Who can read your prompts on Aile?

Before sending a prompt, ask two questions: which model will answer, and who can read the input?

Those are different decisions. Aile connects buyers with several kinds of capacity through a common API, but the underlying request paths do not have identical privacy properties. A machine running a model has different access from one forwarding encrypted traffic.

Provider-backed capacity: the node forwards, the provider answers

On a node-relayed provider route, the lender’s machine forwards encrypted traffic. It cannot read the prompt or the provider credential.

Aile’s relay prepares the authenticated request and can read the prompt and response. The upstream provider processes the request to produce the answer. The lender’s node being unable to read your prompt does not mean Aile is unable to read it.

Here, “can read” means having access to readable content. It does not mean a person manually reviews every request.

Nodeless capacity: no lender machine in the path

On a nodeless route, Aile connects directly to the provider. There is no lender node forwarding the request, but Aile’s relay can still read its content.

Removing the node changes the route. It does not make the prompt invisible to the systems handling it.

Self-hosted capacity: the lender runs the model

A self-hosted lender operates the machine that performs inference. That machine reads the prompts it answers because processing the input is the work.

“Self-hosted” refers to the supplier’s hardware—not necessarily your own device. Renting a self-hosted listing therefore means trusting another operator with the input. The model weights stay on that operator’s machine; this is separate from who can access your prompt.

What “blind” actually means

A provider-backed response may include:

x-aile-capacity: subscription
x-aile-blind: true

The second header describes the lender’s node, not the entire request path. It means that machine could not read your request. It makes no claim that Aile’s relay was unable to read it.

Nodeless responses report x-aile-blind: false and omit x-aile-node, because no lender machine participated. That is a description of the route—not evidence that an additional lender received your prompt.

Use these headers to understand how the request was served. Do not treat a single flag as an end-to-end privacy guarantee.

Reading content is different from storing it

Aile’s Privacy Policy states that request and response bodies are processed in memory for routing, screening, and metering, rather than persisted as content.

It separately lists billing metadata, including timestamps, model names, token counts, latency, and status. Operational logs have a stated retention period of 30 days; that is not a blanket retention period for every category of account or billing data.

Not retaining a prompt does not mean being unable to read it during processing. Aile’s storage policy should also not be treated as a guarantee about every upstream provider or independently operated endpoint.

Encryption has similarly specific boundaries. Linked provider credentials are stored encrypted, but Aile decrypts them in memory when needed to serve requests. Encrypted storage does not make those credentials inaccessible to Aile.

Agent tools have another reader

Renting an MCP tool call is different from requesting model inference.

Aile forwards the task text and the arguments declared by the lender’s tool. It does not automatically include your entire conversation history, system prompt, memory, or other tools’ output in that call.

However, the task itself must reach the system doing the work. Aile and the lender’s agent can read it. On an attended agent listing, the lender’s human operator can see it too. Do not send secrets or confidential documents to an attended task.

Filtering account metadata is not the same as redacting your text. If you paste a customer’s name, email, or private document into the task, you have included that information in what the recipient receives.

Send the smallest useful input

Suppose you need help rewriting a support response. Start with the relevant issue and replace identifying details with placeholders. Do not include the customer’s full account record merely because it is available.

Review what your application actually sends, including history and tool arguments—not only the latest message you typed. Keep credentials and private keys out of prompts, and use public or synthetic material while testing.

Before introducing sensitive data, confirm who operates the selected capacity and what handling requirements apply. Do not infer that nobody else can access your input from words such as “self-hosted,” “encrypted,” or “blind.”

Choose the route based on who you trust with the input, not just which model you want to use.