Ghost Mode — zero-retention API keys for sensitive work

If you route legal, medical or proprietary data through an LLM, "where does my prompt end up?" isn't paranoia — it's due diligence. Ghost Mode is our answer: a per-key, zero-retention mode where your prompts and responses are never written to our disks.

What zero-retention means here

Turn Ghost Mode on for an API key, and every request made with that key skips body storage on our side. We keep exactly one thing: the token count, because that's how billing works. Your prompt text and the model's response are processed in memory and forwarded — never persisted.

• Nothing stored. No request bodies, no response bodies, no transcript.
• Per-key, opt-in. Use a Ghost key for sensitive workloads and a normal key for everything else — same endpoint, same models, same price.
• Works everywhere. Direct API, Codex CLI, Cursor, any OpenAI-compatible client. The protection is enforced on our server, keyed off the API key — you don't have to do anything special.

Don't trust us — verify

Privacy claims are cheap. So Ghost Mode is built to be checked, not believed:

• Signed no-store receipt. Ghost responses carry a signature over (request_id, policy=zero-retention, timestamp). It's a non-repudiable commitment — if we ever broke it, that signature is the evidence.
• "What do you store on me?" Ask our API for everything tied to your key. For a Ghost key, you get token counters and nothing else — see for yourself that no bodies come back.
• Inspectable path. The code that handles a Ghost request has no write step for bodies. There's nothing to read because there's no column it lands in.

The honest part

Here's what we will not tell you: "100% privacy." It would be a lie. Your prompt still travels to the model provider — OpenAI, Anthropic, Google — because that's the only way an LLM produces an answer. Their data policies are their own.

What we control is what we keep, and the answer with Ghost Mode is: nothing but a number. Anyone promising "fully private, cryptographic proof we never saw it" for a model they don't run is selling you a story. We'd rather give you a guarantee you can actually verify.

Who it's for

• Teams under NDA or compliance (legal, healthcare, finance)
• Anyone red-teaming prompts they don't want logged
• Privacy-first builders who just don't want a transcript sitting in someone's database

Ready? Grab a key and flip Ghost Mode on, or read more on the Ghost Mode page.