.png){kind=logo}
Use cloud and AI with full sovereignty
Public sector workloads are to be migrated to shared cloud platforms, IT service providers are to take over system operations, and AI is to support work on data holdings and applications. Yet high protection requirements stall these use cases, above all because sensitive information is processed on third-party infrastructure and public institutions lose control over their data.
Sovereign platforms for administration and health
Confidential computing layer behind the Deutschlandplattform and MEDI:CUS
Cloud registers with technical data sovereignty
Winning consortium, GovTech Deutschland and FITKO competition
Confidential AI for sensitive health data
Project led by the University of Lübeck
The security gap: unprotected data processing
Classic encryption protects data at rest and in transit. During processing, however, data sits unencrypted in memory. Privileged system components and administrators, or attackers holding the same rights, have technical access that contracts and software-based permissions cannot prevent.
Confidential computing protects data in use inside Trusted Execution Environments (TEEs). TEEs isolate workloads in hardware and block even privileged access. Remote attestation verifies each environment before keys and data are released. Public institutions use external infrastructure without admitting its operators into their trust model.
Stored data protected
Storage encryption, AES
Transmitted data protected
Transport encryption, TLS
Processed data: open
Unencrypted in memory while it is being used. This is where confidential computing closes the gap.
New possibilities for public institutions
Use cloud and managed services securely
Confidential computing separates technical operations from access to sensitive data, creating more room for external infrastructure and services.
Confidential AI
Sensitive administrative data flows into AI processes under control: pseudonymisation before external models, model execution in TEEs, or protected RAG workloads.
Collaborate across agencies on sensitive data
Run joint analyses and data spaces without exposing raw data to other participants or to the infrastructure operator.
How enclaive simplifies confidential computing
Different hardware technologies, remote attestation and key management must work together securely. enclaive bundles these functions in one integrated security architecture, usable across cloud and on-premises environments.
Confidential computing in the multi-cloud
A central control plane for provisioning and managing confidential environments across providers, automated and from one place.
Control over attestation and keys
Nitride provides independent remote attestation and workload IAM. Vault manages keys and secrets on the customer side, protected by TEEs.
Confidential VMs and Kubernetes
Buckypaper moves VMs into TEEs by lift-and-shift. Dyneemes enables confidential container orchestration in common Kubernetes distributions.
AI workloads with sensitive data
External models receive only pseudonymised data, your own and open-weight models run in TEEs, and confidential RAG protects data base, retrieval and processing.
How confidential computing becomes a sovereignty factor
Confidential computing gives public institutions control over their sensitive data, including on third-party or shared infrastructure. Four prerequisites must be met.
Relevant regulations and assessment frameworks
C5:2026 contains its own confidential computing criteria, for example on remote attestation. C3A offers direct anchor points in external key management, client-side encryption and operational sovereignty.
Appropriate technical safeguards such as cryptography and access controls are required. Confidential computing adds encryption of data in use and protection against privileged provider access.
Confidential computing strengthens technical measures under Art. 32 GDPR and limits unauthorised access. For social data it additionally supports the social secrecy obligation under Section 35 SGB I and the processing requirements under Section 80 SGB X.
No refactoring. Open standards and APIs.
Only a few percent additional compute overhead.
Cloud, hybrid, on-prem. TEE-agnostic.
enclaive already protects sensitive workloads in demanding platform and digitalisation projects for the public sector and healthcare: the Register-as-a-Service reference implementation, the GovTech-Framework behind the Deutschlandplattform and MEDI:CUS, and the AnoMed II project led by the University of Lübeck.
Create new room to act for digital administration
Cloud, AI and external operating models can be unlocked for sensitive workloads with full sovereignty. enclaive shows you how to turn them into a secure, resilient operating architecture.
Identify use cases
Where confidential computing creates the most value.
Develop the architecture
Protection needs and sovereignty requirements become a target picture.
Deliver the pilot
With our partner network, from pilot to production.
