Skip to main content
Confidential runs the model inside a Trusted Execution Environment: sealed hardware that keeps the provider’s operator, its host system, and its cloud out of the memory the model runs in, and that produces signed attestation evidence describing what is running inside. Your request goes through Nito to that hardware, the model answers from inside it, and Nito stores nothing. New to the idea? Start with What’s a TEE.

​
What It Protects Against

The provider’s operator reading your prompt or the reply while the model runs, on top of everything Private gives you. The operator loads the model and runs the machine. The hardware keeps it out of the sealed memory.

​
Evidence on Every Call

Before every Confidential call, Nito fetches fresh attestation evidence from the hardware serving that model, checks that the evidence is present and bound to the provider, the model, and the workload it expects, and refuses to run the call otherwise. The evidence proves that a genuine sealed environment running the expected workload was serving the model when the evidence was fetched. Nito hands it to you in full, and verifying it is yours. See How Attestation Works and Verify It Yourself.

​
What It Does Not Cover

  • Nito in transit. The prompt reaches the sealed hardware through Nito. Encrypted closes that.
  • That a call happened. Sealed hardware hides the content of a call, never its existence, timing, or size.

​
Picking It

Choose a model whose entry ends in :confidential. Streaming and the ordinary feature set work. A call that cannot run at Confidential fails with a clear message.

How Attestation Works

What the evidence is and how it reaches you.

Verify It Yourself

Completing the hardware verification.

Encrypted

Encryption on your device, on top of Confidential.