Skip to content

CONCEPT Cited by 1 source

Stateless processing

Definition

Stateless processing is a service-level discipline where, after a session completes, the service retains no access to the data it processed — there is no disk-write path, no external storage write path, no in-memory cache that outlives the session. The architectural consequence is that a later compromise of the service cannot recover earlier sessions' data, because the data was never kept.

Meta states the property verbatim in the 2025-04-30 WhatsApp Private Processing post:

"We operate Private Processing as a stateless service, which neither stores nor retains access to messages after the session has been completed. Additionally, Private Processing does not store messages to disk or external storage, and thus does not maintain durable access to this data."

Why this is structurally different from "data is deleted"

Standard services treat stored data as a resource — collect it, use it, delete it eventually (often at a retention boundary, sometimes on request). The attack surface is therefore the retention window: a compromise during that window exposes the data.

Stateless processing shrinks the retention window to the duration of the active session. There is no persistent storage of content; there is no asynchronous worker that needs the content later; there is no telemetry path that carries content to a log pipeline. The only copies of the plaintext that exist are the transient in-memory representation inside the TEE during inference.

Load-bearing on top of TEE

In a TEE-based inference service, stateless processing is what turns the TEE's "host can't see inside" into a "host cannot see inside now AND cannot look later" guarantee. Without statelessness, a TEE-backed service could still accumulate plaintext in external storage that a later host compromise would expose. Stateless processing closes that gap by never writing plaintext to any durable medium.

Composes with forward security

Stateless processing + forward security together give a two-axis property: stateless closes the durable-storage axis (there's nothing to find); forward-secure keys close the ephemeral-key axis (even the in-RAM session key can't be recovered from a later snapshot). Meta names the composition explicitly as "Stateless processing and forward security" as one of Private Processing's foundational requirements.

Discipline, not just policy

Stateless processing requires architectural decisions that enforce the property, not just an operational policy:

  • No disk / object-store write path for plaintext content.
  • Log-filtering egress so content cannot escape via observability.
  • Ephemeral per-session keys that are non-extractable from the TEE.
  • Minimised request inputs (concepts/data-minimization) — if only the needed message set is sent in, there's less content to be stateless-about.
  • CVM teardown or state-reset between sessions to guarantee no carry-over.

Seen in

Last updated · 319 distilled / 1,201 read