A privacy router for every model, anonymous compute for agents and a zero knowledge toolkit for the developers who build them. Requests are sharded and split inside an attested enclave, so nobody sees the whole picture. Not the provider. Not us.
Audit the Nordic Labs staking contract before the $2.1M mainnet launch and rank every reentrancy, oracle and access control bug.
Private inferenceshard A · no logs
Specialist modelshard B · via exit eu-fra
Frontier modelshard C · via exit us-iadWorks with the tools and rails you already use
Higgsfield
Base
Intel TDX
Recraft
HiggsfieldShield breaks a task into fragments that are useful alone but meaningless together. Sensitive fragments go to private inference. The rest go to the strongest model for the job. You get one answer, rebuilt in the enclave.
Your request is decrypted only inside an attested enclave. Secrets, names and identifiers are pseudonymized there.
The task is cut into fragments that work on their own but do not reveal the whole.
Sensitive shards go to private inference. Hard reasoning goes to the strongest model.
Outputs are merged and validated in the same enclave. One reply, original format, with the attestation attached.
Four products. One key. One balance.
Our CFO Maya Lindqvist approved a $2.4M line from Nordbank at 6.1%. Wallet 0x7b00…DE91 holds the collateral until 14 Nov.
shard A · identity · privateshard B · terms, no namesshard C · clause analysisDeterministic redaction, a task graph with dependency tracking and a validation step on merge, all inside an attested enclave. Three modes: redact, split, private-split.
How Shield routes→Requests leave from WISPR exit nodes. Headers stripped, bodies never logged. Providers see our IP, never yours.
Keys, tokens and wallet signers, scoped per agent, delivered short lived. Signing happens in the Vault, the key never leaves.
CPU boxes for always-on agents, GPUs by the hour from Akash, Vast.ai and our own racks. Paid from the same balance, auto stop at your budget.
Deploy an agent, pick its privacy level, give it tools. It keeps running when your laptop is closed.
Point your base URL at WISPR, keep your OpenAI client. Privacy is a header.
curl https://api.wispr.xyz/v1/chat/completions \
-H "Authorization: Bearer $WISPR_API_KEY" \
-H "X-Wispr-Relay: on" \
-H "X-Wispr-Shield: private-split" \
-d '{
"model": "auto",
"messages": [{ "role": "user",
"content": "Review this contract and my position." }],
"stream": true
}'import os
from openai import OpenAI
client = OpenAI(
base_url="https://api.wispr.xyz/v1",
api_key=os.environ["WISPR_API_KEY"],
default_headers={"X-Wispr-Shield": "private-split"},
)
r = client.chat.completions.create(
model="auto",
messages=[{"role": "user", "content": "Review this contract and my position."}],
)import OpenAI from "openai";
const client = new OpenAI({
baseURL: "https://api.wispr.xyz/v1",
apiKey: process.env.WISPR_API_KEY,
defaultHeaders: { "X-Wispr-Shield": "private-split" },
});
const r = await client.chat.completions.create({
model: "auto",
messages: [{ role: "user", content: "Review this contract and my position." }],
});Every OpenAI endpoint, same shapes.
Pass straight through, shard aware.
Under the same key and balance.
Agents pay per request, no card.
Every model, box and GPU is billed at what it costs us. We charge once, when you top up. Stake $WISPR and the fee goes to zero.
Fee per month at each top up method. Usage is always provider price, shown per call in every response.
| Mode | Provider calls | Extra |
|---|---|---|
redact | 1 | none |
split | 2 to 4 | more tokens than one direct call |
private-split | 2 to 4 | one call lands on private inference |
| Confidential level | same | enclave box from 0.011 USD/h |
With Shield on, no. The split and the merge run inside an attested Intel TDX enclave on Phala. The enclave measurement is published and every response carries the quote, so you can check it with wispr attest. Our operators see shard metadata and spend, not the task. With Shield off, the gateway holds the prompt in memory to route it and does not log it.
Sometimes. A fragment loses the context around it, and heavily split tasks can answer worse than one direct call. The reconstructor validates the merge and re runs a shard that contradicts the others, and we will publish benchmarks per routing policy. When identifiers are the only sensitive part, redact mode keeps a single call.
Provider price for every call, plus one fee when you top up: 8% by card, 6% in crypto or over x402, 0% while you have $500 of $WISPR staked for 90 days. Split mode makes two to four provider calls, which you pay at provider price. Every response lists each call.
Private inference partners for sensitive shards and the major frontier and open models for everything else. Pick one with model, or let auto choose by sensitivity, capability and cost.
Top up with any crypto (converted to USDC on Base, bridge fee shown first) or by card, or let your agent pay per request over x402. Your balance is held in USD credits and every request shows the underlying provider cost.
Most "private AI" hides you from the model provider. WISPR hides the task from every provider, and from WISPR, with an attestation to prove it.
