Platform terms
- Prem API: The end-to-end encrypted, OpenAI-compatible API for confidential AI inference.
- Prem API Gateway: The service that receives your encrypted payloads. It handles authentication, billing, and routing. It cannot read your data.
- Enclave: The sealed environment that decrypts your request, runs the AI model, and encrypts the response. The enclave runs inside a Trusted Execution Environment.
- Confidential Proxy: A local proxy from the SDK. It exposes OpenAI-compatible and Anthropic-compatible routes. It encrypts and decrypts all traffic for you. See Confidential Proxy.
- RVENC: Raw volatile encrypted. The name of the encrypted inference endpoints, for example
/rvenc/chat/completions. - Model router: The component inside the sealed environment that sends each request to the correct AI model.
Hardware and attestation terms
- TEE (Trusted Execution Environment): A hardware-isolated environment. The processor encrypts the memory of the environment and blocks access from the outside. See Security Model.
- CVM (Confidential Virtual Machine): A virtual machine with hardware-encrypted memory. Prem API uses AMD SEV-SNP and Intel TDX technology for CVMs.
- Attestation: A hardware-signed report that proves which code runs on which hardware. You can verify the report independently. See Attestation.
- Nonce: A random challenge value that you send with an attestation request. The report contains your nonce. This proves that the report is fresh and not a replay.
- TCB (Trusted Computing Base): The firmware and software that the attestation report measures. The TCB version shows the firmware and microcode versions, so you can confirm the security patch levels.
Key and encryption terms
- KEK (Key Encryption Key): Your master key (32 bytes, base64). You generate it and keep it. It protects all other keys and does not leave your device without encryption. See Encryption.
- DEK (Data Encryption Key): A unique key for one file (32 bytes). Each file gets its own DEK for isolation.
- DEK store: The local store that holds your wrapped DEKs. Make a backup of it. If you lose it, you lose access to your uploaded files.
- RAG DEK: A persistent key (32 bytes) for encrypted document search operations.
- KID (Key Identifier): An identifier that the system derives from your KEK. It identifies your keys on the server and does not show the KEK.
- XWing: The hybrid key exchange that Prem API uses. It combines ML-KEM768 and X25519.
- ML-KEM768 (Kyber): A NIST-standardized quantum-resistant key encapsulation algorithm.
- X25519: A proven elliptic curve key exchange algorithm.
Account and API terms
- API key: Your authentication credential. Prem issues API keys at the organization level. You can limit an API key with scopes and IP restrictions. See API Keys.
- Scope: A permission on an API key. A scope defines which parts of the API the key can access, for example
chats.completion. - Organization: The account level that owns API keys, rate limits, and billing.
- Tier: The usage level of your organization (
BASE,TIER_1,TIER_2,TIER_3). The tier controls your rate limits. See Rate limits. - Idempotency key: A header value that makes a retry safe. The API executes a request with a known key only once in a 24-hour period.
If a term is missing from this page, contact us at support@premai.io.