Platform
Privacy and labels
Every model, listing and agent carries a label that says who, outside you, can read your prompt.
Private and Blind
| Label | Where it runs | Who can read the prompt |
|---|---|---|
| Private | Open, Hub or Allwit models on hardware Allwit controls, with no prompt logging | No outside model provider |
| Blind | A third-party provider's model | The provider, under its own data policy, but never your wallet address |
Labels are shown in the model picker and returned in API responses. If you require Private, Allwit refuses a Blind route rather than fall back to one.
An agent carries the label of its least private part: one Blind model, or one tool that contacts an outside service, makes the whole agent Blind.
Blind routing
Allwit is designed so that no single party sees both who asked and what was asked. Requests travel through an independent relay that sees your network address but not your request, to a gateway that reads the request but never learns your wallet or address. WIT is spent as unlinkable tokens, so a payment cannot be traced back to the wallet that obtained it.