Multicloud AI & ERP / Cloud & AI Security, Governance & Compliance
Why it matters
Some data is too sensitive to expose even during processing: patient records, financial models, proprietary AI weights and data shared between companies. Confidential computing closes that last gap.
How it works
How it works
Data stays encrypted at rest and in transit. Processing happens inside a secure enclave or confidential VM whose memory the CPU encrypts. Attestation proves the hardware and code are trusted, and only then are keys released so the workload can decrypt and process privately.
AWS, Azure and Google Cloud compared
| AWS | Azure | Google Cloud | |
|---|---|---|---|
| Confidential VMs | AMD SEV-SNP instances | Confidential VMs (SEV-SNP, TDX) | Confidential VMs (SEV, SEV-SNP, TDX) |
| Enclaves | AWS Nitro Enclaves | Confidential containers | Confidential GKE Nodes |
| Attestation | Nitro Enclave attestation | Microsoft Azure Attestation | Confidential Space attestation |
| Key release | KMS with attestation | Secure key release from Managed HSM | Confidential Space key release |
| Confidential AI | Nitro-based isolation | Confidential GPUs (H100) | Confidential GPUs (H100) |
What makes each cloud different
AWS
The AWS Nitro System is designed so AWS operators cannot access customer memory, and Nitro Enclaves add isolated environments inside EC2 that release KMS keys only after attestation.
Azure
Azure offers confidential VMs, confidential containers and confidential GPUs for protecting AI models and data in use, with secure key release from Managed HSM to attested workloads.
Google Cloud
Google offers confidential VMs and GKE nodes, and Confidential Space lets several parties analyze shared data with attestation, without any party seeing the others' raw data.
Design decisions that matter
- 01Use it for the most sensitive processing
Not every workload needs it.
- 02Attest before releasing keys
Trust is verified, not assumed.
- 03Consider multi-party use cases
Joint analysis without sharing data.
- 04Test performance
Overheads are small but real.
Common mistakes we see
- Skipping attestation. Encryption without verified trust.
- Everything confidential by default. Cost and complexity without need.
- Ignoring AI models. Proprietary weights deserve protection too.
A practical 30-day plan
- Week 1
Identify data that needs protection in use.
- Week 2
Pilot a confidential VM or enclave.
- Week 3
Wire attestation to key release.
- Week 4
Measure performance and plan rollout.
How NTS helps
NTS designs confidential computing solutions on AWS, Azure and Google Cloud, covering enclaves, confidential VMs and GPUs, attestation and key release, and multi-party data collaboration.
What you get
- Workload assessment for confidential computing
- Confidential VMs, containers or GPUs deployed
- Attestation and key release design
- Performance and cost testing
Typical outcomes
- Sensitive data protected even from cloud operators
- New collaboration on shared sensitive data
- Stronger compliance for regulated workloads
How we work with you
- 1Assess
A focused review of your confidential computing across AWS, Azure and Google Cloud. We look for the gaps we find most often: skipping attestation, everything confidential by default and ignoring AI models.
- 2Design
A target architecture and roadmap built on the decisions that matter most: use it for the most sensitive processing, attest before releasing keys, consider multi-party use cases and test performance.
- 3Build
Hands-on delivery alongside your team. We identify data that needs protection in use, pilot a confidential VM or enclave, wire attestation to key release, and finally measure performance and plan rollout.
- 4Run and improve
We monitor attestation, update configurations and extend protection to new workloads.
Why teams choose NTS for confidential computing
- Protect data in use
We add the final layer of encryption beyond rest and transit.
- Attestation expertise
Keys are released only to verified, trusted environments.
- Practical adoption
We pick workloads where the protection truly matters.
Book a free 30-minute review
Talk to an NTS architect about your confidential computing on AWS, Azure and Google Cloud.