Confidential Computing: Protecting Data While It Is In Use

TL;DR: Confidential computing protects data during processing with hardware-based trusted execution environments, closing the gap between encryption at rest and

Data is valuable, but it is also vulnerable when it is processed. Organisations that handle sensitive information such as Personally Identifiable Information (PII), financial data, or health records must guard against threats that target data in system memory. Traditional security measures encrypt data at rest in storage and in transit across the network, but once data is loaded into memory for computation, it often sits unencrypted and exposed to the operating system, hypervisor, or cloud provider administrators. This gap is where confidential computing steps in: it protects data while it is being used, ensuring that even during active processing, the data remains confidential and tamper-proof.

For engineering teams running AI workloads on shared infrastructure, this changes who must be trusted. Instead of relying on the entire host stack, confidential computing shrinks the trust boundary down to a hardware-protected environment where code and data are isolated. This environment can attest to its authenticity, allowing a relying party to verify that its workload is running inside a genuine protected enclave before ever sending secrets. Tools like the Open Enclave SDK, Gramine, and the Certifier Framework make this practical, enabling developers to build applications that run inside these secure compartments without re-architecting from scratch.

The Three States of Data: Closing the Gap

In any computing system, data exists in three states: at rest, in transit, and in use. The first two are well understood and commonly protected by encryption: data at rest is encrypted on disk with algorithms like AES, while data in transit is shielded by protocols such as TLS. But data in use, while it is being processed by the CPU, has traditionally been a blind spot. Conventional infrastructure lacks a built-in mechanism to protect data and application code in memory from privileged system software or cloud operators.

Confidential computing fills this blind spot by performing computation inside a hardware-based Trusted Execution Environment (TEE). A TEE is an isolated enclave within a processor that safeguards data and code from everything outside it, including the operating system, hypervisor, and other tenants sharing the same machine. Even if an attacker compromises the host, the data inside the TEE remains encrypted and inaccessible. This concept is not new; hardware vendors have offered similar capabilities in specialized forms, but the formation of the Confidential Computing Consortium (CCC) under the Linux Foundation has brought cross-industry alignment. The CCC defines confidential computing as “the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment.” By standardising definitions and fostering open-source projects, the consortium helps teams adopt TEEs without vendor lock-in.

Attestation is the linchpin that makes this trust model work. Because the TEE can generate a cryptographic report of its identity and the software it is running, a remote party can verify that the environment is genuine and has not been tampered with. This matters especially when workloads run on infrastructure you do not own: you no longer need to trust the cloud provider’s administrators or the hypervisor; you only need to trust the hardware root of trust and the attestation verification. Projects like Veraison, now graduated within the CCC, build software components for attestation verification services, giving operations teams a standard way to validate TEEs across cloud and edge deployments.

Why This Matters for AI and Agent Workloads

AI and agent-based applications are pushing the need for confidential computing to the forefront. These workloads routinely process prompts, documents, API keys, and proprietary models in memory, and they increasingly run on shared, multi-tenant infrastructure, such as public clouds, GPU clusters, or edge nodes. Without protection for data in use, sensitive model weights, user queries, and inference results are exposed to anyone with access to the host. This is especially problematic when handling regulated data like PII or health records, where a memory-scraping attack could lead to compliance violations and loss of trust.

The Certifier Framework for Confidential Computing, an incubating project within the CCC, simplifies this challenge for development teams. It provides a client API and a policy-driven evaluation server that unify attestation, secure storage, and secret sharing across multi-vendor TEE platforms. Instead of writing platform-specific code, a team can use the Certifier API to establish trust, provision secrets into an enclave, and create secure channels. The framework also supports scalable trust management, making it easier to rotate credentials and update policies without redeploying the entire application. This operational simplicity is critical for small and mid-sized European companies that cannot afford to build deep TEE expertise from scratch.

Consider a typical agent workflow: a customer prompt hits a cloud-hosted language model, which fetches context from a vector database, calls an external API, and returns a response. At every step, data is in memory. If an attacker on the same host dumps memory or compromises the hypervisor, they could steal prompts, retrieval results, or API keys. By running the agent inside a TEE, all intermediate data stays encrypted and isolated. Attestation ensures the client knows it is talking to a genuine enclave before sharing sensitive data.

Navigating the Confidential Computing Landscape

Adopting confidential computing requires understanding the available hardware and software building blocks. The CCC hosts several graduated projects that serve as on-ramps for different use cases. Gramine is a lightweight library OS that runs unmodified Linux applications inside Intel SGX enclaves, essentially providing a compatibility layer without requiring a full guest OS. It is much lighter than a traditional virtual machine and allows legacy applications to benefit from TEE protection with minimal changes. Open Enclave SDK is an open-source framework that abstracts away the differences between TEE implementations, letting developers write applications once and run them on various hardware-backed enclaves. Both projects have graduated, indicating mature governance and community support.

On the attestation front, Veraison provides components to build an Attestation Verification Service, handling the complex task of validating evidence from different TEE types. For teams deploying confidential VMs, the COCONUT-SVSM project offers a Secure VM Service Module that runs within the trusted compute base of a confidential virtual machine. It can operate in multiple modes: service module, paravisor, or service VM, to reduce the need to harden the guest OS against a malicious hypervisor. By proxying hypervisor services inside the trusted context, COCONUT-SVSM shrinks the attack surface and simplifies the security model.

These projects, backed by major hardware vendors and cloud providers, signal a maturing ecosystem. The tools are production-ready and increasingly integrated into cloud service offerings.

Frequently Asked Questions

Q: How does confidential computing differ from traditional encryption?

Confidential computing protects data while it is being processed, not just when it is stored or transmitted. Traditional encryption covers data at rest and in transit; confidential computing extends protection to data in use inside a hardware-based Trusted Execution Environment.

Q: What is attestation, and why is it important?

Attestation is a mechanism by which a TEE generates a cryptographic proof of its identity and the software it is running. A remote party can verify this proof to ensure that the environment is genuine and has not been compromised, allowing them to trust the enclave with secrets.

Q: Do I need to rewrite my applications to use confidential computing?

Not necessarily. Tools like Gramine and the Open Enclave SDK allow many applications to run inside TEEs with minimal modifications. The Certifier Framework further abstracts platform specifics, making it easier to add confidential computing capabilities to existing workloads.

Q: Is confidential computing only for cloud deployments?

No. While public cloud is a primary use case, confidential computing applies across environments: on-premises, edge, and hybrid. The CCC’s projects support a spectrum from lightweight library OSes to full confidential VMs, suitable for various deployment scenarios.

Further Reading

• Kimi 2.6 as an AI Engineering Auditor: Where It Actually Fits
• How to Map Data Flows in a Local-First AI Assistant
• The Local-First AI Assistant Wave: Privacy, Control, and Enterprise Adoption
• The Open-Source AI Repos European Engineering Teams Should Watch Right Now
• The New AI Development Stack: Premium Reasoning, Low-Cost Execution