Omniousdocs
ArchitectureLive V1

Privacy: zero retention

The router keeps receipts, not transcripts. Prompt and reply bodies never touch disk.

Most inference platforms retain your prompts because retention is the default: logs are useful, storage is cheap, and nobody is billed for the risk. Omnious inverts the default. The router's business is the economic record of a request, not its content, so the economic record is all it keeps.

Receipts, not transcripts

Prompt and reply bodies are never written to disk. In flight, they pass through bounded in-memory stream buffers whose purpose is resilience, not retention: a mobile client that drops mid-generation (iOS suspending a backgrounded app is the common case) can reconnect and resume exactly where it left off, because generation, metering, and billing run to completion regardless of the client connection. Buffers are capped per stream and globally, and finished buffers are swept within minutes.

What persists is the signed economic record:

  • token counts (input, output, cached)
  • cleared prices and the amounts charged, authorized, and refunded
  • payment references and settlement transaction ids
  • signed receipts and the epoch hashes anchoring them

That record is enough to prove what you were charged, by whom, and under which auction, without containing a word of what you asked. See tamper evidence for what the record proves.

The exceptions, scoped and scrubbed

One flow requires content to rest: patient limit orders. An order that waits for the market to reach your target price must hold the prompt until it fills. The retention contract is explicit: the prompt is scrubbed in the same transaction that closes the order, and the stored result is swept after a 24-hour pickup window (ORDER_RESULT_TTL_MS). A scrubbed order keeps only a non-reversible fingerprint, preserving idempotency without the content.

Everything conversational lives on your side of the wire. Conversations and memories in the web app are stored in the browser, not on the server. Share links and opt-in settings sync store only what the user explicitly submits, and nothing else.

As a customerYour prompt's lifetime is the request itself: memory during the stream, gone within minutes of it ending. You can hand an auditor the signed receipt and the full auction breakdown without ever exposing what you asked, because the router could not reproduce it either.
As a providerThe router keeps no transcript of the traffic you serve. What it retains about you is the same economic record: token counts at your cleared prices, measured latency, signed quotes. Disputes run on those records, so zero retention costs you nothing in evidence.
why this shapeZero retention is not a policy promise layered over a logging system; it is the absence of a write path. The stream buffer is the only place content exists on the router, it is memory, and it is swept. Policies can be amended quietly. Missing code cannot.
where this lives in code