1. No identity tied to the request
A prompt encrypted client-side and paid for per-call in USDC over x402, with no account and no API key linking it back to you. Nothing to subpoena, nothing to breach, because there’s no identity attached to unlink in the first place.2. Attested execution
Inference runs inside a Trusted Execution Environment (TEE), an isolated enclave where even LETHE’s own infrastructure cannot read the prompt or the output while it’s being processed. The operator is architecturally excluded, not just contractually restrained.3. Verifiable deletion
Instead of a policy that says “we delete your data,” a cryptographic attestation proves the request ran in an isolated enclave and was discarded afterward. Verifiable, not promised.What this means in practice
Most AI products ask you to trust that logs won’t leak, that “we don’t train on your data” holds forever, and that a privacy policy won’t quietly change. LETHE’s bet is that none of that should require trust: the architecture itself should make the alternative (logging, retaining, training on your prompts) structurally impossible, not just against the rules.Where LETHE is today
This is the mission the product is built toward, not a claim about every line of the system as it stands right now. Building attested, verifiable infrastructure takes time to get right, and LETHE is honest in these docs about the gap between the two:What's shipped today
Guest-by-default chat with zero server-side storage, stateless API calls, and wallet-gated quota instead of accounts.
What's still ahead
TEE-attested inference, x402 pay-per-call, and closing the gap on signed-in history storage.
