> ## Documentation Index > Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Levels at a Glance > The four privacy levels in brief, how you reach each from the plugin, with links to the full Privacy section. Every model carries a privacy level, and the level decides how private a call to it is. This is the short version: enough to pick a level and keep working. The full treatment is in the [Privacy](/privacy/overview) section. ## Privacy Follows the Model, Per Call You choose privacy per prompt, by choosing a model, because [the level follows the model](/privacy/levels). The reason to climb only as high as you need: stronger levels narrow the set of models available and may add some overhead. For the most efficient use, match the level to the sensitivity of the call rather than always maxing it out. ## The Four Levels From lightest to strongest: | Level | How you reach it | What it gives you | | :--------------- | :-------------------------- | :------------------------------------------------------------------------------------------------------ | | **Anonymous** | Choose an Anonymous model | The frontier rung. The provider gets your request from Nito, without your identity attached. | | **Private** | Choose a Private model | Everything Anonymous gives you, plus the upstream provider held to zero data retention. | | **Confidential** | Choose a Confidential model | Runs inside a sealed environment (a TEE) that produces a signed attestation you can verify. | | **Encrypted** | Coming soon to the plugin | Adds client-side encryption to the sealed environment. Web search, files, tools, and streaming are off. | Confidential is the strongest level this release can run. An `:encrypted` model is refused with a message pointing you back to the three levels above. See [Encrypted](/privacy/levels/encrypted). Two terms worth defining: * **Zero data retention (ZDR)** means the upstream provider is told, contractually and technically, not to keep your request after serving it. * **Trusted Execution Environment (TEE)** is a sealed environment the surrounding system cannot read into, which can produce an **attestation**: a signed statement you can check. Think of it as a tamper-evident safe that also hands you a receipt proving it did the work. ## It Never Silently Downgrades If a model cannot serve a call at its level, the call **fails with a clear message** rather than dropping to a weaker level and serving you anyway. A guarantee that quietly weakens is worse than no guarantee, so Nito refuses instead. When a call at a stronger level succeeds, you know it was served at that level. ## Anonymous vs Private vs Confidential * **Anonymous and Private** work the same way for you (you just pick the model). The difference is what sits behind them: Anonymous is where frontier models run, with your identity detached, and Private is where open-weight models start, with the provider also held to zero data retention. * **Confidential** is the first level that gives you a **proof**: Private holds the provider to a promise, while Confidential gives you an attestation you can verify yourself. See [TEE Attestation](/privacy/tee-attestation). ## Related Resources Each level in depth, and what it protects. Which models sit at which level. How a model's name shows its level.