Definition
Confidential computing is Confidential computing protects data and code while they are being processed, by running them inside a hardware-isolated, verifiable environment that even the cloud operator cannot read.
Confidential computing is a way of keeping data private while a computer is actually using it. The Confidential Computing Consortium, part of the Linux Foundation, defines it as protecting data in use by performing computation in a hardware-based, attested trusted execution environment.
Data has three states. It can sit on a disk (at rest), travel over a network (in transit), or be loaded into memory and processed (in use). Encryption has long covered the first two. The third was the weak spot: to compute on data, a machine normally has to decrypt it, which leaves it visible to the operating system, the hypervisor and anyone with administrator access to the host.
Think of a locked filing cabinet. Encryption at rest and in transit locks the cabinet and the delivery truck. Confidential computing gives you a locked reading room, so the data stays protected even while someone works on it.
The core piece is a trusted execution environment, or TEE. It is a region of a processor, and its memory, that the hardware isolates from everything else on the machine. The memory inside is encrypted with a key held by the chip, so the host software and the cloud operator cannot read or change it.
The second piece is attestation. Before you send anything sensitive, the TEE can produce proof, checkable by a third party, that it is genuine and running the code you expect. You verify first, then hand over the data.
Common hardware platforms include Intel TDX and AMD SEV. Accelerator makers have also added similar protections to chips that run AI models.
AI workloads move valuable things onto someone else's hardware: private documents, customer records and the model weights a company spent millions to train. Regulated industries and governments often cannot do that on an ordinary cloud.
With confidential computing, a hospital could run inference on patient data, or a lab could host a proprietary model on rented machines, with hardware enforcing that the host cannot peek. It also pairs with zero data retention promises: retention policies are a contract, while a TEE is an enforcement mechanism.
It is not magic. It protects against a curious or compromised host, not against bugs in your own code, a stolen password or a malicious prompt. Side-channel attacks on the hardware have been demonstrated in research, so the protection is strong but not absolute. Isolation can also add some performance cost, which varies by system.
Confidential computing is about where and how a model runs. Data residency is about which country the data stays in. Airgapping removes the network entirely. They can be combined, and a buyer with strict rules often wants more than one.
When a vendor says it offers confidential AI, ask two questions: what hardware does the isolation, and can you verify it yourself through attestation?
It keeps data private while a computer is processing it, by running the work inside a hardware-isolated environment that the host machine and cloud operator cannot read.
A trusted execution environment is an isolated region of a processor whose memory is encrypted and protected from the rest of the machine, including the operating system and hypervisor.
Google Cloud is rolling out OpenAI's GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna in private preview, billed on your existing Google invoice and commitments. For Google Cloud shops, the procurement excuse for skipping OpenAI is gone.
Google announced TPU 8tx, for confidential inference, and TPU 8i Max, for long-context work, on November 9, its third and fourth TPU systems this year. There is no price or date yet, so the software is what you can use today.