iCloud Private Relay uses a two-hop architecture consisting of an Apple ingress node and a third-party egress node (such as Cloudflare or Akamai), ensuring that no single entity simultaneously knows both the identity of the accessor and the content being accessed.