> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# What It Protects

> What stays private at Encrypted, what it relies on, and what sits outside the envelope.

## What Stays Private

| | At Encrypted |
| :- | :- |
| **From Nito** | Nito relays ciphertext and holds no key that opens it. |
| **From the provider's operator, its host system, and its cloud** | The model runs inside sealed hardware, and the private key exists only there. |
| **On the network** | The content is ciphertext under TLS. |
| **The model** | Reads the prompt inside the sealed hardware, where it answers. |

## What It Relies On

* **The key belonging to the sealed hardware.** The model's public key arrives with the attestation evidence. Checking the evidence, and confirming the key is bound to the attested workload, is what ties the key to the hardware. See [Verify It Yourself](/privacy/tee-attestation/verify-yourself-recipe).
* **Your device.** Plaintext exists on it, before encryption and after decryption.
* **Fresh keys for every message.** Each message uses a fresh ephemeral key, and the cipher authenticates the ciphertext. The authenticated variant also binds a per-request nonce, a timestamp, the model, and the message position into every envelope. Which variant applies depends on the backend. See [Protocol](/privacy/encrypted/protocol).
* **The code that encrypts.** In the Browser App that code arrives from Nito over TLS. With your own client on the API, it is yours. See [How It Works](/privacy/encrypted/how-it-works).

## Outside the Envelope

* **That a call happened.** Nito sees the time, the model, the account, and the size of the encrypted envelope, and settles usage from the token counts the provider reports. The content is sealed. The fact of the call is not.
* **Work done on your side.** Function tools at Encrypted run on your device, in plaintext, by design. In the Browser App, web grounding runs through a browser-side helper before encryption, so the search query leaves your browser before the prompt is encrypted. See [What Works at Encrypted](/privacy/encrypted/what-works).

## Related

<CardGroup cols={3}>
  <Card title="How It Works" icon="arrows-left-right-to-line" href="/privacy/encrypted/how-it-works">
    The call, step by step.
  </Card>

  <Card title="Data Retention and Visibility" icon="eye-slash" href="/privacy/data-retention-and-visibility">
    What Nito keeps, at every level.
  </Card>

  <Card title="Privacy Levels" icon="layer-group" href="/privacy/levels">
    The four levels side by side.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.