docs/models.md

# Models

The co-op serves models from multiple providers. This is the single list — both
the chat and the API draw from it, so it's the one place to look (and the one
place to update).

## Providers

Models are named `provider/model-name`, so you can choose not just *which* model
but *where* it runs. Providers differ along two independent axes: **privacy**
(how protected your prompts and responses are) and **green energy** (how the
compute is powered). These are gradations, not binary switches — and no
provider today is best on both.

| Provider | Value | Privacy | Green energy | What that means |
|---|---|---|---|---|
| **Tinfoil** | *private* | **Strongest — architectural** | Not a green claim | Runs in hardware enclaves (TEEs) with end-to-end encryption (EHBP), verifiable via remote attestation. Neither we nor Tinfoil can read your prompts or responses at inference time. Energy mix is not disclosed. |
| **GreenPT** | *green* | **Policy-based** | **Strongest — 100% renewable** | Standard (non-enclave) hosting in the EU; privacy rests on GreenPT's commitments and EU data rules, not on cryptography. Compute runs on 100% renewable energy. |
| **Regolo** | *green* | Policy-based — **zero data retention** | **100% renewable** | EU-hosted (Italy, Seeweb) with a stated zero-data-retention policy: prompts are not stored or reused. Compute runs on 100% renewable energy. |

**Reading the gradations:**

- **Privacy:** *architectural* (Tinfoil) beats *policy-based* (GreenPT,
  Regolo). An enclave protects you even if the provider is compromised; a
  policy protects you only as far as the provider keeps its word. Both are
  better than a provider with neither — and Regolo adds a written
  zero-data-retention commitment on top of its policy.
How the co-op measures its own energy use and carbon emissions is on the
[energy and carbon page](energy.md) — including what those figures cover and what
they miss.

- **Green energy:** *100% renewable* (GreenPT, Regolo) beats *undisclosed*
  (Tinfoil). GreenPT and Regolo both run on 100% renewable energy; Tinfoil's
  mix is not disclosed.

Trade-offs are real: the most private option (Tinfoil) isn't the greenest, and
the greenest option (GreenPT) isn't the most private. The point of the co-op is
that **you choose** which axis matters more for a given task.

**How to pick, quick guide:**

- **Default** → `greenpt/deepseek-v4.1-flash`: DeepSeek's efficient multimodal
  reasoning model on renewable energy, and the model the chat starts on. For the
  TEE-protected (private) version of the same model, use `tinfoil/deepseek-v4-1-flash`.
- **Everyday chat and drafting** → a fast model: `greenpt/glm-5.3-flash`.
  These handle the bulk of what people use chat for, at a fraction of flagship
  cost.
- **Hard reasoning, coding, agentic work** → a flagship: `greenpt/glm-5.3`
  (renewable) or `tinfoil/glm-5.3` (TEE-protected) — the GLM flagship on the
  provider of your choice — or `tinfoil/deepseek-v4-1-flash` for long documents
  and tool-driven tasks.
- **Images in, text out (vision)** → `tinfoil/deepseek-v4-1-flash` or the
  Apertus models — see the ✅ in the table below.
- **Cheap and cheerful** → `tinfoil/gpt-oss-120b` or `greenpt/glm-5.3-flash`.
- **Model origins matter to you** → the Apertus models (publicly developed;
  see below).

## Current models

Pricing is per 1 million tokens, input / output / **cached input** (what the
co-op pays the provider — your own cost is your monthly allowance, not
per-token billing). The cached-input rate applies when a model reuses a
shared prompt prefix (multi-turn conversations, agent loops); most providers
charge a steep discount for it. Models with `—` don't offer a distinct
cache-read price. **Vision** means the model accepts images as input
(screenshots, photos, documents to reason about). **Image generation** is
available via the chat's image feature (the 🎨 button) using
`regolo/qwen-image`.

