What we can and cannot see

Two paths, two different answers. Both are stated plainly, because a privacy product that is vague about its own boundary is just marketing.

The room — end to end

In the app, and through turboprivate connect, your prompt is sealed on your machine with a hybrid post-quantum key (X25519 and ML-KEM-768) that is fresh for every request. It is opened inside your session and nowhere else. Every answer comes back with a signed receipt you can verify offline, after the session is destroyed.

The API — TLS, not end to end

When Claude Code, Codex or any client talks to https://api.turboprivate.ai directly, the request is decrypted on our inference host so it can be handed to the model. That is a real difference and we will not dress it up:

Encrypted in transit, and the host is the same machine your session would run on — never the billing service.
No request or response bodies are logged, and nothing is written to disk.
Metering records token counts and a cost. Not content.

If you want the end-to-end guarantee in your editor, use npx turboprivate@latest claude --private. It runs the same interface over a sealed room.

What is still true on both paths

Nothing is kept after your session ends: workspace, keys and history are gone.
Nothing is used for training, by us or anyone else.
The model runs on hardware we control, not a third-party API.

Honest limit: until the inference host runs on confidential-computing hardware, an operator with root on that machine could read memory. The app says so in the session itself rather than claiming a guarantee we cannot yet make.