Confidential Computing

Confidential computing uses hardware-based trusted execution environments - such as AMD SEV-SNP or Intel TDX - to encrypt a workload's memory while it runs. This closes the last gap in data protection: data is already encryptable at rest and in transit, and enclaves add encryption in use.

Remote attestation lets a relying party verify exactly what code is executing inside the enclave before trusting it. For a self-hosted control layer, confidential computing is an optional layer that hides in-memory data even from a privileged host administrator.