The emoji in the model name marks its **value tier** (the same icons used in the chat picker):

- 🔒 **Private** — Tinfoil: architecturally private (TEE enclaves)
- 🌱 **Green** — GreenPT and Regolo: renewable-powered EU hosts (Regolo adds
  a zero-data-retention commitment). The 🌱 emoji marks renewable-powered
  providers, not a specific company.

| Model | Provider | Privacy | Green | Vision | Context | Pricing (in / out / cached) | Notes |
|---|---|---|---|---|---|---|---|
| `🌱 greenpt/deepseek-v4.1-flash` | GreenPT | policy | ✅ 100% renewable | ✅ | 1M | $0.22 / $1.10 / $0.011 | **Default.** DeepSeek's multimodal reasoning model, renewable energy; TEE twin below. |
| `🔒 tinfoil/deepseek-v4-1-flash` | Tinfoil | architectural | undisclosed | ✅ | 1M | $0.65 / $1.45 / $0.13 | TEE-protected version of the default; image input, tool calling, long docs/agents. |
| `🔒 tinfoil/glm-5.3` | Tinfoil | architectural | undisclosed | — | 1M | $1.80 / $5.75 / $0.45 | GLM flagship, TEE-protected; strongest private-tier model for agentic coding and long-horizon tasks. |
| `🔒 tinfoil/gpt-oss-120b` | Tinfoil | architectural | undisclosed | — | 131K | $0.15 / $0.60 / — | Lightweight open-weight reasoning; cheapest private tier. |
| `🌱 greenpt/glm-5.3-flash` | GreenPT | policy | ✅ 100% renewable | — | 1M | $0.11 / $0.44 / $0.022 | Fast GLM model, renewable energy. |
| `🌱 greenpt/glm-5.3` | GreenPT | policy | ✅ 100% renewable | — | 1M | $1.10 / $4.40 / $0.275 | GLM flagship — strongest agentic model in the green tier. |
| `🌱 regolo/apertus-70b` | Regolo | policy + ZDR | ✅ 100% renewable | ✅ | 262K | $0.46 / $2.44 / — | Fully open sovereign model (Apache-2.0), large/capable, image understanding. |
| `🌱 regolo/qwen3.5-122b` | Regolo | policy + ZDR | ✅ 100% renewable | ✅ | 262K | $1.16 / $4.87 / — | Large vision+reasoning MoE (Qwen 3.5, 122B-A10B); 262K context. |

Vision is verified working through the co-op gateway (base64 image input via
`/v1/chat/completions`, standard OpenAI format). In the chat UI, just attach
an image to your message while using a ✅ model.

Context figures are measured the same way, through the gateway. Where a
provider's public catalog advertises a smaller limit than the model actually
accepts, the measured figure is the one shown here.

**Reading the Privacy column:** *architectural* means the protection is built
into the infrastructure (TEE enclaves) — even the provider can't read your
prompts. *Policy* means the provider commits, by contract and policy, not to
store or reuse your data. *ZDR* (zero data retention) is a stronger policy:
the provider keeps no copy of prompts or outputs at all after the response is
delivered.

**Same model, two providers:** `glm-5.3` (Z.ai's GLM flagship) is offered both
on GreenPT (renewable, $1.10/$4.40) and on Tinfoil (TEE-protected, $1.80/$5.75)
— pick the axis that matters to you. The fast `glm-5.3-flash` variant is
GreenPT-only (Tinfoil deprecated their flash variant in October 2026).

### Audio models

These are **not chat models** — they power the chat's voice mode (dictation
and spoken replies) and are available through the API on `/v1/audio/*` routes
for members building speech into their own tools. They're hidden from the chat
model picker to avoid confusion.

| Model | Provider | Use | Pricing |
|---|---|---|---|
| `🔒 tinfoil/whisper-large-v3-turbo` | Tinfoil | Speech-to-text | $0.05 / 1M input tokens |
| `🔒 tinfoil/voxtral-tts` | Tinfoil | Text-to-speech | listed $0 (verify on invoice) |

