.png){kind=logo}
Flexible, scalable confidential computing
Start free on the platform, then choose the commercial model that fits how you operate.
Pay as you go*
Self-service on the platform. Prove the mechanism on one workload for free, then pay for what you use.
* Depending on the entry-level system.
Enterprise self-managed
Licence the platform and operate it yourself, in your own cloud accounts and operational model.
Built on enclaive (OEM)
For software vendors and service providers who want confidential computing inside their own offering: enclaive's trust layer embedded and shipped under your brand, and your customers get sealed workloads without ever meeting us.
Select a product
One control plane. Every cloud.
The platform layer: provision and operate confidential workloads across hyperscalers, European clouds and on-prem from a single control plane, deployed into your own cloud accounts.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
The cryptographic root of trust, back under your control.
HSM-grade key custody at VM economics. Where policy requires a certified hardware root, the vHSM bridges to physical HSMs so appliances retire on their own depreciation schedule.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
Confidential AI — prompts, models and data sealed in use.
Run inference and AI workloads where prompts, model weights and data stay encrypted in use, verified on the same terms as everything else in the estate.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
An open-source UEFI firmware you can verify.
An enterprise confidential computing firmware distribution: a reduced, reproducibly built firmware for confidential VMs, so the root of trust is something you verify rather than delegate.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
Your virtual machines, sealed at the silicon.
Confidential-ready VM images and packaging: move an existing workload into a sealed image without code changes, with disk encryption and measured boot from first start.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
Hardware isolation, extended to every pod.
Kubernetes on confidential infrastructure: extend hardware isolation to containerized workloads, with workload identity and sovereign key release built into the cluster.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
One place for identities, secrets and access.
One centralized control point for the database passwords, API keys and credentials modern estates scatter everywhere — released only to workloads that have proven themselves through attestation.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
Every workload proves what it is — before it gets anything.
Identity rooted in silicon rather than issued on trust: workloads are measured by the platform's trusted execution environment and verified against your policy before any secret is released.
Available in all three commercial models. The number depends on how much you seal, where it runs, how deep the custody goes and your regulatory requirements.
How much you seal
Pricing follows protected workloads, not seats — it tracks what you get value from.
Where it runs
Hyperscaler, European provider, on-prem or a mix — your accounts, your infra cost.
Custody depth
Keys alone is the smallest footprint; secrets, policy and evidence move the number.
Regulatory specifics
Supervised sectors need control mappings, audit support and specific terms.
Is it per seat, per workload or per core?
Per protected workload. Seats don't correlate with the value you get, and core-based pricing punishes exactly the compute-heavy workloads confidential computing is for.
What does the free tier actually include?
Enough to prove the mechanism: one confidential workload in your own cloud account, with exportable attestation evidence.
Can we start small and expand?
That's the intended path — most programmes start with key custody or one blocked workload, then expand along the evidence. Nothing in the pricing model penalises phased adoption.
What happens to our existing HSM investment?
It coexists. The vHSM bridges to certified physical HSMs where policy requires a hardware root of trust, so appliances retire on their depreciation schedule rather than on ours.
When should we choose OEM?
When confidential computing is part of what you sell rather than what you run. If you are a software vendor or service provider and your customers should get sealed workloads inside your product, under your brand, OEM is the model. If you only need to protect your own workloads, Pay as you go or Enterprise self-managed fit better.
What is the difference between OEM and Enterprise self-managed?
Enterprise self-managed licenses the platform for your own estate: you operate it to protect your workloads. OEM licenses enclaive's components for redistribution: you embed the trust layer in your offering and deliver it to your customers, with white-label attestation and key release and partner terms.
What does building on enclaive give our business?
A differentiated capability without building a confidential computing stack yourself: attestation, key release and evidence ship inside your product under your brand, integration and certification engineering is supported, and partner pricing with co-selling lets it grow with your customer base.
Why isn't the price on the page?
Because a number without your workload count, cloud mix and compliance regime would be a guess, and you'd have to redo it in the first call anyway. What we can do is be specific about what moves it — that's the drivers section above — and give you a written quote within a single conversation rather than a procurement cycle.
Do we pay for the cloud infrastructure separately?
Yes — deployment lands in your own cloud accounts, so infrastructure stays on your existing provider contracts and commitments. That's deliberate: it keeps your exit cheap and your negotiating position intact.
What support comes with each model?
Pay as you go is self-service. Enterprise self-managed includes named support and SLAs alongside compliance mappings and audit support. OEM terms include integration engineering and certification support.
Bring your estate. Leave with a quote
Workload count, clouds in play, key custody requirements and the compliance regime you answer to — that's a 30-minute call and a written number, not a procurement cycle.
