On paper, OpenRouter is the most private way to use uncensored models: it scores 65 / 100 on our privacy rubric, 1st of 37. DeepInfra, Hugging Face and NextBit are joint 2nd of 37 at 58, and Venice.ai is the highest-scoring service that markets itself as uncensored, at 55. Nobody scores above 65, because no provider’s “no logs” can be verified all the way to the model: it’s a promise in a policy. The one uncensored model with end-to-end encryption is Venice’s E2EE Gemma 4.
Scores come from each provider’s published policies, checked October 11–12, 2026. We haven’t audited anyone’s systems, and these scores say nothing about how well the models perform.
The top of the table
| Provider | Privacy | What it does well | Watch for |
|---|---|---|---|
| OpenRouter | 65, 1st of 37 | No prompt logging by default, no training, New York jurisdiction, names the upstream host for every request, accepts crypto (USDC) | Account required. 22 models, none abliterated |
| DeepInfra | 58, joint 2nd | Inputs held only in memory, outputs deleted once returned, no training, California company | Card only. 5 models |
| Hugging Face | 58, joint 2nd | Doesn’t store request or response bodies when routing, no training | Each upstream provider’s policy also applies |
| NextBit | 58, joint 2nd | Zero-retention terms, EU endpoint on its own hardware in Spain | 30-day legal-hold exception. 2 models |
| Venice.ai | 55, 5th of 37 | No logging for API inference, chat history kept on your device, Wyoming jurisdiction, crypto accepted | “Anonymized” frontier models still send your prompts to their vendor |
| Unfil.ai | 50, 6th of 37 | Says API prompts aren’t stored or used for training, no email needed, crypto accepted | No named company or jurisdiction; IP usage logs kept 30 days |
The first four are general inference hosts. They serve uncensored fine-tunes such as Hermes and Euryale but don’t market “uncensored”. OpenRouter, DeepInfra and NextBit list no abliterated models at all; Hugging Face routes 5 to other hosts. For a wider choice of priced abliterated and Heretic checkpoints, Unfil (6 listed) is the best-scoring option; Venice lists 2.
Why nobody gets near 100
Our rubric only gives points for what a provider documents. Two items carry 30 of the 100 points, and no provider in the top tier earns either one:
- Technical guarantee (20 points): attested confidential computing (a TEE), where hardware proves what code is running, or end-to-end encryption, applied to the service as a whole. A policy saying “we don’t log” doesn’t count.
- Independent audit or open-source code (10 points): nobody in the top tier has published an audit or open-sourced its servers. Two providers further down earn these points: AI Horde, for open-source code, which still scores only 28, partly because volunteer workers can see your prompts; and PayPerQ (45), for the open-source enclave code described below.
That caps everyone else at 70. OpenRouter loses 5 more for requiring an account, which is how it lands on 65.
The other gap is upstream. A gateway can keep no logs while the GPU host behind it does. OpenRouter and Hugging Face name that host for each request; most others don’t. Our full write-up, How private is “private” uncensored AI?, goes through every provider’s score.
Encrypted and TEE options
A few individual models go beyond a policy promise:
- Venice: Gemma 4 26B A4B Uncensored (E2EE), $0.19 / $0.88 per 1M tokens (input / output), 64K context. It’s the only uncensored model in our index with end-to-end encryption. Venice doesn’t say how it was uncensored, so we mark it Unverified until we test it.
- NanoGPT: Gemma 4 26B A4B Uncensored TEE, $0.15 / $0.70, labelled as running in a trusted execution environment. NanoGPT itself scores 35 (joint 19th of 37).
- PayPerQ: since September 2026, its privacy policy says every chat request is decrypted only inside an AWS Nitro Enclave running open-source, reproducibly built code that you can check before sending. That stops PayPerQ itself from reading your prompts, but the model host behind it still receives them in readable form, and none of its uncensored models are labelled E2EE. It earns the 10 open-source points, not the 20 for a guarantee: 45, joint 11th of 37.
- Dolphin: its network page says traffic is end-to-end encrypted, but requests run on anonymous third-party GPU operators and we found no privacy policy.
None of these earns the 20 rubric points. The first two cover one model, not the whole service; PayPerQ’s enclave doesn’t extend to the model host; and Dolphin’s claim isn’t backed by any policy. If you want more than a policy promise today, Venice’s E2EE Gemma 4 is the strongest documented option for an uncensored model.
Three providers we couldn’t score
A score needs a documented retention policy. Three providers don’t have one:
- AI/ML API: its privacy policy covers account, website and ad-cookie data, and says nothing about prompts or outputs.
- Dolphin: no privacy policy found.
- Mancer: its privacy policy doesn’t say whether prompts are kept.
Unscored doesn’t mean they log your prompts. It means there’s nothing in writing to hold them to.
See how each rubric item is scored on the methodology page, or compare every provider in the index.