Omniousdocs
ArchitectureBeta

Privacy: zero retention by default

Ordinary requests keep receipts, not transcripts; durable content requires an explicit Passport, order, share, or sync feature.

Owner
Protocol
Version
router-2026.07
Verified
2026-07-13

Most inference platforms retain your prompts because retention is the default: logs are useful, storage is cheap, and nobody is billed for the risk. Omnious inverts the default. The router's business is the economic record of a request, not its content, so the economic record is all a raw completion keeps. Durable content exists when a caller creates a task, patient order, Context Passport, or share. The normal chat's Build mode creates a seven-day task so long work can survive a closed tab; ordinary chat and direct completion callers can retain nothing.

Receipts, not transcripts

For an ordinary completion, prompt and reply bodies are never written to disk. In flight, they pass through bounded in-memory stream buffers whose purpose is resilience, not retention: a mobile client that drops mid-generation (iOS suspending a backgrounded app is the common case) can reconnect and resume exactly where it left off, because generation, metering, and billing run to completion regardless of the client connection. Buffers are capped per stream and globally, and finished buffers are swept within minutes.

What persists is the signed economic record:

  • token counts (input, output, cached)
  • cleared prices and the amounts charged, authorized, and refunded
  • payment references and settlement transaction ids
  • signed receipts and the epoch hashes anchoring them

That record is enough to prove what you were charged, by whom, and under which auction, without containing a word of what you asked. See tamper evidence for what the record proves.

Explicit durable modes

A durable task stores its goal, ordered events, checkpoints, and effect/verification evidence behind a high-entropy capability. Only the capability hash is stored. Retention is selected at creation from one hour to 30 days (seven days by default), and DELETE /v1/tasks/:id immediately removes the task and its dependent rows. Normal-chat Build mode and SDK runTask()use this resource for resumable multi-step work.

not in the mainnet launchContext Passport creation and continuation are gated off for the V1 mainnet launch. Inspection and deletion stay available if serving is paused, so a kill switch never traps caller-managed data.

A Context Passport is opt-in server-side conversation state. The router stores its messages, structured handoff, and version ledger behind a high-entropy bearer token; only the token hash is persisted. Passports expire after the configured retention window (seven days by default), refresh when used, and can be deleted immediately with DELETE /v1/context/passports/:id. Do not enable context when zero transcript retention is the requirement.

A second flow requires content to rest: patient limit orders. An order that waits for the market to reach your target price must hold the prompt until it fills. The retention contract is explicit: the prompt is scrubbed in the same transaction that closes the order, and the stored result is swept after a 24-hour pickup window (ORDER_RESULT_TTL_MS). A scrubbed order keeps only a non-reversible fingerprint, preserving idempotency without the content.

Local conversations and memories in the web app are also stored in the browser. The task ledger stores only turns run through that task; shares, Passports, and opt-in settings sync store only what their user explicitly submits.

As a customerA raw completion's prompt lifetime is the request itself. The normal chat's explicit Build mode creates a time-limited task so it can resume long work and prevent duplicate effects after a crash; its capability can delete that state immediately. On the raw path, you can hand an auditor the signed receipt and full auction breakdown without exposing what you asked, because the router could not reproduce it either.
As a providerThe router keeps no transcript for raw completion traffic. Task and Passport turns retain caller-authorized state, while provider-private KV state remains outside the Passport. Economic evidence remains token counts, measured latency, signed quotes, and receipts.
why this shapeZero retention remains available on the raw completion path, not as an account-wide promise. Content persistence requires an explicit wire resource: a task, context, patient order, share, or settings sync. That makes the retention choice visible in the request and removable through the matching lifecycle API.
where this lives in code