When Ambient Desktop, or any other client, sends an inference request to the Ambient network, the network keeps no user data beyond what is needed to serve and bill the request. Ambient serves and bills the request, then retains nothing, and on testnet that is verified two independent ways, by technical inspection and by legally binding contract. How the guarantee is enforced, and which further privacy capabilities are available, depends on the network stage.
A two-zone diagram split by the boundary of your machine. The left zone, labelled your machine and local-first, lists what stays on your device: files and workspace, secrets held in managed flows, sandboxed capabilities, and agent memory which is off by default. An arrow labelled request crosses to the right zone, and an arrow labelled response returns. The right zone, labelled Ambient network and zero data retention, shows three steps: serve the request in memory then release it, return the response, and discard the content with no store and no log. Below a divider it notes that only usage and billing metadata is kept, never the content you sent or received.
Zero data retention by default#
Ambient is zero-data-retention (ZDR) by default. As a provider, Ambient does not keep:
- your prompts,
- your files and context,
- your tool inputs,
- the model's outputs.
Requests are processed in memory to produce a response and are then discarded.
The only thing retained is the minimum required to serve and bill a request: usage metering such as request counts, plus billing metadata. Your content is never part of that record.
What "serve and bill" actually covers#
Two narrow purposes, and nothing beyond them.
| Purpose | What it means |
|---|---|
| Serve: fulfilling the request | Your prompt and context are processed transiently to produce a response, then released. There is no content store, no training corpus, and no retained conversation log on Ambient's side |
| Bill: metering usage | The metadata needed to count and bill requests is kept: usage totals, not the content of what you sent or received |
How the guarantee is enforced today (testnet)#
The Ambient chain is on testnet today, and the enforcement mechanism is scoped to that stage: the infrastructure that serves requests is whitelisted, and it fully meets the zero-data-retention guarantee. That is verified in two independent ways, so it is not only a promise in a document:
| Check | What it establishes |
|---|---|
| Technical inspection | The whitelisted serving infrastructure can be inspected to confirm that no user content is retained |
| Legally binding contracts | The same guarantee is backed by binding contractual commitments, so the obligation is enforceable rather than aspirational |
On the roadmap for mainnet#
Two further privacy capabilities are tied to mainnet rather than testnet. Both are labelled roadmap here so that what is and is not available today is explicit.
- Onion-routed requests are not offered on testnet: it is too small on a per-server basis to onion-route requests credibly. Onion routing will be available on mainnet.
- End-to-end encryption will be available upon request for mainnet customers.
Local-first, on top of zero retention#
Provider-side ZDR pairs with how the desktop already works. Ambient Desktop is local-first: your files, workspace, and secrets stay on your machine, risky capabilities are sandboxed (see the security model), and provider keys move through managed secret flows rather than into chat. Zero data retention covers what reaches the provider; the security model covers what stays on your device. Even the experimental agent memory system is workspace-local and off by default.
Read the full policy#
This is a plain-language summary. Ambient's complete privacy and data policies, with the precise definitions, scope, and terms, are published at ambient.xyz. If your deployment has specific compliance requirements, start there.
FAQ#
Do you store my prompts or the model's responses? No. Prompts, context, tool data, and outputs are processed in memory to serve the request and then discarded. Only usage and billing metadata are retained.
How is zero data retention verified? On testnet, the serving infrastructure is whitelisted and meets the guarantee, confirmed by both technical inspection and legally binding contracts.
Is onion routing or end-to-end encryption available now? Not on testnet. Onion routing is coming on mainnet (testnet is too small per server to do it credibly), and end-to-end encryption will be available on request for mainnet customers.
Where can I read the binding policy? The full privacy and data policies are published at ambient.xyz.
Keep going#
- Security model: the agent works on your real desktop; the genuinely risky capabilities are what gets contained
- Agent memory: the opt-in, experimental system that reuses relevant context across turns, adapted from the open-source TencentDB-Agent-Memory project, stored workspace-local, and off by default
- Provider routing: prioritizing and falling back through providers for search, fetch, browser, media, and model-adjacent work