Skip to main content
Encrypted is coming soon to the plugin. This release of the plugin and the nito command line tool cannot run a call at this level. Choosing an :encrypted model returns a message asking you to pick an Anonymous, Private, or Confidential model instead. Confidential is the strongest level you can use today.
Encrypted adds client-side end-to-end encryption to sealed execution. Your data is encrypted on your own machine against the attested key, so it can be read only inside the sealed environment that runs the computation.

​
What You Get

  • Everything Confidential gives you, including the attestation and the baseline verification.
  • Encryption that reaches the sealed environment rather than stopping at the edge of the system.

​
The Constraints

Encrypting end to end to a sealed environment rules out anything that would need to read or transform your request along the way. At this level these are unavailable:
  • Streaming. Output arrives as one complete response.
  • Reasoning
  • Tools
  • Prompt caching
  • Multi-part messages
Use Confidential when you need any of them.

​
How to Pick It

Not yet. The client checks the level before it routes anything, so an :encrypted model is refused:
When it ships you will pick it the way you pick any model, by choosing a catalog entry whose name ends in :encrypted.

​
When to Use It

The most sensitive single-shot requests, where end-to-end confidentiality is worth doing without streaming and tools.

Confidential Level

Sealed execution with an attestation, available today.

TEE Attestation

How attestation works, end to end.

Privacy Levels in Depth

All four levels, and how each is chosen.