> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> Definitions of the terms that the Prem API documentation uses.

This page defines the terms that the Prem API documentation uses. Each page uses these terms with these exact meanings.

## Platform terms

* **Prem API**: The end-to-end encrypted, OpenAI-compatible API for confidential AI inference.
* **Prem API Gateway**: The service that receives your encrypted payloads. It handles authentication, billing, and routing. It cannot read your data.
* **Enclave**: The sealed environment that decrypts your request, runs the AI model, and encrypts the response. The enclave runs inside a Trusted Execution Environment.
* **Confidential Proxy**: A local proxy from the SDK. It exposes OpenAI-compatible and Anthropic-compatible routes. It encrypts and decrypts all traffic for you. See [Confidential Proxy](/confidential-proxy).
* **RVENC**: Raw volatile encrypted. The name of the encrypted inference endpoints, for example `/rvenc/chat/completions`.
* **Model router**: The component inside the sealed environment that sends each request to the correct AI model.

## Hardware and attestation terms

* **TEE (Trusted Execution Environment)**: A hardware-isolated environment. The processor encrypts the memory of the environment and blocks access from the outside. See [Security Model](/security-model).
* **CVM (Confidential Virtual Machine)**: A virtual machine with hardware-encrypted memory. Prem API uses AMD SEV-SNP and Intel TDX technology for CVMs.
* **Attestation**: A hardware-signed report that proves which code runs on which hardware. You can verify the report independently. See [Attestation](/attestation).
* **Nonce**: A random challenge value that you send with an attestation request. The report contains your nonce. This proves that the report is fresh and not a replay.
* **TCB (Trusted Computing Base)**: The firmware and software that the attestation report measures. The TCB version shows the firmware and microcode versions, so you can confirm the security patch levels.

## Key and encryption terms

* **KEK (Key Encryption Key)**: Your master key (32 bytes, base64). You generate it and keep it. It protects all other keys and does not leave your device without encryption. See [Encryption](/encryption).
* **DEK (Data Encryption Key)**: A unique key for one file (32 bytes). Each file gets its own DEK for isolation.
* **DEK store**: The local store that holds your wrapped DEKs. Make a backup of it. If you lose it, you lose access to your uploaded files.
* **RAG DEK**: A persistent key (32 bytes) for encrypted document search operations.
* **KID (Key Identifier)**: An identifier that the system derives from your KEK. It identifies your keys on the server and does not show the KEK.
* **XWing**: The hybrid key exchange that Prem API uses. It combines ML-KEM768 and X25519.
* **ML-KEM768 (Kyber)**: A NIST-standardized quantum-resistant key encapsulation algorithm.
* **X25519**: A proven elliptic curve key exchange algorithm.

## Account and API terms

* **API key**: Your authentication credential. Prem issues API keys at the organization level. You can limit an API key with scopes and IP restrictions. See [API Keys](/api-keys).
* **Scope**: A permission on an API key. A scope defines which parts of the API the key can access, for example `chats.completion`.
* **Organization**: The account level that owns API keys, rate limits, and billing.
* **Tier**: The usage level of your organization (`BASE`, `TIER_1`, `TIER_2`, `TIER_3`). The tier controls your rate limits. See [Rate limits](/rate-limits).
* **Idempotency key**: A header value that makes a retry safe. The API executes a request with a known key only once in a 24-hour period.

<Note>
  If a term is missing from this page, contact us at [support@premai.io](mailto:support@premai.io).
</Note>