Skip to main content
Private is where open-weight models start. The upstream provider is held to zero data retention: instructed, contractually and technically, not to keep your request after serving it.

​
What You Get

  • Nothing retained upstream. A model is carried at Private only if the provider serving it can meet that requirement.
  • Nothing retained by Nito. Your prompt, the response, reasoning, tool payloads, and attachment contents are never persisted. That holds at every level.

​
How to Pick It

Choose a model whose level is Private. The level travels with the model, so there is nothing else to set. Browse with the models command, or see the Model List. The level is a property of the model, so a call never runs at a level the model does not carry. One that cannot be served at the level you chose fails with a clear message.

​
When to Use It

When what the provider retains is the deciding factor: confidential business content, customer data, anything where the provider keeping nothing is the assurance you need. When you also want proof of where the call ran, that is Confidential.

Privacy Levels in Depth

All four levels, and how each is chosen.

Confidential Level

Sealed execution with an attestation you can verify.

Data Retention and Visibility

What is kept, and who can see what.