> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# TEE Attestation

> How a Confidential call proves it ran sealed: what Nito checks, what it hands back, and what you verify yourself.

A Confidential call runs inside a sealed, hardware-isolated environment. An **attestation** is the signed statement, produced by that hardware, describing what was running inside it. Attestation is what makes the claim checkable.

You supply a fresh random value (a nonce) with the request. You get back the raw hardware evidence, a structured summary, and whether the evidence passed Nito's baseline checks.

## The Boundary to Understand First

**Nito is a baseline verifier, not a full hardware-quote verifier.**

Nito checks that the evidence is present and well-formed, that the proof format and signing material are there, that the fresh value you supplied is echoed back, and that the binding between the evidence and your request holds.

Nito does **not** verify the underlying hardware evidence: the raw hardware quotes, certificate chains, certificate revocation lists, or Trusted Computing Base policies. Those are yours to complete, on the raw evidence Nito returns.

So a Nito result is **baseline-verified**, **attested**, and **verifiable**. It is never "fully verified," because Nito alone does not establish full hardware trust.

## Anti-Replay Is Caller-Driven

Nothing stores nonces between requests. Supply a fresh random value every time and the baseline enforces that the evidence was produced for this request. Omit it and an empty-binding report is permitted, which gives you no replay protection. Replay resistance is a property of the protocol you follow, not an unconditional guarantee. Full treatment: [the report-data binding](/privacy/tee-attestation/freshness-binding).

## This Section

* [**What a TEE is**](/privacy/tee-attestation/what-a-tee-is): the hardware concept, in plain language.
* [**The attestation pipeline**](/privacy/tee-attestation/attestation-pipeline): the end-to-end flow and everything that comes back.
* [**The seven-gate baseline**](/privacy/tee-attestation/seven-gate-baseline): the exact checks Nito runs, and the scope limit.
* [**The report-data binding**](/privacy/tee-attestation/freshness-binding): how your nonce is bound in and compared.
* [**Address-only model binding**](/privacy/tee-attestation/address-only-model-binding): two invariants that decide what a binding proves.
* [**Per-provider attestation**](/privacy/tee-attestation/per-provider-attestation): how evidence differs by backend.
* [**Verify it yourself**](/privacy/tee-attestation/verify-yourself-recipe): the procedure for completing the verification.

## Related Resources

<CardGroup cols={3}>
  <Card title="Confidential Level" icon="file-award" href="/privacy/levels/confidential">
    The level attestation backs.
  </Card>

  <Card title="Attestation Pipeline" icon="arrows-left-right-to-line" href="/privacy/tee-attestation/attestation-pipeline">
    The end-to-end flow of a Confidential attestation.
  </Card>

  <Card title="Verify It Yourself" icon="memo-circle-check" href="/privacy/tee-attestation/verify-yourself-recipe">
    Become the final verifier.
  </Card>
</CardGroup>