Who can read your prompt on an agent stack
Every box on the main path handles cleartext; whether it retains is per-box policy.
Retains payloads by default or by design
Retention depends on plan, setting, or contract
Retention is your own configuration
Your user
The prompt is born
Where browser extensions harvested
8M users' AI chats (2025)
Agent layer
App / framework telemetry
Tracing / observability SaaS
Memory / vector stores
Session replay / analytics
AI gateway
SaaS aggregator gateway
Its policy + routed host's
Security / DLP gateway
Observability console
Gateway-side caches
Self-hosted gateway
Inference providers
Model vendor's official API
Runs where the vendor runs
Cloud-hosted model
Region-pinned, cloud is processor
GPU host, open weights
Policies vary host by host
Plus: caches, batch files, abuse logs,
safety classifiers, subprocessors, backups
Self-hosted inference (the bypass)
Dedicated cloud
tenant / VPC
Your own
datacenter GPUs
No third party sees cleartext, but your own access logs and traces become the retention surface