Privacy Levels in Depth

Each Level Builds on the Last

Read the four as a ladder. Each rung adds a stronger guarantee and, in exchange, narrows the models and features available to you. Climb only as high as the call needs.

Level	How you reach it	What it adds
Anonymous	Pick a model whose level is Anonymous	Your identity detached before the provider sees the request
Private	Pick a model whose level is Private	Upstream provider held to zero data retention
Confidential	Pick a model that offers Confidential	Sealed execution with a verifiable attestation
Encrypted	Coming soon to the plugin	Client-side encryption to the sealed environment

The Level Follows the Model

There is no privacy flag on your command. The level is part of the model’s name. Anonymous and Private are a model’s own level, and its ID is just provider and model. A model that also offers a stronger level gets a separate entry in the catalog, whose name ends in :confidential or :encrypted.

z-ai/glm-5.2                 the Private entry
z-ai/glm-5.2:confidential    the Confidential entry
z-ai/glm-5.2:encrypted       the Encrypted entry, coming soon

One underlying model, several entries, one level each. You pick the level by picking the entry, and you never add the marker yourself: it is part of a name the catalog gives you. See Model ID Convention. Browse with the models command, then set your model with model or --model. Set it once and it stays until you change it, and the level comes with it.

Why a Model Reaches Only Certain Levels

No model offers every level, and the reason is what can be enforced on it.

Open-weight models can be served with zero data retention enforced, or run inside confidential hardware. That is what makes everything above Anonymous possible: retention switched off upstream, sealed execution, an attestation you can check. They start at Private and climb from there.
Frontier models always route through their provider. What can be done is detach your identity from the request: the provider gets it from Nito, without your identity attached. That is Anonymous, and it is as far as a frontier model goes.

So the ladder is not a quality ranking. It reflects what can be enforced on a given model.

It Never Silently Downgrades

If a call cannot be served at the chosen model’s level, it fails with a clear message rather than dropping to a weaker one. A guarantee that quietly weakens is worse than no guarantee, so the call is refused instead.

The Four Pages

Anonymous

The frontier rung. Your identity is detached before the provider sees the request.

Private

Privately served models with no upstream retention.

Confidential

Sealed execution with an attestation you can fetch and verify.

Encrypted

The top rung, adding client-side encryption to the sealed environment. Coming soon to the plugin.

​Each Level Builds on the Last

​The Level Follows the Model

​Why a Model Reaches Only Certain Levels

​It Never Silently Downgrades

​The Four Pages