The Developer Guide to Private Images

Private image generation is not one feature. It is a chain of choices.

Start with the request. Treat prompts, source images, masks, reference images, generated outputs, and keys as user content. That means they deserve a narrower path than ordinary telemetry. They should not casually appear in logs, analytics, dashboards, or customer support screens.

Next, separate authorization from content. The system needs to know whether the account can run the task and pay for it. That does not mean the billing layer needs the prompt. Content-blind billing is boring in exactly the right way: it records that usage happened without recording what was made.

Then make processing short-lived. A Generation Session should exist to process a task and return the result, not to become a durable workspace. Temporary files may be necessary while the job runs. They should not become product state after the job finishes.

Keep observability content-blind. You still need metrics: queue time, model performance, failure type, capacity, cost, and health. You do not need raw user content in most operational events. If you think you do, ask whether you are debugging the system or hoarding customer context because it is easier.

Be careful with retries. Failed jobs should not leak prompts into logs or leave source images behind. Retry systems are useful, but they must respect the same content boundary as successful jobs.

Decide whether you are offering history. If you provide a gallery, say so. If you do not, make that a feature. A no-gallery architecture is easier to align with zero-retention promises because outputs are returned rather than retained.

Write the docs for non-experts. “Sealed request” is useful only if the user can understand what it protects and what it does not. Say where content goes, what remains, and what operators can see.

The developer’s guide is really this: reduce the number of places private image content can live, then make the remaining path easy to explain.

Further reading: Getting started, How Unexposed works, and Unexposed data storage.