What is confidential computing?
Confidential computing protects data while it is in use by processing it inside a trusted execution environment (TEE), a hardware-enforced region whose memory is encrypted and isolated from the rest of the machine. Encryption at rest and in transit leaves a gap, because data must be decrypted in memory before it can be computed on. A TEE closes that gap: the host operating system, the hypervisor, the cloud provider’s administrators, and other customers on the same server cannot read what runs inside it. Intel and AMD server processors support confidential virtual machines, and data center GPUs starting with NVIDIA’s H100 extend the protection to AI workloads.
Remote attestation makes the protection verifiable. The hardware signs a report of exactly which software is running in the protected environment, and a key management service checks that report before releasing the keys that decrypt the data.
Confidential computing in practice
A regional bank wants to run an open-weight model on rented cloud GPUs to extract figures from commercial loan files, but its risk committee requires that the cloud operator never see borrower financials. The bank runs the model server in a confidential virtual machine with the GPU in confidential mode. Its key service releases the document key only when the attestation report matches the approved software image, so plaintext loan data exists only inside protected memory. Confidential computing does not protect against a flaw in the application itself, so the bank still applies access control and output logging to the model server.