If the orchestrator sees prompt text in transit, these docs do not imply end to end encryption unless that property is actually implemented.
No prompt storage
Processed for the active request, not retained after completion.
Worker anonymity
Workers receive job text and parameters, not user identity.
Limited logs
Operational logs avoid raw prompt text.
| Property | Documentation wording | Engineering requirement |
|---|---|---|
| No prompt storage | Prompts are processed for the active request and are not retained after completion. | Disable conversation persistence for raw prompt content. Keep only billing and telemetry fields needed for settlement. |
| Worker anonymity | Workers receive the job text and model parameters, not user identity. | Strip account, wallet, IP, and billing identifiers before dispatching jobs to workers. |
| Limited logs | Operational logs should avoid raw prompt text. | Use request IDs, token counts, model IDs, worker IDs, latency, and error classes. |