> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> The words used on the privacy and attestation pages.

**Attestation.** The hardware's signed statement of what is running inside a sealed region: a measurement of the code, the report data, and a signature rooted in the silicon. On Nito, the evidence returned for a Confidential or Encrypted model.

**Attestation subject.** The name the proof is bound to, so you can confirm the evidence belongs to the workload you meant to run. Each backend names its workload differently, and some model-bound requests omit it.

**Broker.** Nito's role in attestation. Nito fetches the evidence, binds it to a challenge, checks it against the route, and hands it to you. Verification is yours.

**Challenge (nonce).** A fresh random value you supply with a request, 32 bytes hex encoded, which the workload binds into the report data. Finding it inside the signed evidence proves the evidence was produced for your request.

**Client public key.** Your side of the key agreement at Encrypted, sent in the `nito-encrypted-client-pub-key` header. The sealed hardware encrypts the reply to it.

**Enclave.** Another word for the sealed region a TEE creates. These pages say "sealed hardware".

**Envelope.** At Encrypted, the hex string that replaces a message's content: an ephemeral public key, a cipher nonce, and the ciphertext with its authentication tag. See [Protocol](/privacy/encrypted/protocol).

**Ephemeral key.** A key pair generated for one message and discarded, so no two envelopes share a symmetric key.

**Measurement.** A cryptographic fingerprint of the exact code loaded into the sealed region, committed to in the attestation. A changed workload gives a different measurement.

**Model public key.** The key the sealed hardware attests to, returned with the attestation as `model_public_key`. Your device encrypts with it at Encrypted. The matching private key exists only inside the sealed hardware.

**Privacy level.** Anonymous, Private, Confidential, or Encrypted. Part of the model ID. See [Privacy Levels](/privacy/levels).

**Proof format.** The label on the evidence that names the backend's evidence layout: how the challenge and keys are bound inside the quote.

**Quote.** The processor's signed attestation document. Today an Intel TDX quote, verified with Intel's DCAP quote-verification library. GPU evidence is verified with NVIDIA's attestation service.

**Report data.** A small field inside the quote that the workload fills before the hardware signs. Backends bind your challenge, and where documented the signing keys, into it.

**Sealed hardware.** A Trusted Execution Environment: a region of a machine whose memory the processor encrypts and isolates from the operator, the operating system, the hypervisor, and other programs.

**TEE (Trusted Execution Environment).** See sealed hardware. The technology behind Confidential and Encrypted.

**Verified.** A result whose hardware evidence you have checked with the maker's tooling. Nito returns attested results, and verifying is yours. The `verified` field on the API response is always `false` for that reason.

**Variant.** One of the three Encrypted protocol variants (Standard, Authenticated, Legacy), selected by the attestation's proof format. See [Protocol](/privacy/encrypted/protocol).

**Zero data retention.** The provider's setting that requires it to keep nothing once a request is served. Sent on every Private call.

## Related

<CardGroup cols={3}>
  <Card title="What's a TEE" icon="microchip" href="/privacy/tee-attestation/what-a-tee-is">
    From the start.
  </Card>

  <Card title="How Attestation Works" icon="arrows-left-right-to-line" href="/privacy/tee-attestation/how-attestation-works">
    What happens on every call.
  </Card>

  <Card title="Privacy Levels" icon="layer-group" href="/privacy/levels">
    The four levels.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.