Private AI is AI where your prompts and files are not readable by the provider running the model. The strongest form encrypts data on your device and decrypts it only inside hardware-isolated enclaves, so the operator cannot access the contents even if compelled to.

Is there an AI that is completely private?

Running a model locally on your own hardware is the most private option, but it limits you to models your machine can run. Hardware-encrypted hosted AI is the closest equivalent for larger models: data is encrypted before it leaves your device and decrypted only inside an attested enclave, so the provider cannot read it.

ChatGPT processes prompts in plaintext on OpenAI's servers. Privacy depends on account settings and OpenAI's policies rather than on architecture. Turning off chat history limits training use, but it does not make the content unreadable to the provider.

What is the difference between private AI and a privacy policy?

A privacy policy is a promise about what a company will do with data it can read. Private AI, in the architectural sense, removes the company's ability to read it at all. The difference is whether your privacy survives a policy change, a subpoena, or a breach.

How can I verify an AI provider's privacy claims?

Look for open-source client and server code, reproducible builds, and live cryptographic attestation. Attestation lets you confirm that the code running in production matches the published source. Without all three, a privacy claim cannot be independently checked.

What is private AI?

Three things get called “private AI,” and only one of them survives a subpoena. Here's how to tell them apart.

Try Maple free See our attestation

On this page

What private AI means

Private AI is AI where the provider cannot read your prompts. Not will not — cannot. That distinction is the whole subject, and almost every disagreement about what counts as private AI is really a disagreement about which of those two words applies.

Most products marketed as private AI mean the first one. They process your text in plain form on their servers and govern access with policy. That is a real commitment, and for plenty of use cases it is enough. But it is a promise about behaviour, not a property of the system, and it can be revised, overridden, or breached.

Why it matters now

AI stopped being a writing tool. It now sees medical questions, legal strategy, client notes, financial detail, source code, and the half-formed reasoning people would not put in an email. The sensitivity of what goes into a prompt has climbed far faster than the guarantees around it.

For regulated professionals — therapists, lawyers, accountants, clinicians — the gap is sharper still, because their obligation is to the confidentiality of someone else's information, and “the vendor promised” is not a defence they get to make.

The three levels of AI privacy

Level 1

Policy privacy

The provider promises not to look.

Your prompts arrive in plaintext. A privacy policy, a settings toggle, or a zero-data-retention agreement governs what happens next. This is the most common form of 'private AI' and it is entirely a trust relationship — it can be changed by a policy update, overridden by a subpoena, or undone by a breach.

How to verify: Read the policy. There is nothing else to check.
Level 2

Proxy privacy

A middleman strips your identity.

A proxy sits between you and the model provider, removing identifying metadata before forwarding the request. Your identity is better protected, but the content of your prompt still reaches the provider in plaintext. You now trust two parties instead of one.

How to verify: Ask what the proxy logs, and whether the downstream provider retains content.
Level 3

Hardware-encrypted AI

The provider cannot read it.

Prompts are encrypted on your device and decrypted only inside a hardware-isolated enclave (a TEE) that runs measured, published code. The operator cannot read the contents — not because they promise not to, but because the architecture doesn't permit it.

How to verify: Check the attestation document, compare the enclave measurement against a reproducible build of the published source, and confirm the code is open.

How to verify a privacy claim

A privacy claim you cannot check is a marketing claim. Three things make one checkable:

Open source, client and server. A client-only release tells you nothing about what happens after the request leaves.
Reproducible builds. Published source only matters if you can rebuild it and get a byte-identical artifact to compare against.
Live attestation. A signed measurement, from the hardware vendor, of the exact code running right now — verifiable against that vendor's root certificate.

With all three, “trust us” is replaced by a hash you can compute yourself. Maple publishes all three; you can see the current attestation on the how it works page.

Evaluation checklist

Six questions worth asking any AI vendor that claims privacy:

Is the code open source?: Both client and server, not just the client.
Are builds reproducible?: Otherwise published source proves nothing about what's running.
Is there live attestation?: A signed measurement of the running code you can verify against the hardware vendor's root certificate.
Where is data decrypted?: If the answer is 'on our servers', it is policy privacy.
What happens to your data on subpoena?: The honest answer for encrypted architectures is 'we can hand over ciphertext'.
Is it used for training?: And is that a setting, or a structural impossibility?

Common questions

What is private AI?: Private AI is AI where your prompts and files are not readable by the provider running the model. The strongest form encrypts data on your device and decrypts it only inside hardware-isolated enclaves, so the operator cannot access the contents even if compelled to.
Is there an AI that is completely private?: Running a model locally on your own hardware is the most private option, but it limits you to models your machine can run. Hardware-encrypted hosted AI is the closest equivalent for larger models: data is encrypted before it leaves your device and decrypted only inside an attested enclave, so the provider cannot read it.
Is ChatGPT private?: ChatGPT processes prompts in plaintext on OpenAI's servers. Privacy depends on account settings and OpenAI's policies rather than on architecture. Turning off chat history limits training use, but it does not make the content unreadable to the provider.
What is the difference between private AI and a privacy policy?: A privacy policy is a promise about what a company will do with data it can read. Private AI, in the architectural sense, removes the company's ability to read it at all. The difference is whether your privacy survives a policy change, a subpoena, or a breach.
How can I verify an AI provider's privacy claims?: Look for open-source client and server code, reproducible builds, and live cryptographic attestation. Attestation lets you confirm that the code running in production matches the published source. Without all three, a privacy claim cannot be independently checked.