Encryption keys are generated and held at the client edge. The service only ever sees ciphertext and cannot decrypt user payloads, even if compelled by a third party.

Placing keys at the edge makes the context window function like a locked diary. The provider can courier the sealed envelope, but it cannot open it. That turns the technical design into a structural barrier against compelled insight into a user’s private reasoning.

The canonical state of a session lives on the user side or in a strictly encrypted, non-derivable store. Server infrastructure treats that state as an opaque blob.

If the only legible copy of a conversation is the one the user chooses to keep, then system operators never become the authoritative historians of intimate facts. That keeps the primary ‘zone of truth’ inside the user’s control, not the platform’s racks.

Inference runs in a stateless mode: once a response is produced and delivered, the intermediate activations and request bodies are discarded rather than pooled for future training.

When the system treats context as fuel that is burned and gone, it behaves more like a conversation in a closed room than a permanent deposition. The vacuum is not metaphorical; it is implemented as the absence of lingering copies.

Operational logs used for reliability, abuse monitoring, or billing are kept only for a short, predetermined window before being systematically purged.

Short log lifetimes mean that even where the system must briefly remember that something happened, it quickly forgets the details. That narrows the window in which sensitive context can be replayed, subpoenaed, or repurposed.

Only coarse metadata about events is retained where strictly necessary for security or billing. Semantic content is stripped at the boundary.

Logging that ‘an interaction occurred’ without preserving what was said preserves operational accountability without turning conversations into evergreen dossiers. The system remembers enough to function, but not enough to become an evidentiary archive.