Docs
Lethe and privacy
Lethe is the river of forgetting in the myths around Elysium. Here's what Talos keeps, what Lethe seals, and how to check it yourself.
Private by default
Every API request goes only to providers that have promised to keep no data. Talos checks every request, so there's nothing to set up. Every model is labelled by what its providers promise.
- Lethe
- Can run sealed in an enclave. In the chat, Lethe models are encrypted end to end.
- No label
- Served only by providers that keep no prompts or replies. Most models are here.
- Keeps data
- No provider for it promises to keep nothing. Keys skip it unless they're set to All models.
What Talos keeps
- Prompts and replies
- Never stored.
- IP addresses and emails
- Never stored.
- Each request
- The model, the cost and the time, for 30 days. After that, only daily totals.
- Your API key
- Only a hash. The key is shown once, when it's made, and can't be shown again. Lost it? Replace it.
Sealed enclaves
Lethe models run on Phala's confidential computers, where the processor and the GPU keep the model's memory encrypted. The company that owns the machine can't read your prompt, and neither can anyone who breaks into it. The hardware also signs a report of the exact code it's running, so you don't have to take anyone's word for it.
How the chat seals a message
- Check the enclave. The page asks the enclave to prove itself with a fresh challenge, then checks the proof in your browser: genuine hardware, signed just now, running the code it claims.
- Seal the message. Your message is encrypted on the page to a key that only that enclave holds. Talos passes the sealed message along and can't open it.
- Open the reply. The reply streams back sealed to a one-time key your browser made for that message, and is decrypted as it arrives.
- Check the receipt. Each reply comes with a receipt signed inside the enclave. The page checks it against the exact bytes it sent and received.
- Keep it sealed. Saved chats are encrypted in your browser with a key that can't leave it. Temporary chats aren't saved at all, and closing them deletes them.
The encryption is X25519 with AES-256-GCM, as Phala's confidential API specifies, and the checks use Phala's open-source verifier. In the chat, select View attestation to see every check and its result.
Who sees what
- Your browser
- Everything. Your history is sealed here with a key that can't be copied out of the browser.
- Talos
- Ciphertext, its size and time, the model, and a count of free messages. Never the words.
- The enclave's host
- Encrypted memory. The hardware keeps the machine's owner out.
- The enclave
- Your message, to answer it. It runs measured code that keeps no data.
Your history lives only in this browser. Clearing the site's data deletes it, and Talos can't bring it back.
Free messages
The chat gives every browser 20 free messages a day on Lethe models marked Free, with no account. A home or office network shares 60, and all free messages draw on one daily budget, so a busy day can end early. Replies run up to 2,048 tokens, and models are free up to $1 in and $2 out per million tokens.
To count them, Talos sets a random cookie and hashes your IP address with the date. Neither is kept as it is, and both reset at midnight UTC, so one day's count can't be matched to the next.
Lethe over the API
Each key has a privacy setting, which you change in the dashboard with a wallet signature. Private, the default, only reaches providers that keep no data. Lethe only reaches only models that run in a Phala enclave. All models also allows the models labelled Keeps data, whose providers may keep prompts. It's off unless you turn it on. A key refuses models outside its setting.
Over the API, a Lethe key runs the model in an enclave, but the request travels to it through Talos and OpenRouter over TLS rather than sealed from your machine. Neither stores it. For end-to-end sealing, use the private chat. Model ids stay the same, like moonshotai/kimi-k3.