Private Processing is Meta's server system for AI features in WhatsApp.
Meta reports that it runs requests in confidential virtual machines on AMD SEV-SNP processors with NVIDIA Hopper GPUs. In Meta's description, the client checks the server's attestation report, a fresh client nonce, the service's policy and proofs from a third-party transparency log before connecting. Models and prompts loaded after launch are also verified against the log, but the model weights stay private.
NVIDIA reported in February 2026 that Meta had adopted NVIDIA Confidential Computing for the service. Trail of Bits' pre-launch review found 28 issues, eight of high severity, including unmeasured configuration and attestations without freshness.
Meta resolved 16 issues and partly addressed four. Trail of Bits notes that SEV-SNP does not fully protect against advanced physical attacks, and that fully reproducible server images remain challenging.
Meta reports running Private Processing for WhatsApp users, and Trail of Bits published the findings of a review made before launch.
Assessed use: showing WhatsApp clients which logged software and artifacts serve their AI requests
On this page
What it is
Private Processing is Meta's server system for AI features in WhatsApp 1. Meta reports that it runs requests in confidential virtual machines (CVMs) on AMD EPYC processors with SEV-SNP and NVIDIA Hopper GPUs 1. NVIDIA reported in February 2026 that Meta had adopted NVIDIA Confidential Computing for WhatsApp's private processing 2.
Private Processing applies TEE remote attestation so that the WhatsApp client can check which software will handle a request before it connects 1.
How it works
Meta describes the checks as follows 1:
- Before it connects, the WhatsApp client checks the server's attestation report, a fresh nonce from the client, the service's policy and proofs from a third-party transparency log run with Cloudflare.
- Models and prompts loaded after launch are also verified against the log.
Meta does not publish the model weights 1.
Meta's threat model includes physical attacks on hosts. Meta lists data-centre security, memory encryption and third-party relays as mitigations 1.