Your AI Transcript Isn't Yours: How Inference APIs Lock Sessions to the Provider

The early inference-API bargain was that a conversation was just input and output—keep both and you owned a portable record you could inspect, archive, replay, or hand to a different model. That was always a slight fiction (prompt caches, tokenization differences, non-deterministic sampling), but the semantic transcript still belonged to the user. Modern APIs are quietly eroding even that. Providers now return a blend of readable text and provider-bound state that is deliberately non-portable: reasoning tokens billed to you but delivered as opaque encrypted blobs, hosted web searches whose actual retrieved passages never reach the client, compacted context only the vendor can decrypt, and conversation state addressed entirely by server-side IDs. The result is that the file on your disk is no longer your session—it’s a partial view of a session whose operational state lives on someone else’s servers.

The author proposes five concrete tests for real ownership—inspection, export, replay, audit, and deletion—and argues today’s features fail them. A response ID is not a transcript; a list of citations is not the evidence a search actually placed in the model’s context; and a ciphertext you can’t decrypt is not user-controlled state. The piece is pointed about naming: fields like “encrypted_content” sound like a privacy guarantee but are better described as provider-sealed state. The encryption is real, but it hides the data from you, not from the inference provider that holds the keys. There can be a legitimate privacy upside (OpenAI can return encrypted reasoning with store:false and decrypt it in memory without persisting it, which helps zero-data-retention customers), yet the same mechanism also cements lock-in.

The lock-in shows up concretely across vendors. OpenAI’s Responses API and Google’s new Gemini Interactions API both default to storing conversations server-side (retained ~30 and up to 55 days respectively), turning a local transcript into a foreign key the app doesn’t control unless it explicitly opts out. Raw chain-of-thought stays hidden on all closed-weight models: OpenAI recovers prior reasoning only via previous_response_id or replayed encrypted_content, and Anthropic ships an encrypted “signature” plus a model-generated summary, with thinking blocks explicitly tied to the model that produced them and meant to be stripped when switching. These schemes preserve continuity inside one ecosystem while making a genuine cross-provider handoff impossible—an ownership shift that matters for anyone building tools, auditing agent behavior, or wanting the freedom to walk their work to another model.