Confidential computing for AI: what TEE protection achieves and where its limits are

What is confidential computing?

Confidential computing protects data while it is being processed. Encryption in transit and on disk has existed for a long time; in the main memory of conventional servers, however, data sits in plain text. The Confidential Computing Consortium, an association under the umbrella of the Linux Foundation, describes confidential computing as the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment (TEE).

A TEE is an isolated area protected by the processor. The server’s operating system, hypervisor and administrators see only encrypted data from the outside. For AI this means: the model computes in this environment, and the data centre operator is not supposed to have access to inputs and answers. This is called confidential inference.

How does confidential inference work?

1. Protected environment on the CPU: A confidential virtual environment, for example with Intel TDX, isolates the main memory.
2. Protected GPU: Newer GPUs, such as the NVIDIA Hopper generation, have a confidential computing mode. NVIDIA describes it as protecting code and data even from the owner of the computer or cloud service. Intel points out that a GPU alone is not a complete TEE: it relies on the protected environment of the CPU.
3. Attestation: Before any data flows, the hardware delivers a signed report on the firmware and the software loaded. Your system or a verification service compares it with expected values. Only then are keys released. For systems with a GPU, Intel recommends a joint attestation of CPU and GPU.
4. Encrypted path: The request travels encrypted all the way into the protected environment; only there is it in plain text.

What does the protection achieve?

• Access by the operator: The provider’s administrators and hypervisor see no content. This lowers a risk that conventional hosting covers only by contract.
• Verifiability: Attestation shows which software is running and makes changes detectable.
• Choice of models: A provider can run models for many customers without seeing their content.

Where are the limits?

Confidential computing shifts trust; it does not remove the need for it. Looked at objectively:

• Hardware and firmware: You trust the manufacturer of the CPUs and GPUs, its firmware and its signing keys.
• Side channels: Research has shown that TEEs can be attacked through side channels, for example Intel SGX. Intel reflects such security advisories in the attestation: a report can state that additional configuration or software hardening is needed. Attestation is important proof of security, but not comprehensive proof.
• Trust boundary: Protection only holds if pre- and post-processing run within the same boundary: sign-in, document search, logs, caches, web search and connected tools. If any of these sits outside, it sees the plain text.
• Implementation: Audited hardware says little about the provider’s specific software. Ask for an independent review of the implementation.
• Law: The data remains personal data. A data processing agreement, a legal basis and a data protection impact assessment are still needed. If a TEE-protected service passes identifiable content on to a provider in a third country, the hardware removes neither the personal nature of the data nor the obligations under Chapter V GDPR (third-country transfers).

Which questions should you ask a provider?

Question	Why it matters
Are both CPU and GPU protected?	a GPU alone is not a complete TEE
Is attestation performed before keys are released, and can you check the report yourself?	otherwise you trust the provider, not the hardware
Do pre- and post-processing run within the same trust boundary?	plain text outside cancels out the protection
How does the provider handle security advisories and firmware updates?	new side channels keep coming to light
Is there an independent review of the specific implementation?	hardware certificates do not cover the software
Where is the provider based, and is it subject to the law of a third country?	jurisdiction and contracts remain separate questions

Supervisory authorities, too, assess the specific data flow. We are not aware of any general approval of TEE technology by a data protection authority (as of October 2026).

How does basebox handle this?

basebox takes a different approach: the platform and the AI model run on a server in your organisation or in our cloud in the München-Ost data centre (Munich). With the server, the hardware stays with you, and without an operations contract basebox has no access to your data. In the cloud, each organisation gets its own virtual environment and its own account management; access by our operations staff is limited to operations and is logged. This is a different architectural decision from confidential inference at a model provider; which one fits depends on whom you want to entrust with the processing. Details are on the Security page and in the security questions.