 WISPR |
|
AnonRouter | |
Dolphin | |
|---|---|---|---|---|---|
| Request split across models, no provider sees the whole task | Shield | ||||
| Names, secrets and identifiers pseudonymized before any model sees them | in the enclave | ||||
| Operator cannot read the full prompt, with attestation | split and merge in TDX | policy only | TEE on 7 models | TEE option | |
| Provider never sees your IP or identity | Relay | own models | |||
| Operator never knows who you are | hash + password sessions | account | anonymous accounts | account or wallet | chat only |
| Funding unlinkable to usage, zero knowledge deposit notes | deposit USDC, redeem a note into a session with a proof, beta | BTC, traceable | |||
| Hardware enclave option (TEE) | Confidential | 7 models | |||
| Attestation attached to every reply | TDX quote per reply | TEE models | TEE option | ||
| Request bodies not logged by default | retention opt in | unstated | |||
| Frontier and open models | 300+ | 400+ | 215 | open only, ~30 | own models |
| Images and video from the same key | Higgsfield, Runway, Luma, Kling | images | images | ||
| Always on agent compute and isolated workspaces (boxes, GPUs) | Compute, Environment | ||||
| Scoped secrets and signing for agents | Vault | ||||
| Pay with crypto, no card | any coin, settled in USDC on Base, x402 per request | via Coinbase | BTC, Lightning | VVV / DIEM | |
| Cost on top of provider price | 6% crypto · 8% card · 0% staked | 5.5% top up | 8% top up | sub or stake | list price |
No account, just a secret file and a password. Pay in any crypto, card, or per request with x402. Provider price, one fee at top up, zero if you stake $WISPR.
Competitor rows from public docs and sites, fee figures re-checked 29 Oct 2026 (AnonRouter lists 8% with a 5% launch promo). Company stated where no audit exists. Tell us if something is wrong and we will fix the row.
What people said about AI privacy in 2026, with the sources, and what WISPR does about each one. Where we are still building, it says so.
The NYT case forced OpenAI to keep every chat, temporary ones included, and a judge ordered a 20 million chat sample handed over. Only API traffic on zero retention endpoints was exempt. "No logs" has to be structural, not a policy.
WISPR live
Shield splits and merges inside an attested enclave, so the full prompt never exists on a machine we control outside it. The gateway stores shard metadata and spend, not the task. A retention order against WISPR gets fragments, not conversations.
How Shield works→Altman said ChatGPT therapy chats carry no legal confidentiality, and a 2026 court held that Claude chats are not covered by attorney client privilege. Bar associations and HIPAA guidance tell lawyers and clinicians not to paste client data into a chatbot.
WISPR live
Sessions are a hash and a password, with no email or account behind them. redact mode strips names, numbers and identifiers inside the enclave before any model sees the text. What a provider receives cannot be tied back to you or your client.
With a normal router your prompt and your API key arrive in the same readable request, so the middleman holds both. A 2026 arXiv paper, "The Proxy Knows Too Much", argues that an LLM router has to run inside an attested TEE to be trusted at all.
WISPR live
The planner and the merge run in an Intel TDX enclave on Phala. Requests are encrypted to the enclave key, which is bound to a published code measurement. GET /v1/attest returns the quote, wispr attest shield checks it, and the SDK refuses a mismatch.
When Confer and Tinfoil launched, Hacker News answered with "a TEE compromise exposes everything", "attestation does not prove no side channel", and the tee.fail breaks of NVIDIA confidential computing. People want a second layer.
WISPR live local mode building
Even a broken enclave only ever held fragments bound for different providers, through different Relay exits, under a session that is not you. For people who will not trust any attestation, SDK local mode moves the planner onto your machine so no enclave is needed.
Private from whom→Writers, researchers and security teams hit refusals on benign prompts, with a 14x refusal gap measured between models on the same safe questions. The escape hatches are worse: "uncensored" models get dumber and less truthful, and Venice users report silent "model not available" errors when a guideline trips.
WISPR building
A refused shard is re run on a less restrictive model while the rest of the task stays on a frontier model, so quality holds. A refusal is a typed error, never a silent failure. Benchmarks per routing policy will be published with the release.
Error codes→In April three coding agents posted their own API keys after a prompt injection, and 24,000 secrets were found sitting in public MCP config files. Every vendor describes prompt injection as unsolved, which means the key has to be somewhere the agent cannot reach.
WISPR live outbound filter building
Vault issues scoped, expiring grants and does the signing itself, so the agent gets a result, not a key. A compromised agent can spend its allowance and nothing more. Next: an outbound filter on Relay that blocks anything shaped like a credential from leaving the box.
Vault→How it works
Shield splits a task inside the enclave. Each provider receives one fragment and the answer is merged back where nobody can read it.
What it gives you
Use the strongest model on the market without that model's provider ever seeing your task.
How it works
A session is a note hash and a password. No email, no phone, no identity on file, and request bodies are never written to disk.
What it gives you
There is no account to subpoena, breach or sell. Open a session and go.
How it works
Deposit notes break the link between the money that funds a session and the requests it makes. The note is redeemed, the session spends.
What it gives you
Pay in and work without the two ever being tied together on our side.
How it works
Chats and files are encrypted with a key derived from your password in the browser. WISPR stores ciphertext and cannot open it.
What it gives you
Your history survives, in a form only you can read. Lose the password and nobody can recover it, including us.
How it works
A shard that comes back refused is re run on a less restrictive model while the rest of the task stays on a frontier model.
What it gives you
No silent failures and no dumbed down uncensored model. You get a typed error or a real answer.
How it works
Vault issues scoped, expiring grants and signs inside the enclave. The agent gets a result, never the key.
What it gives you
A compromised agent can spend its allowance and nothing more.
Quotes and figures from public threads, filings and posts collected 28 Oct 2026. Links go to the original sources. If we have misread one, tell us and we will correct it.
Free credits on signup. No email required.