential computing as the guarantee
Confidential computing keeps data encrypted while it is being processed. A hardware trusted execution environment (TEE) isolates a region of CPU or GPU that even the operating system, hypervisor and machine operator cannot read. AMD SEV or Intel TDX on the CPU side, paired with NVIDIA Confidential Computing on the GPU, provide the isolation. Data is encrypted in transit and at rest with AES-256 and is only ever decrypted inside the TEE.
Remote attestation turns the promise into a verifiable guarantee. Before a client sends any data it asks the TEE to prove what code is running. The hardware produces signed cryptographic evidence. The client verifies that evidence against known-good values and only then establishes the encrypted channel. Verify first, send second.
Neither the AI service operator nor the cloud provider can see prompts, completions or context. The hardware will not let them.
Privatemode in practice
Privatemode is built by a Germany-based specialist in confidential-computing software. It exposes an OpenAI-compatible API; a client-side proxy handles attestation and encryption transparently so existing tools and SDKs continue to work. The current flagship coding model is Kimi K2.6 with 256K context; others are on the roadmap.
The product is already in production with Capgemini for regulated-industry clients, the German Federal Employment Agency, banks, insurers and defense organizations. Its cryptography is post-quantum-safe, defending against harvest-now-decrypt-later attacks.
How it plugs into GitLab Duo
GitLab Duo Self-Hosted talks to a self-hosted AI Gateway that forwards inference to any OpenAI-compatible endpoint. The Privatemode proxy is that endpoint. When a request arrives the proxy encrypts it before it leaves the network, verifies the remote TEE, and only then forwards the request. Decryption happens exclusively inside the confidential-computing environment. Inside Duo the developer experience for Code Suggestions, Chat, Code Review and agentic flows stays the same.
You run the AI Gateway and the proxy yourself. The setup is deployment-agnostic (Linux package, Docker or Kubernetes). The operational burden is ordinary infrastructure work, not GPU procurement or model operations.
Practical considerations
Agentic flows currently run as a beta feature; full support for model-specific issues is still on the roadmap. The extra cryptographic round-trip adds latency; GitLab recommends raising the AI Gateway timeout for slower self-hosted backends. The trust assumption narrows to the silicon and the attestation chain, which is smaller and more inspectable than trusting an operator not to look, but it is not zero.
Requirements are GitLab Self-Managed Premium or Ultimate, version 17.9 or later, with the Duo Enterprise add-on. Agentic flows need the Duo Agent Platform (generally available on 18.8+). Usage consumes GitLab credits under the bring-your-own-model rules.
The result is a path to modern AI coding agents that satisfies existing IP and data-protection policy without buying GPUs or standing up model operations, while still delivering the same Duo experience developers already know.