confidential computing (TEE)

advancedspreading

A type of protection that keeps data in the processor's hardware-locked, encrypted memory environment even during processing, so even the machine operator cannot easily inspect it.

In plain terms

Data could already be well protected as long as it rested on the disk or traveled over the network: in these cases, it is encrypted. The weak point was the moment of processing, because to calculate, the data had to be decrypted, and in this case, the owner of the machine could theoretically look into them. Confidential computing closes this gap.

Imagine having your valuable material worked on in someone else's workshop, but the work takes place in a sealed, opaque booth. The workshop owner provides the space, the electricity and the machine, but cannot reach into the booth and cannot see what happens inside. This sealed booth is the trusted execution environment, abbreviated TEE.

In the AI era, this has become important because language models and agents mostly run in someone else's cloud while working with your emails, contracts, or health data. With confidential computing, the provider not only promises not to look into your data, but technical barriers also make this very difficult, and it is externally verifiable.

How it works

The processor manufacturer embeds a separate, protected area into the chip, whose memory the hardware encrypts with a key that never leaves the chip.
The program and data are loaded into this protected area. The operating system, the cloud provider's system administrator, and other programs running on the machine see only encrypted gibberish.
Before sending your data, the chip provides a digitally signed certificate confirming a genuine secure environment and exactly which program is running within it (containing the program's fingerprint). This is called remote attestation.
If verification is in order, data arrives via an encrypted channel directly to the protected area and is decrypted only for the duration of computation.
The result returns to you via an encrypted channel. When the protected environment shuts down, the memory key is destroyed, making its contents unreadable unless the program intentionally saved something from it.

An everyday example

Your phone cannot perform a more complex AI request, such as summarizing a long conversation, locally, so it sends it to the cloud. If the provider uses confidential computing, your messages are processed on the server in a sealed environment, and even the company's own staff cannot read them. Several major phone and messaging providers' "private" AI functions are built on such solutions.

Who is affected

entrepreneur, executiveYou can share trade secrets or customer data with a cloud AI service by restricting the provider's access not only through a contract but also via hardware protection.

patient, doctorSensitive health data can thus be analyzed by AI or jointly processed between hospitals without anyone seeing them in raw form. → Health

bank customer, investorBanks can thus jointly filter fraud or run AI analysis without your account data leaving the protected environment. → Money

developerIf you run an agent or model on third-party infrastructure, you must design what goes into the protected environment and how you verify its attestation. → Code

A common misconception

MythIf something runs with confidential computing, my data is fully secure, and I need to trust no one.

In realityTrust does not disappear; it shifts: you must still trust the chip manufacturer and the correctness of the program running in the secure environment. Moreover, the protection applies only during processing and does not guard against faulty or malicious applications.

Limits and risks

Protected environments have been breached multiple times via so-called side-channel attacks, which infer secrets from timing or power consumption, for example. In 2025, researchers also showed that anyone with physical access to a server can bypass protection using a cheap device attached to the memory module. Protection is therefore strong, but not impenetrable.
Protection is only worth something if someone actually verifies the attestation certificate, and also checks whether the program running in the protected area is public and audited.
It does not prevent the program itself from leaking: if an agent sends your data from the protected environment to a third party, the hardware will not stop it.
It comes with some slowdown and additional costs, and support on the graphics processors required for large AI models is newer and less mature.

Similar, but not the same

End-to-end encryption – It only protects the message in transit between sender and recipient, whereas confidential computing also protects the moment a server processes the data.
homomorphic encryption – This is a purely mathematical method that does not decrypt the data for calculation but is much slower; confidential computing relies on hardware protection and decrypts the data within a secured area.
sandbox – The sandbox protects the machine from an untrusted program; confidential computing does the reverse: it protects the program and its data from an untrusted machine.

Related concepts

Broader

data protection, cybersecurity, privacy-enhancing technologies

Narrower

trusted execution environment, remote authentication, secure enclave

On the edge

homomorphic encryption, federated learning, differential privacy, End-to-end encryption, sandbox

A brief history

The idea of a Trusted Execution Environment emerged in the 2000s within mobile phone chips. Intel's SGX technology, launched in 2015, brought it to PCs and smaller servers, while cloud solutions protecting entire virtual machines made it widely usable, first with AMD SEV from 2017. The term "confidential computing" spread in 2019 when the Confidential Computing Consortium was established under the Linux Foundation.

Where things stand

As of late 2026, every major cloud provider offers confidential virtual machines, and the protection is now also available on AI accelerator chips. More and more 'private cloud' features in consumer AI services are built on it, but the vast majority of AI processing still does not run this way.

Status: 2026 November

Also known as

confidential computing · confidential computing · confidential computing · trusted execution environment · trusted execution environment · TEE · secure enclave · confidential AI

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.