Skip to main content
A Trusted Execution Environment solves the hardest case in data protection: data in use. Encryption protects data at rest and in transit, but to run a computation a machine has to decrypt the data into memory, and whoever controls the machine, the operating system, or the hypervisor can in principle read it there. A model cannot answer without processing your prompt, so without a TEE the prompt is exposed exactly when the work happens. A TEE closes that gap.

​
The TEE

A Trusted Execution Environment is a region of a computer, enforced by the processor, that runs code in isolation from everything else on the machine. The processor encrypts that region’s memory and refuses reads and writes from outside it. The machine’s operator, the operating system, the hypervisor, and other programs are kept out by the silicon, with no setting the host can switch off. On these pages, “sealed hardware” means a TEE.

​
Attestation

An attestation is the hardware’s signed statement of what is running inside the sealed region: a certificate the processor issues about itself.
  • Signed by the hardware, with a key rooted in the silicon, so it cannot be forged in software.
  • Commits to what is running, as a measurement: a cryptographic fingerprint of the exact code loaded into the region.
  • Carries a field you can fill. The report data is a small slot the workload sets before the signature is made. Nito’s backends put your request’s challenge there, so evidence produced for one request cannot be replayed for another.
If the environment is not a genuine TEE, or the code inside has been swapped, the signature does not check out. On a machine with a GPU, the GPU produces its own evidence alongside the processor’s.

​
Freshness

Each attestation request carries a random value, called a challenge or nonce. The workload stamps it into the signed evidence, so you can tell evidence made for your request from evidence made for someone else’s. You can send your own challenge, or let Nito generate one for you. A TEE seals the content of a call, never its existence, timing, or size.

​
On Nito

Confidential and Encrypted calls run inside these sealed environments. Nito fetches the evidence, checks that it is bound to the provider and model that will run the call, and hands it to you in full. See How Attestation Works.

How Attestation Works

What happens on every call.

Verify It Yourself

The procedure.

Glossary

The words on these pages.