> ## Documentation Index > Fetch the complete documentation index at: https://docs.prem.io/llms.txt > Use this file to discover all available pages before exploring further. # Glossary > Definitions of the terms that the Prem API documentation uses. This page defines the terms that the Prem API documentation uses. Each page uses these terms with these exact meanings. ## Inference mode terms * **Inference mode**: The processing path for a request. The Prem API has two modes: confidential inference and Zero Data Retention. Each mode has its own routes, its own model catalog, and its own security boundary. * **Confidential inference**: The mode that encrypts your payload on your device. Only a sealed enclave can decrypt it. The routes start with `/rvenc`. See [Security Model](https://docs.prem.io/security-model.md). * **ZDR (Zero Data Retention)**: The standard mode. Prem sends an OpenAI-compatible request to a trusted partner, and the partner keeps no content. The routes start with `/openai`. Your content is plaintext at the gateway and at the partner. See [ZDR overview](https://docs.prem.io/zdr/overview.md). * **Standard inference**: The internal name for the ZDR mode. The analytics and the prices use this name. * **Trusted partner**: An inference operator that gives ZDR capacity under a zero-retention agreement. Prem does not name its partners in this documentation. ## Platform terms * **Prem API**: The end-to-end encrypted, OpenAI-compatible API for confidential AI inference. * **Prem API Gateway**: The service that receives your encrypted payloads. It handles authentication, billing, and routing. It cannot read your data. * **Enclave**: The sealed environment that decrypts your request, runs the AI model, and encrypts the response. The enclave runs inside a Trusted Execution Environment. * **Confidential Proxy**: A local proxy from the SDK. It exposes OpenAI-compatible and Anthropic-compatible routes. It encrypts and decrypts all traffic for you. See [Confidential Proxy](https://docs.prem.io/confidential-proxy.md). * **RVENC**: Raw volatile encrypted. The name of the encrypted inference endpoints, for example `/rvenc/chat/completions` and `/rvenc/models`. * **Decisions**: Typed questions about a piece of context, answered with probabilities. Served over a TypeSafe-compatible API. See [Decisions](https://docs.prem.io/guides/decisions.md). * **TypeSafe-compatible API**: The request and response format of Decisions. A state, a map of typed questions, and one distribution per question. The official TypeSafe client works against it. * **Question type**: The kind of a Decisions question: `choice`, `noul`, or `score`. * **Noul**: A Decisions question type that answers yes or no. The answer is a single probability. ## Hardware and attestation terms * **TEE (Trusted Execution Environment)**: A hardware-isolated environment. The processor encrypts the memory of the environment and blocks access from the outside. See [Security Model](https://docs.prem.io/security-model.md). * **CVM (Confidential Virtual Machine)**: A virtual machine with hardware-encrypted memory. Prem API uses AMD SEV-SNP and Intel TDX technology for CVMs. * **Attestation evidence**: A hardware-signed report or token that carries measurements and security claims. A verifier authenticates the evidence and applies a policy before accepting the runtime. See [Attestation](https://docs.prem.io/attestation.md). * **Nonce**: A random challenge value that you send with an attestation request. The report contains your nonce. This proves that the report is fresh and not a replay. * **TCB (Trusted Computing Base)**: The firmware and software that the attestation report measures. The TCB version shows the firmware and microcode versions, so you can confirm the security patch levels. ## Key and encryption terms * **KEK (Key Encryption Key)**: Your master key. The current SDK expects 32 bytes encoded as 64 hexadecimal characters. You generate and keep it. It wraps other keys. See [Encryption](https://docs.prem.io/encryption.md). * **DEK (Data Encryption Key)**: A unique key for one file (32 bytes). Each file gets its own DEK for isolation. * **DEK store**: The local store that holds your wrapped DEKs. Make a backup of it. If you lose it, you lose access to your uploaded files. * **RAG DEK**: A persistent key (32 bytes) for encrypted document search operations. * **KID (Key Identifier)**: An identifier that the system derives from your KEK. It identifies your keys on the server and does not show the KEK. * **XWing**: The hybrid key exchange that Prem API uses. It combines ML-KEM768 and X25519. * **ML-KEM768 (Kyber)**: A NIST-standardized quantum-resistant key encapsulation algorithm. * **X25519**: A proven elliptic curve key exchange algorithm. ## Account and API terms * **API key**: Your authentication credential. Prem issues API keys at the organization level. You can limit an API key with scopes and IP restrictions. See [API Keys](https://docs.prem.io/api-keys.md). * **Scope**: A permission on an API key. A scope defines which parts of the API the key can access, for example `chats.completion`. * **Organization**: The account level that owns API keys, rate limits, and billing. * **Tier**: The usage level of your organization (`BASE`, `TIER_1`, `TIER_2`, `TIER_3`). The tier controls your rate limits. See [Tiers](https://docs.prem.io/tiers.md). * **Idempotency key**: A header value that makes a retry safe. The API executes a request with a known key only once in a 24-hour period. > [!NOTE] > > If a term is missing from this page, contact us at [support@premai.io](mailto:support@premai.io). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.