Skip to main content
Private is where most open-weight models start. Nito sends every call with the provider’s zero-data-retention setting on, and lists a model at Private only where the provider offers that setting. The provider serves the request and is required to keep nothing once it has answered. Nito stores nothing you send or receive.

​
What It Protects Against

The provider keeping the request after serving it, on top of everything Anonymous gives you.

​
What It Does Not Cover

  • The provider’s operator during the call. Private rests on the provider honoring its zero-retention setting. For hardware that keeps the operator out while the model runs, and evidence of it, use Confidential.
  • The search query. Nito runs web search and fetch as its own step before the model call, so the call keeps its retention setting. The query, generated from your prompt and redacted of secrets and identifiers, still reaches a search provider, and the redaction is best-effort. Turn the tools off for a prompt if that matters. See Data Retention and Visibility.

​
Picking It

Choose a model whose level is Private. See the Model List. A call the model cannot serve at its level fails with a clear message.

​
When to Use It

When what the provider retains is the deciding factor: confidential business content, customer data. For evidence of where the call ran, use Confidential.

Privacy Levels

All four levels.

Confidential

Sealed hardware with attestation you can verify.

Data Retention and Visibility

Who can see what.