🕶️ Privacy tiers — new

We can be blind on purpose.

Routing means reading — on the default tier. But you decide how much apiegg sees: nothing stored, nothing readable, or nothing at all. It's a dial, and you hold it.

See what we see — and don't Get early access
See it work

The middleman view.
Four tiers of blind.

Your request passes through apiegg to reach a model. Here's exactly what the middleman sees at each tier — it cycles on its own, or click a tier.

What the router sees

interactive demo

Default tier — to route well, we read each request in memory for a few milliseconds. Then it's gone.

↩️ response → straight back to you — nothing saved on the way

All data in this demo is fake — planted on purpose.

The dial

Four tiers.
You pick the blind spot.

Honest labels, no marketing fog — here's exactly what we see at each tier.

T0 · Zero retention

free · default
we see your request, for milliseconds — in RAM only

To route well, apiegg reads each request in memory — tools, context, intent — picks the best-fit model, and forgets. Bodies never touch disk. This is the default for every account, free. That's our side of the pipe — what each model provider retains under its own policy (including abuse-monitoring carve-outs for flagged content) is disclosed per endpoint in our catalog.

T1 · Blind mode

sealed
we see an envelope: size, latency, route ✓

The payload stays sealed in transit. apiegg routes on the envelope alone — size, timing, and the route you pick — and forwards it without reading the contents. We literally can't see your calls. Blind mode is BYOK: your provider key rides inside the sealed tunnel and never touches us. (Blind to us — the model provider you pick still processes your prompt, as with any provider API.)

T2 · Tokenize

data stays home
we see [TOKEN_1] … [TOKEN_n] — not your data

Sensitive values are swapped for tokens before they leave your side. The model works on tokens and answers; the response is rehydrated with real values for you alone. Useful work, zero exposure.

T3 · Attested

roadmap
we see nothing — and we can prove it 🔒

Provably blind: cryptographic attestation that the routing path cannot read your content — not "trust us," but "verify us." In active design with early access users.

Trust, as a demo

The canary audit.

Promises are cheap. Proof is a program.

We plant fake secrets. Then we prove they never surface.

With your permission, apiegg seeds canaries — a fake card number here, a fake API key there — into your traffic patterns. Then we watch every surface where data could leak: logs, caches, metrics, provider pipelines. If a canary ever sings back, you'll know.

So far: silence. And the audit runs continuously, so it stays that way — provably.

canary: card •••• 1111 → logs never canary: sk-fake-999 → caches never canary: "Aigerim C." → training corpora never

🚫 What we never do

  • Never sell your data — or your customers'. Not to anyone, not for anything.
  • Never train third-party models on your prompts or outputs. Your traffic is not anyone's training data — not ours to give.
  • Never snoop — no one at apiegg reads customer calls, on any tier, for any reason.

The binding version of all this lives in the Privacy Policy →

The guardian catches what shouldn't leave Where requests may land
Good questions

Asked with eyes open.

Honest answer: on the default tier (T0), yes — transiently. Prompts are processed in memory, for the milliseconds it takes to route them well. They are never stored. If even transient visibility is too much for your workload, that's exactly why the dial exists: from T1 up, we can't see them at all.

Yes, a little. With the payload sealed, apiegg routes on the envelope — size, timing, and the route you pick — instead of reading content. Explicit model pins always work, and with our optional local helper computing routing hints on your side, frontier-vs-cheap matching keeps its edge — it works with every agent; just point the base URL at the helper. A notch of nuance is traded for a vault of privacy. And since we can't meter tokens we can't see, blind mode bills flat or per request.

Roadmap. Real attestation — cryptographic proof the routing path can't read your content — is machinery we're designing with early access users right now. If your compliance story needs it, tell us loudly: customers who need T3 get it sooner.

Early access

Choose how much
we get to see.

One endpoint, dozens of models — and a privacy dial from "process and forget" to "provably blind." Free during early access.

Get early access

✨ Free during early access · no credit card

Meet the guardian layer Back to all features

🕶️ Privacy tiers describe the product's data handling, not a legal guarantee — the binding commitments live in the Privacy Policy.