Know what is processed. Know what is kept.

Content is processed transiently

Your client sends text to the API gateway, which authenticates and meters the request before model inference. AblitAI's application does not intentionally retain prompt or response content. Plaintext exists in memory while processing. This is not end-to-end encrypted inference: the gateway and inference runtime must read the text to serve it.

Authentication has two different stores

The server stores API-key hashes. Your browser stores a local plaintext copy of the key after the one-time server return. Anyone who obtains that plaintext key may use its account. Hashing on the server does not protect a compromised browser or a shared PDF backup. Follow the account and backup guide.

Accounting records remain

Account identifiers, balances, request accounting, payment references and reconciliation records support credit integrity. These records are separate from prompt and response content. Read the privacy notice for the actual categories and third-party boundaries.

Transport and browser controls

Public traffic uses TLS. The website uses self-hosted fonts and assets, a restrictive Content Security Policy, and no third-party trackers or analytics beacons. Payment availability is validated against the public catalog; malformed or unreachable state leaves purchase controls closed.

Infrastructure metadata is a separate boundary

Infrastructure and payment providers may process network and operational metadata under their policies. Country checks may be needed for checkout. Bitcoin transfers appear on a public ledger. A no-email account does not erase those facts or provide anonymity.

Private-beta readiness

Encrypted offsite-backup and clean-host restore verification, monitoring, a verified support channel, and operator requirements remain paid-launch gates. These planned controls are not presented as completed certifications. Private beta has no uptime SLA. Check readiness and payment state.

Report a concern

The public support channel is being prepared. The contact page states its availability. Never submit keys, passwords, identity documents, or private prompt content to an unverified channel.

For a deeper explanation, read what private inference means and the Acceptable Use Policy.

Transient prefix state

The current model runtime can reuse transient in-memory prefix state across requests. This state is distinct from persistent prompt or response logs and databases. Disabling prefix caching is prepared but has not yet been deployed; content should not be assumed to clear from GPU memory immediately after a request.

Runtime telemetry opt-outs are prepared but not yet applied. Request, output, statistics, and HTTP access logging are disabled. Operational telemetry is a separate boundary from prompt and response logs; no claim is made here that every runtime telemetry mechanism is disabled.