TEE and E2EE

Mystro supports TEE and E2EE on supported inference routes. Treat their coverage as a property of the approved route, rather than every operation in your product.

Trusted execution environment

A trusted execution environment (TEE) provides a protected execution boundary for computation. For your route, confirm which inference components run inside that boundary, how its identity is verified, and what evidence is available to your integration.

The specific attestation flow, hardware, measurement policy, and verification interface are not established by this guide. Obtain those details before making implementation-specific guarantees to your customers.

End-to-end encryption

End-to-end encryption (E2EE) protects content between defined endpoints. Confirm the endpoints for your route, where plaintext becomes available for inference, and where returned content is decrypted. Do not assume that browser-to-provider coverage follows from a route supporting E2EE.

Key ownership, generation, custody, rotation, and recovery details must be confirmed for the approved integration. This guide does not establish customer-managed keys or exclusive customer key possession.

Outside the inference boundary

External tools, your application, stored conversation history, logs, and backups require separate review. TEE and E2EE are not blanket claims about every system that handles a workflow's data. See data boundaries.