Technology

Confidential Computing: How Companies Can Process Sensitive Data Without Exposing It

Confidential Computing: How Companies Can Process Sensitive Data Without Exposing It

Most companies encrypt their data when it’s stored and when it’s sent across a network. But the moment they actually use that data, to run analytics, train a model, or process a transaction, it has to be decrypted in memory, and that’s the moment it’s most exposed. Confidential computing closes that gap by protecting data while it’s being processed, even from the cloud provider running the hardware. Here’s how it works, where it’s being used, and what it can and can’t do.

The problem: encryption has a blind spot

Data lives in three states: at rest (on disk), in transit (over the network), and in use (being processed). Standard encryption covers the first two well. The third is the weak link. To compute on data, a system normally has to decrypt it into memory, where it can be seen by anyone with enough access: a malicious insider, a compromised hypervisor, an attacker who has broken into the host, or a cloud administrator.

That’s a real obstacle for regulated industries and for anyone who wants to use public cloud for sensitive workloads. As organizations accelerate AI adoption, multi-cloud deployments, and cross-border data sharing, protecting information only at rest or in transit is no longer enough.

So what exactly is confidential computing?

Confidential computing is a way to keep data private even while it’s being used, not just when it’s stored or sent somewhere. It does this using trusted execution environments (TEEs), which act like secure, locked spaces inside a computer’s processor.

A useful analogy: imagine a locked glass-walled room inside a shared office. Work goes on inside, but nobody outside, including the building’s own staff, can see in or tamper with what’s happening. The workload is placed inside a trusted execution environment, where access to the data and code is restricted.

How it works

Confidential computing rests on two ideas working together. It leverages trusted execution environments and attestation services.

  1. Hardware isolation (the TEE). The processor itself creates an isolated region of memory. Data inside is encrypted in memory and can only be decrypted within the secure boundary of the chip, so the operating system, hypervisor, and cloud operator can’t read it. Common implementations include Intel SGX, AMD SEV-SNP, and Arm TrustZone, and Intel TDX and Arm CCA are also available in mainstream server processors.
  2. Attestation (the proof). Before sensitive data is released, the environment produces cryptographic evidence of what hardware and code it’s running. The data owner can verify this proof first, so data only flows into an environment that has been confirmed as genuine and unmodified. Using trusted execution and attestation, organizations can limit their trust assumptions while still leveraging public cloud scalability.

The result is that a company can run a sensitive workload on infrastructure it doesn’t fully trust, and still have technical assurance that the infrastructure owner can’t see inside.

Where companies are using it

  • Healthcare and life sciences. A pharma company could analyze clinical trial data from multiple hospitals while preserving patient privacy and complying with HIPAA or GDPR.
  • Financial services. Banks run multi-party analytics on customer data without exposing raw records to counterparties. Financial institutions are increasingly adopting TEE-based confidential computing for multi-party analytics without exposing plaintext records to a counterparty or cloud provider.
  • Collaborative analytics and data clean rooms. Two companies can combine data to learn something together without either side seeing the other’s raw data. One platform, for instance, allowed ID-level data matching across partners while maintaining full privacy and GDPR compliance.
  • Confidential AI. This is the fastest-growing driver. It provides a trusted execution layer that helps secure AI workloads during processing, reducing risks such as model theft, prompt leakage, data reconstruction, and insider access. GPU extensions provide encrypted GPU memory and attestation for GPU workloads, allowing training and inference where both the model and the data remain confidential. A company can send private data to a hosted model without the cloud operator, or even the model’s owner, seeing it.
  • Government and defense. Sensitive and classified workloads moving to cloud-style infrastructure.

The market is growing, with a caveat on the numbers

Analyst estimates differ widely, so treat any single figure with care. One report estimates the global market at USD 5.59 billion in 2025, reaching USD 6.48 billion in 2026. Different research firms use different definitions and arrive at very different totals. The more reliable signal is the direction: adoption is moving from early pilots to large-scale deployments in banking, healthcare, and public-sector workloads. And Gartner predicts that by 2029, more than 75% of operations processed in untrusted infrastructure will be secured in use by confidential computing. That’s a forecast, not a measurement. On the supply side, Microsoft announced general availability of Azure Confidential Computing virtual machines for use in the U.S. in March 2026, and several cloud ecosystems are expanding support for confidential GPUs, confidential containers, and confidential VMs.

What it doesn’t do

Confidential computing is powerful but not magic:

  • It protects data in use, not everything. It doesn’t fix bugs in your own application, stop a poorly designed system from leaking data through its outputs, or replace encryption at rest and in transit. It adds a layer.
  • Trust moves, it doesn’t vanish. You now trust the chip manufacturer and the attestation process. Hardware TEEs have also been the target of research into side-channel and other attacks, so patching and vendor transparency matter.
  • Performance and complexity. There can be overhead, and applications may need adjusting, though cloud providers have embedded TEEs directly into virtual machine offerings to enable migration of sensitive workloads without significant refactoring.
  • Not every workload needs it. Ideal use cases include regulated industries like finance, health, or defense, multi-tenant SaaS platforms handling sensitive user data, AI pipelines where both models and data must remain confidential, and cross-border processing with data sovereignty concerns.

It also sits alongside other privacy techniques rather than replacing them. Enterprises are extending protection to data in use through TEEs, homomorphic encryption accelerators, and secure multiparty computation, and some vendors combine TEEs with fully homomorphic encryption.

How a company can start

  1. Identify the workload. Pick one high-sensitivity process, such as a regulated analytics job or an AI inference service handling private data.
  2. Start with confidential VMs or containers. They typically need the least rework compared with building enclave-specific code.
  3. Plan for attestation. Decide who verifies the proof, what counts as an approved environment, and how that gets audited.
  4. Layer it with the basics. Keep encryption at rest and in transit, strong access controls, and monitoring in place.
  5. Test performance and compliance fit before expanding.

Frequently Asked Questions

What’s the difference between confidential computing and regular encryption?

Regular encryption protects data at rest and in transit, but data has to be decrypted to be processed. Confidential computing protects data while it’s being processed, by running it inside a hardware-isolated environment that even the host system and cloud operator can’t inspect.

Can the cloud provider still see my data?

Not the contents inside a properly configured trusted execution environment. The data is encrypted in memory and only decrypted within the secure boundary of the processor. You do still trust the hardware vendor and need to verify the environment through attestation before sending data.

Does it work for AI and machine learning?

Yes, and AI is a major driver. TEEs, including GPU-based ones, let companies run model training and inference while keeping both the data and the model protected, which reduces risks like model theft and prompt leakage.

Is confidential computing hard or expensive to adopt?

It’s become easier. Major cloud providers now offer confidential virtual machines and containers that need much less rework than custom enclave code. Costs and performance overhead vary by workload, so the practical approach is to pilot it on one sensitive process and measure the results before rolling it out widely.

Key takeaways

  • Standard encryption protects data at rest and in transit, but data in use is exposed in memory, which is the gap confidential computing addresses
  • It works through hardware-based trusted execution environments plus attestation that proves the environment is genuine
  • Leading uses are regulated analytics, multi-party data collaboration, and especially confidential AI
  • Market size estimates vary a lot by research firm, but the shift from pilots to production deployments is consistent across sources
  • It’s a layer, not a cure-all: it doesn’t fix application bugs, and you still trust the hardware vendor
  • The easiest way in is confidential VMs or containers on a major cloud, starting with one sensitive workload