Confidential computing is a set of technologies that protect data while it is being used, by processing it inside a hardware-isolated area of a computer's processor called a trusted execution environment (TEE), or secure enclave. Data inside the enclave is encrypted in memory and cannot be read or altered by the operating system, the cloud provider or other software on the same machine. The approach completes the protection offered by encryption of data at rest, on disks, and in transit, across networks, which are already widely used.
Major chipmakers offer the technology, including Intel's Software Guard Extensions (SGX) and Trust Domain Extensions (TDX), AMD's Secure Encrypted Virtualization (SEV) and Arm's TrustZone, and recent Nvidia data-centre GPUs support confidential modes. Large cloud providers sell confidential virtual machines. The Confidential Computing Consortium, a Linux Foundation project founded in 2019, promotes standards. In finance and crypto, the technology is used to protect keys, private transactions and shared data analysis, and it is often compared with cryptographic alternatives such as zero-knowledge proofs and multi-party computation.
Confidential computing in plain terms
Normally, when you rent a computer in the cloud, you have to trust the landlord. Your data may be locked up on the way there and while stored, but to work on it the computer must unlock it, and at that moment the landlord could, in principle, peek.
Confidential computing builds a locked room inside the computer's chip. Your data is only ever unlocked inside that room, and the walls are made of hardware the landlord cannot open. Before you send anything, the room can also show you a signed certificate from the chipmaker proving exactly what program is running inside. You still have to trust the chipmaker, but no longer the landlord or anyone else with access to the machine.
How it works
Confidential computing rests on three features:
- Isolation. The processor sets aside protected memory for the enclave or confidential virtual machine, encrypted with keys that never leave the chip.
- Remote attestation. The hardware produces a signed report describing the code running inside, so a remote user can verify it before sending secrets.
- Sealing. Data can be encrypted so that only the same enclave code on the same platform can later decrypt it.
Together these let a program process sensitive information on hardware owned by someone else, much as a hardware security module protects keys, but for general-purpose code.
Uses in finance
Banks and payment firms use confidential computing to move sensitive workloads to cloud computing platforms while meeting data privacy rules. It also allows several institutions to pool data, for example to detect fraud or money laundering patterns across banks, without revealing customer details to one another. It is one of the privacy-enhancing technologies regulators have discussed for data sharing, and it is increasingly used to protect AI models and the data they are trained on.
Uses in crypto
Several blockchain projects use TEEs to add privacy to smart contracts, so that inputs and state are hidden even from the nodes running them; this is one way of building a confidential layer. Ethereum block-building systems have used TEEs so that builders can handle users' transactions without seeing or exploiting them before inclusion. Custody providers use enclaves to guard private keys, sometimes alongside a multi-party computation wallet. TEEs are also used to run AI agents that control crypto wallets in a verifiable way.
Limitations
Confidential computing shifts trust to hardware vendors and their attestation services rather than removing it. Researchers have repeatedly found side-channel and other attacks that extracted secrets from enclaves, particularly Intel SGX, prompting patches and, in some cases, exposing secrets of blockchain networks that relied on it. Enclaves can be slower and harder to program, and supply-chain or physical attacks remain a concern. For these reasons, many crypto designers prefer cryptographic methods such as zk-SNARKs where possible, and use TEEs as one layer of defence rather than the only one.
Regulators and standard-setters have so far treated confidential computing as a useful control rather than a guarantee. Firms that rely on it still need to show how they manage the keys, verify attestation reports and respond if a vulnerability is announced in the hardware they use. Costs have fallen as the feature has become standard in new server processors, which has widened its use beyond the largest banks and technology companies.