> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ostrum.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy by architecture

> Individual contributions cannot be exposed by anyone, including the platform itself

An information market only functions if contributing doesn't mean
surrendering the information's source. Ostrum is engineered so individual
contributions can't be exposed by anyone, including the platform itself.
These are structural properties of the pipeline, not policy promises
layered on top.

## No database of precise contributions exists

The most identifying thing about first-hand information is its exact
numbers, so they don't survive intake.

Exact values are converted to buckets and ratios at submission. The raw
figures exist only transiently in memory and are never written to the
dataset. Supporting verification material sits in an encrypted temporary
cache while the verification system reviews it, and is purged when a
verdict is reached. The cache itself has a hard expiry, so no bug can make
raw material linger. What persists is the verdict. Never the documents.

## Aggregation-only access

All access runs through an aggregation-only statistics layer with
minimum-cohort thresholds and suppression rules. No query, from a user or
from the internal LLM itself, can return an individual contribution.
Aggregates below the minimum cohort size aren't served at all.

## We never know who you are

Ostrum doesn't hold identities. No names, no emails. The only thing tied to
your participation is a crypto address.

Getting paid doesn't require Ostrum knowing anything about you either.
That's part of the point of
minting each contribution's earnings claim as an NFT: rewards accrue to the
NFT and pay out to the address holding it, so paying you never requires
knowing who you are. Consumers never see who contributed anything, and
nothing served to a user, or to the model answering them, carries any
contributor information.

## Your queries are private too: end-to-end encrypted, LLMs in TEEs

In an information market, questions are information. Repeatedly asking
about one venue's listing costs telegraphs a negotiation. So your questions
get the same protection as your contributions.

Your conversations aren't stored. Chat history stays on your device, in
your browser. Ostrum never stores it on its servers.

The model answering you is private too. Queries go only to open-source
large language models deployed inside trusted execution environments:
hardware-isolated enclaves where your questions stay end-to-end encrypted
and are decrypted only inside the enclave itself. No AI lab gets access to
your information. Neither do the operators of the machines the model runs
on.

Beyond that, usage feeds exactly one thing: anonymous, aggregated usage
patterns drive the data pricing model.

## The verification system

Every submission passes through the verification system, which tests
validity against public sources, internal data, and signs of fraudulent or
manipulated documents. Its runs are time-limited: proof is cached only
while the system works and purged once it reaches a verdict. Some of what
the system checks is published; some is deliberately withheld to protect it
against exploitation and data poisoning.

Corroboration is the system's long-run backbone. Independent contributors
converging on the same facts is hard to fake, and it compounds as the
dataset grows. Submissions the system fails are excised and earn nothing.

## Infrastructure

Encrypted data at rest is table stakes, and it isn't the pitch. Saved data
is a target even when it's encrypted: it can be breached, leaked, or
compelled, and it sits there waiting for someone to try. Ostrum's design
goes a step further and avoids saving data at all. Whatever can live in
transient memory never touches a disk, and the little that does have to be
saved, bucketed rows and verdicts, is encrypted. Third parties that process
content do so under no-retention terms disclosed in our contributor terms.