Confidential Computing

Data can be protected in three places. On the hard drive, on its way across the network, and while the computer is computing with it. The first two cases have been solved for decades: you encrypt the data, turning it into a string of characters that is unreadable without the matching key. For computation, this long remained impossible, because a processor can only work with readable numbers. Confidential computing closes exactly this gap. The decrypted state exists only within a sealed-off area of the processor that no one can access from the outside.

Why companies distrust their own data centers

Most companies no longer run their software on their own hardware today. They rent computing power from providers such as Amazon, Microsoft, or Google. This means their data runs on someone else’s hardware, in someone else’s buildings, managed by someone else’s staff. Whoever holds administrator rights there can, in principle, look into memory and read along.

For many industries, this is a real obstacle. A hospital may not simply outsource patient data anywhere. A bank faces strict requirements for account transactions. Confidential computing shifts the question of trust: you no longer have to believe that the provider won’t look inside. Technically, it simply cannot.

In the AI industry, this issue is especially charged. Models are expensive to train and represent a valuable trade secret. At the same time, users often enter very private things when chatting. Both sides want to be protected, and both are sitting on the same foreign machine.

The sealed-off zone inside the processor

At the core of the technology is a so-called enclave, also called a Trusted Execution Environment. This is an area of memory that the processor itself secures. Everything stored there is encrypted by the hardware. The key is fixed inside the chip and never leaves it. Even the operating system, which otherwise controls everything, only ever sees unreadable data noise.

For this to be of any use, a second building block is needed: attestation. The chip issues a cryptographically signed certificate stating exactly which software is currently running in the enclave. This certificate can be verified remotely. Only once it checks out does one send in one’s secret data. This prevents anyone from secretly slipping in a manipulated program.

An analogy: the enclave is a vault room with machines inside. You feed in encrypted documents, calculations happen inside, and encrypted results come out. The janitor has access to the building but not to the vault. It’s important to distinguish this from homomorphic encryption: that computes directly with encrypted numbers, with no special hardware needed at all, but remains extremely slow to this day. Confidential computing does decrypt the data — just in a place no one can reach.

From cloud contracts to the phone in your pocket

The major cloud providers have long sold corresponding servers as a dedicated product, for instance under names like Confidential VMs. The underlying technology comes from chip manufacturers: Intel calls it SGX and TDX, AMD calls it SEV, and at ARM it’s called CCA. Nvidia has since built it into its AI graphics cards as well, so that models can compute in a protected manner.

In everyday life, too, this principle has long been sitting in your pocket. The fingerprint and facial profile on a smartphone reside in a separate security chip that functions like an enclave. Apple extended this concept to its servers in 2024 with Private Cloud Compute: requests to the AI are processed in sealed-off areas and then deleted.

A common misconception is that this solves everything. Enclaves are no magic trick. Researchers have repeatedly demonstrated side-channel attacks, in which conclusions about the data are drawn from power consumption or timing behavior. And if the software inside the enclave itself contains bugs, even the finest vault is of no help. Confidential computing shrinks the circle of those you have to trust — it does not eliminate it.