Enabling End-to-End Encryption

Every request on Nito runs in privacy-preserving hardware, with attestation you can verify. End-to-end encryption adds encryption on your device.

Side by Side

Nito never retains your conversations, on any route. Encryption adds another check on that promise: it makes it impossible for Nito to ever see the prompt or the response.

	What it is	Protects against
Every request	Runs inside privacy-preserving hardware, with attestation you can verify	The provider’s operator, its host systems, or its cloud reading the request while the model runs
With encryption on	The same hardware, plus the prompt and response encrypted on your device on the way in and out	All of that, plus anyone between your device and the hardware reading the request, Nito included

Turning It On

Web App. End-to-end encryption in Settings, under Privacy.
API. Send a model’s :encrypted ID with the encryption headers and encrypt the messages on your client. See Model ID Convention.

The Key

The key your device encrypts with arrives with the attestation evidence. Nito checks that the key is present and the right shape for the declared algorithm, and hands it to you with the evidence. Confirming the key belongs to the attested workload is part of verifying the evidence. See Verify It Yourself.

What Changes With It On

Replies arrive whole in the Web App. They are decrypted in your browser before they can be shown.
Web search and fetch cannot run inside the encrypted request. In the Web App, Nito grounds the prompt with a browser-side step before encrypting, where the model supports it.
Fusion synthesis is an explicit step. The model answers come first, then a Synthesize answers action. See Fusion.
Fewer models. The Model List shows which models support it.

No Silent Downgrade

A call that asks for encryption and cannot be served that way fails with a clear message. When it succeeds, it ran encrypted.

How Privacy Works

The hardware every call runs in.

Encrypted Inference

How the encryption works, step by step.

Model List

Which models support end-to-end encryption.