On 4 November Venice announced that Kimi K3.1 Pro is now a “Private” model: every brief written and every output generated is neither stored nor used to train anything. The model page confirms zero retention on prompts, uploads and results. Then it adds, with a frankness that deserves to be imitated more often, what the word “private” does not say.

Four tiers, not one

The API documentation lists four modes sitting on top of a common proxy: Anonymous, where the user’s identity never reaches the provider but the prompt does; Private, zero data retention, guaranteed by contract; TEE, inference inside a hardware enclave with remote attestation; E2EE, where the client encrypts the prompt and only the verified enclave decrypts it. These are four increasing degrees of protection, and Venice keeps them apart instead of cramming them all under a single label.

Kimi K3.1 Pro sits on the second rung. The page says so explicitly: inference for this model is not isolated in a TEE and is not end-to-end encrypted, so the guarantee is the zero-retention policy. Put plainly: a promise you can verify in a contract, and in a lawsuit if it comes to that, not in a cryptographic attestation. Anyone who needs the second kind of proof has to look for a model carrying the e2ee identifier and accept the limits that come with it.

The paradox of the label

The same spec sheet carries a detail worth more than the press release: Venice classifies Kimi K3.1 Pro as filtered, so it is not the model to choose for uncensored output. On a platform that built its identity on the absence of filters, the new flagship arrives private and not free. That is not a contradiction, it is proof that privacy and freedom of expression run on different axes: one is about who can read, the other about what can be said. Confusing the two is the most common mistake in the debate over AI.

A label that moves without a changelog

Then there is the mechanics. The October changelog still lists Kimi K3.1 Pro as “Anonymous”, while the model page today reads “Private”. Not a scandal: the tier is a label maintained model by model, and the changelog trails behind. But for anyone choosing on privacy grounds the label is the interface, and an interface that changes without a line in the log is exactly the point where trust has to move from reading to verification.

Meanwhile the market does not reward the refinement: VVV trades just under 22 dollars, with a market capitalisation around 1.06 billion, roughly 37% below the September peak. Privacy remains Venice’s best product and its most fragile argument, because it sells with one sentence and can only be proven by reading the notes at the bottom of the page.

Verified sources: venice.ai/models/kimi-k3-1-pro, the model page with its Private tier, its declared limits (no TEE, no end-to-end encryption, filtered model) and pricing, read on 2026-11-05; @AskVenice notice of 2026-11-04; docs.venice.ai/overview/privacy, the Anonymous/Private/TEE/E2EE taxonomy, read on 2026-11-05; venice.ai/changelog, October 2026, where the model still appears as Anonymous; DefiLlama, Venice protocol page, price 21.81 dollars, market cap 1.066 billion, all-time high of 34.53 dollars on 21 September (2026-11-05); CoinGecko API, 21.66 dollars and 1.059 billion (2026-11-05). Note on discrepancies: the report indicated a Venice TVL of 1,489,834,092 dollars, which does not exist on the source cited: DefiLlama reports TVL of 0 dollars and keeps staking as a separate series (744.92 million, 69.86% of market capitalisation); the 24-hour change in the report (−5.3%) does not match CoinGecko’s (−11.4%) and was not published.