Confidential computing is a privacy-preserving technology that protects data while it is being processed. Unlike traditional methods that focus on protecting data when it’s stored (at rest) or moving between systems (in transit), confidential computing secures data in use. That is, while it’s actively being analyzed or computed.
This is made possible through hardware-based Trusted Execution Environments (TEE). These are isolated areas within a computer’s processor that run code and process data in a protected environment. Even if the operating system or infrastructure is compromised, the data and the computation inside a TEE remain inaccessible to unauthorized access.
Organizations today work with sensitive information, including customer data, intellectual property, proprietary algorithms, financial records, health data, and more. While encryption can protect this information when it’s stored or transferred, it often must be decrypted to perform any kind of processing. That moment of decryption can expose data to internal threats, cloud providers, or attackers exploiting system vulnerabilities.
Confidential computing fills that gap. It allows data to stay protected even when in active use by:
This method allows multiple parties to work together on sensitive datasets without revealing the raw data to each other or to the infrastructure provider, making it a crucial tool for data security and regulatory compliance.
A Trusted Execution Environment is a secure enclave within a processor. TEEs operate separately from the rest of the system and only allow pre-approved code to run inside them.
The process works through several steps:
Attestation is the process of proving that a TEE is genuine and running the expected code.
There are two types:
No one else, including the cloud operator, provider, or host system, can access what’s happening inside the TEE.
Organizations adopt confidential computing for a variety of reasons, particularly when handling private, regulated, or proprietary data. Some of the main benefits include:
Confidential computing is supported by several major cloud environments and hardware vendors. These include:
Confidential computing is also supported through open standards and collaborations like the Confidential Computing Consortium, which promotes ecosystem growth and interoperability.
Confidential computing offers strong privacy protections, but there are some trade-offs. Deployment may require additional steps like attestation and key management, which can add complexity. In some cases, only specially written code can run inside a TEE, and availability may be limited across confidential cloud regions. Despite these factors, confidential computing remains a valuable option for secure data collaboration and privacy-focused workloads.
Confidential computing is useful across a wide range of industries. Common applications include:
Because the computations happen inside TEEs, these collaborations do not expose the data or models outside the protected environment.
At Duality, confidential computing plays an important role in our broader platform for data confidentiality and collaboration. TEEs are one of several Privacy-Enhancing Technologies (PETs) available to our users, alongside methods like fully homomorphic encryption (FHE), federated learning (FL), and differential privacy (DP).
We integrate confidential computing into the platform to allow organizations to work together on private or regulated data without revealing it to collaborators or infrastructure providers. This can include:
For example, this means a pharmaceutical company can run a drug trial across data from multiple hospitals, or a bank can detect fraud patterns across industry data, all without any party seeing the raw inputs from the others.
Our platform integrates directly with TEE-backed infrastructure such as AWS Nitro Enclaves, Google Confidential VMs. We also simplify what can be a complex setup process, handling tasks like attestation, key handling, and policy enforcement so users can focus on analysis and insight.
