This is the canonical reference for how privacy works on Venice: the proxy architecture every request passes through, the four privacy modes, what Venice does and does not store, and how TEE and E2EE verification works. For the live version, see venice.ai/privacy.

Venice's privacy philosophy is simple: you don't have to protect what you do not have. The only way to offer actual privacy is to never have or store the user's data in the first place.

Prompts, responses, generated images, and document uploads are never saved on Venice infrastructure. They stay encrypted on your device. Conversation history also lives on your device, which is why chats on one device won't appear on another, even with the same account. Clear your data and those conversations are gone forever; Venice provides download features if you want to save them.

Every AI interaction passes through three layers: your device, Venice's proxy server, and the GPU where inference runs.

Your device sends the request to Venice's proxy over standard SSL/TLS. The proxy routes it to the appropriate GPU infrastructure for the model you selected. After processing, the response streams back through the proxy to your device.

The proxy relays traffic but does not persist prompt or response content. For frontier models, the proxy also obscures your identity from providers like OpenAI, Anthropic, Grok, and Google: they receive the request but not your IP, account, or session data.

Every model on Venice falls into one of four privacy modes, each adding progressively stronger protections at the GPU layer.

Venice proxies your request to leading frontier model providers. Your identity is obscured from the provider, but you should assume the provider is storing your content.

Inference runs on Venice-controlled GPUs or zero-data-retention partner infrastructure. Privacy is enforced by contractual commitments; no prompt or response is stored.

Inference runs inside a hardware-isolated enclave operated by external TEE partners (NEAR AI Cloud and Phala Network). The enclave isolates computation from the host OS, hypervisor, and infrastructure operator, so GPU providers cannot access your prompts. Verified by remote attestation.

Your prompt is encrypted on your device, remains encrypted through Venice's proxy, and is only decrypted inside a verified hardware enclave on the GPU. Neither Venice nor the GPU providers can see your data at any point, even if they wanted to.

In Anonymous and Private modes, the model sees only the raw prompt context: no user data, no IP address, no identifying information. The plain text prompt exists in memory during processing because the model has to read it to generate the response. That is the remaining trust boundary.

If a node operator had physical access, they could install system-level firmware to log prompts in memory, but they would not know who sent them. Prompts are processed among thousands of Venice users without identity attached.

Prompts and responses are never written to disk. They exist only in memory for the duration of the request and are discarded once complete. TEE and E2EE reduce or remove this trust assumption entirely.

Venice never stores your prompts, responses, generated images, or document uploads. Venice does collect basic telemetry and metadata to run the platform:

Telemetry can be turned fully off in Venice settings. For more detail, see How Venice handles your privacy.

Remote attestation produces a cryptographic certificate tied to the hardware itself, proving the model is running inside a genuine enclave. You don't have to take anyone's word for it: the raw attestation evidence can be extracted and validated independently outside Venice.

In E2EE mode, a verification icon appears on each response. Click it to view the attestation report and independently verify that your prompt was encrypted end-to-end and processed inside a genuine TEE.

With TEE, you no longer need to trust the GPU operator, but you are still trusting Venice that data in transit is not retained (it is not). Venice does not run TEE or E2EE infrastructure itself; both are operated by NEAR AI Cloud and Phala Network. Verification documentation: NEAR AI attestation verification and Phala Trust Center.

Because your prompt is encrypted end-to-end, some features are disabled to preserve the encryption chain:

The set of TEE/E2EE-capable models grows over time, so it is not listed here. For the current roster, see venice.ai/privacy or check the model selector, where each model displays its privacy mode. You can toggle between TEE and E2EE in model settings on supported models.

Source: venice.ai/privacy