A fully-private reading tier means giving up Opus
2026-07-05. A privacy tier for people who don’t want their collection data touching Anthropic at all — the raw collection and the reading served by an inference path that Anthropic never sees. The candidate is venice.ai, a privacy-first model router: requests go over TLS through Venice’s proxy, and Venice itself stores and logs no prompt or response content.
The thing that looks like a free lunch and isn’t: Venice does offer Claude Opus. So the obvious move is “route Opus through Venice and get the depth and the privacy.” That doesn’t work, and the reason is the whole point. Venice has two classes of model with two different privacy stories. Its own open-weight models — Llama, Qwen, DeepSeek, Mistral, GLM — run on Venice’s own GPUs; these are the ones marked Private, with the real zero-retention guarantee and the stronger modes on top (TEE: the model runs in a hardware-isolated enclave with remote attestation; E2EE: the client encrypts before sending and only a verified enclave can decrypt). The proprietary models — Opus, GPT, Gemini — are offered only through anonymized access: Venice strips your identity and metadata, but the prompt content is still forwarded to Anthropic’s own infrastructure to actually run the inference. Anonymized hides who you are from Anthropic. It does nothing about what you sent. Assume the upstream provider can see and store the content.
So Opus-through-Venice fails the exact goal that motivates the tier. The data still reaches Anthropic; you’ve only anonymized the sender. The privacy goal and Opus-quality readings are mutually exclusive on this platform, and probably in general — the depth Constello’s readings depend on comes from a frontier model that, by definition, you don’t get to run on someone else’s private hardware. It’s an either/or:
- Opus via Venice — identity anonymized from Anthropic, prompts still reach Anthropic. Fails the “never touches Anthropic” goal.
- A Venice-hosted open-weight model (Private / TEE / E2EE) — genuinely off Anthropic infra, actually private, but not Opus. The reading changes in depth and character, and the reading is the product — the calibration that pushes past the surface material to why the person collects and carries it is exactly what a weaker model loses first.1
Two framings tried and discarded on the way to this, worth keeping so they don’t get re-derived: first that Venice is “a privacy proxy sitting in front of Opus” (no — for Opus it’s only an anonymizing proxy, the inference is still Anthropic’s); then the overcorrection that “Venice doesn’t have Opus at all” (also no — it has Opus, just in a mode that defeats the purpose). The accurate version is the narrow one: Venice has Opus, but only anonymized, so it can’t be the private path.
One caveat if this ever ships: Venice has published no third-party security audit, where Anthropic holds SOC 2 Type II. The privacy story rests on trusting Venice’s architecture without external verification.
Deferred, not planned — this waits until the algorithm reads true, like the rest of the defensive/infrastructure layer. When it’s built, the cheap part is wiring (Venice is OpenAI-API-compatible); the real work is that an open-weight model needs its own prompt to approach an Opus-tier reading, so the reading design is model-specific, not a swap.