Comment by traceroute66
4 days ago
> If you want zero data retention you have to go api only.
Time for the daily reminder that ZDR is a pinky-promise.
ZDR is a contract clause. That means:
- It is subject to the rest of the contract, e.g. the good old "subject to lawful request or court order" carve-out clauses
- It is subject to random provider exceptions, e.g. see Anthropic and Fable.
- You have no way of verifying it beyond "trust me bro".
Basically you the only options are:
- Run your own hardware which is obviously the ideal situation
- If you can't run your own hardware, use confidential computing which runs the AI in secure enclave, e.g. Privatemode[1] (Germany) or Tinfoil[2] (US)
How do you verify that privatemode.ai or tinfoil.sh are actually running the AI in a secure enclave? If you're the untrusting type, there's no way for them to prove they're not faking it being run on a fake secure enclave. If you're the really untrusting trusting type, "Reflections on Trusting Trust" should be your guidebook on why local hardware won't save you either.
> How do you verify that privatemode.ai or tinfoil.sh are actually running the AI in a secure enclave?
First, the obvious answer, Privatemode.ai has been independently externally audited[1]. So there's that. ;)
Tinfoil have not been independently audited, apparently its "coming soon (maybe)".
Secondly, I quite clearly said "if you can't run your own hardware". But to spell it out: There is no debate to be had that your own hardware will always be best. Preferably in your own private datacentre so as to avoid evil-maid attacks.
However, if we are starting from the position where you CANNOT run your own hardware, then clearly these services are preferable to some "trust me bro" contract clause.
The enclave providers publish their repos on GitHub and you can cryptographically check the attestation change.
Is it perfect ? Of course not.
Is it a million times better than "trust me bro" ZDR ? Hell yes.
The "trust me bro" people don't even publish their runners in GitHub. So you have absolute zero visibility, you cannot even check their claims on a theoretical level, its a complete closed-shop.
[1] https://www.privatemode.ai/security-and-encryption
Yes, company A paid company B to say that company A is safe. Company B is under no duress at all with their findings being what company paid them to find. "Just trust these bros that I've recently paid"
You didn't address my question on reflections on trusting trust. For the AI era, there's https://arxiv.org/abs/2610.13928
2 replies →
Which is why everybody buys tokens from Amazon or Microsoft or Google, not anthropic or OpenAI.
Because you already have your BI and mails on these providers.
> Which is why everybody buys tokens from Amazon or Microsoft or Google, not anthropic or OpenAI.
Erm. Exactly the same thing applies ? AWS, Azure or "direct" ... its all still "trust me dude".
And for the US-jurisdiction side, AWS/Azure EU is fake EU due to the CLOUD act, PATRIOT act etc.
> Because you already have your BI and mails on these providers.
You might. Lots of people don't. My $work and many others included.
For my companies purposes US contract law is risk mitigating enough.
> For my companies purposes US contract law is risk mitigating enough.
Where I work, its quite the opposite.
US exposure is deemed a risk in itself. CLOUD act, PATRIOT act and then the general political situation in the US.
We and many others I know have been working hard to minimize US exposure to the maximum extent possible because the US risk has gone from theoretical to actual.