As someone working in this space: unless they're a very big player with resources to create custom hardware, afaik there's no way to actually prevent the GPU host from seeing the request content. There's no "secure enclave" that sits between a CPU and the GPU, the decrypted payload must necessarily hit system RAM, as would the output. They are, at best, running in TEE VMs which are also pretty horribly broken and don't provide the security that they say they do.

Tinfoil is almost certainly lying to you.