Attestation
On the Enterprise plan, redaction runs inside a Treza Enclave (AWS Nitro) instead of the managed software pipeline. Hardware attestation lets you cryptographically verify where your prompts were redacted β before any of them left your trust boundary for the LLM provider.
TEE-attested redaction is an Enterprise entitlement. Starter and Pro accounts always use managed software redaction (x-treza-mode: standard) and never route through a Treza Enclave. See Plans & Pricing.
Redaction modes
standard
Starter, Pro
Managed software redaction
No
tee
Enterprise
Treza Enclave (AWS Nitro), hardware-isolated
Yes
The mode is reported on every request:
POST /api/redact/chat/completionsβ thex-treza-moderesponse headerPOST /api/redact/runβ themodefield, plus anattestationobject (enclaveId,region,attested) on EnterpriseGET /api/redact/logβ each audit entry'sattestationRefrecords which environment performed the redaction (shared-software-redactionfor standard mode, the enclave id for TEE mode)
x-treza-mode: tee is only set when the redaction actually ran inside an attested enclave. If the enclave cannot be reached, the proxy fails closed (502 redaction_failed) rather than silently downgrading β your unredacted messages are never forwarded upstream.
What the attestation proves
A Treza Enclave produces a signed attestation document with Platform Configuration Register (PCR) measurements. For the redaction service this proves:
Code identity β the exact redaction enclave image (
pcr0), kernel and bootstrap (pcr1), and application (pcr2) that processed your textIsolation β redaction ran inside a hardware-isolated Nitro Enclave with no operator or host access to the plaintext
Engine versions β the
modelVersionandrecognizerVersionof the redaction engine, matching what is stamped on your audit entries
It does not attest the upstream LLM provider β only the Treza redaction step that runs before your request is forwarded.
For background on PCR measurements and attestation documents, see Attestation & Verification.
Get the attestation summary
GET /api/redact/attest β requires a Treza API key with the redact:run scope.
enclaveId
The Treza Enclave performing your redaction (matches attestationRef in the audit log)
region
AWS region the enclave runs in
pcr0 / pcr1 / pcr2
PCR measurements of the enclave image, kernel, and application
modelVersion
Redaction model version running in the enclave
recognizerVersion
Entity recognizer version
attested
true when the summary comes from a verified enclave attestation
On non-Enterprise plans the endpoint returns 403 with code: "PLAN_FEATURE":
Tying attestation to individual requests
Every redaction request β proxied or standalone β writes an audit entry whose attestationRef is the id of the environment that redacted it. To build an auditable chain:
Capture the
x-treza-request-idresponse header on each proxied request.Look the request up in
GET /api/redact/log(or the CSV export); itsattestationRef,modelVersion, andrecognizerVersionidentify the redaction environment.Compare
attestationRefagainst theenclaveIdfromGET /api/redact/attestand verify the PCR measurements against your approved values.
Related
Quickstart β send your first redacted request
Usage & Billing β audit log export
Last updated