Both run inside Tinfoil's enclaves, so voice data gets the same architectural
privacy as the private chat models. TTS voices available: `neutral_female`,
`neutral_male`, `casual_female/male`, `cheerful_female`, plus French, German,
Spanish, Italian, Portuguese, Dutch, and Hindi variants.

```bash
# Speech-to-text
curl https://gateway.inference.coop/v1/audio/transcriptions \
  -H "Authorization: Bearer ***" \
  -F file=@your-audio.mp3 \
  -F model=tinfoil/whisper-large-v3-turbo

# Text-to-speech (returns WAV audio)
curl https://gateway.inference.coop/v1/audio/speech \
  -H "Authorization: Bearer ***" \
  -H "Content-Type: application/json" \
  -d '{"model": "tinfoil/voxtral-tts", "input": "Hello from the co-op", "voice": "neutral_female"}' \
  --output speech.wav

# Vision (image input to a multimodal chat model)
curl https://gateway.inference.coop/v1/chat/completions \
  -H "Authorization: Bearer ***" \
  -H "Content-Type: application/json" \
  -d '{"model": "tinfoil/deepseek-v4-1-flash", "messages": [{"role": "user", "content": [
        {"type": "text", "text": "What is in this image?"},
        {"type": "image_url", "image_url": {"url": "data:image/png;base64,..."}}
      ]}]}'
```

### Image generation

`🌱 regolo/qwen-image` (Regolo, EU-hosted, zero data retention) generates
images from a text prompt. In the chat, press the **Integrations** button
below the message box, choose **Image**, and describe what you want — the
generated image appears in the conversation. Via the API:

```bash
curl https://gateway.inference.coop/v1/images/generations \
  -H "Authorization: Bearer ***" \
  -H "Content-Type: application/json" \
  -d '{"model": "regolo/qwen-image", "prompt": "a watercolor painting of a mountain lake", "n": 1, "size": "512x512"}'
```

The response returns base64-encoded JPEG(s). Billed per pixel generated.

### About the Apertus models

Apertus is the **Swiss AI Initiative's** open foundation model, built by a
public collaboration between **EPFL, ETH Zurich, and the Swiss National
Supercomputing Centre (CSCS)**. It's "fully open" in the strict sense — not just
downloadable weights:

- **Open weights & code** — released under the **Apache-2.0** license, so anyone
  can use, modify, and redistribute it, commercially or not.
- **Open training data** — trained only on *fully open* data (unlike most
  proprietary models, which keep their training set secret). The data, code,
  methods, and alignment principles are all published and reproducible.
- **Open values** — governed by a public **Apertus Charter** that documents the
  model's values and principles rather than leaving them implicit.
- **Sovereign & public-good** — designed to European data-protection norms
  (GDPR, EU AI Act, Swiss law) as an example of "AI as a public good," not a
  proprietary product. Trained across 1,500+ languages (40% non-English).

The v1.5 generation adds image understanding, a longer 262K-token context
window, improved tool use, and instruction-following. It's the *publicly
developed* counterpart to the private (Tinfoil) and renewable (GreenPT)
offerings — sovereignty as a third axis of member choice.

For more information on open-source AI and the Apertus models, see the
[European Open Source AI Index](https://osai-index.eu/database/).

*Source: [apertus-ai.org](https://www.apertus-ai.org/) and the
[Swiss AI Hugging Face](https://huggingface.co/swiss-ai) model cards.*

Some models also have a discounted cached-input rate (when a prompt is reused
and doesn't need to be re-read) — see the `code/litellm` config for the exact
numbers. Pricing here mirrors the `model_info` in the LiteLLM config
(`code/litellm/config.yaml`), which is the authoritative source — the two are
kept in sync.

## Limitations on privacy

Only **Tinfoil** offers architectural privacy. The other providers are chosen
for their value (renewable energy, public models) but do not run in enclaves —
prompts and responses pass through them in the ordinary way. Your **chat
history** is also stored on our server so you can revisit it, and that stored
history is not encrypted in a way that prevents us from technically reading it —
we commit not to. Requests made through the **API** with your own key are a
different matter: those are **not stored on our side at all**, beyond the usage
record needed for metering ([API access](api-access.md)). The full distinction —
what's architecturally private versus what's a policy commitment — is in the
[Privacy Policy](privacy-policy.md).