Hey guys, I'm Matt, founder of PayPerQ (PPQ.AI), the pay-per-use AI router that gives a 5% bonus for lightning deposits. We shipped a big privacy upgrade yesterday that I believe is worthy of a post over here.
Every chat through PPQ now runs inside an AWS Nitro enclave that proves two things:
- PPQ cannot read the content of your queries.
- PPQ sent your query to the model and provider you actually picked. No model fraud.
Every AI router out there, us included until yesterday, can read the prompts going through it. "We don't log your prompts" has only ever been a promise.
Now the only thing we see is billing and error metadata. The enclave code is open source and reproducibly built, and we shipped a small local verifier you can run so you don't have to trust us or Amazon on it.
Combine that with no accounts and paying in sats, and the provider that can read your prompt has no idea who you are, while PPQ, which knows how you paid, can't read your prompt.
Honest caveat: this covers chat only for now. Image, video and audio still hit our backend directly. And frontier providers like Anthropic still see your prompt because that's where the model runs.
Full writeup: https://ppq.ai/blog/introducing-the-enclave-router
The thread version: https://x.com/PPQdotAI/status/2107875352420970878
Code: https://github.com/PayPerQ/ppq-enclave-proxy
Happy to answer any questions here. Hopefully we are staying true to our users' expectations with regard to freedom, privacy, and sovereignty.
Nice! I use the ppq api everyday as the brain of my Hermes agent.
Hey Matt, thanks. This is a good feature.
Would you mind adding a
SECURITY.mdto this repo? If I'm going to run this in production (I'd like to), there's a pretty high probability of needing that at some point between now and my intake being done.Thank you for the feedback. It's added!
Thanks!
Are you serving some of those models yourself? What hardware do you have?
We don't serve any models ourselves. We are a router.
Very cool update!
Nice. I love ppq.ai.
Thank you!
This is a big step - proper separation of who paid vs what was asked. Love that enclave code is open source + verifiable, no need to trust PPQ or Amazon blindly.
Honest caveat about chat-only and frontier providers still seeing prompts is appreciated. Paying in sats with no accounts makes this actually usable for privacy.
Seller-side numbers from the other pay-per-use rail this week, for comparison. On x402 (USDC on Base, agents paying per call) one 42-route seller publishes its gate log: over three days, 7,945 requests answered with 402, 18 paid attempts, 10 settled, 3 of them from wallets the seller does not control. Directory listings bring crawlers; the sellers with real traffic are the ones an operator installs on purpose, which is the position a router like PPQ is in.
Two questions on the enclave design: