The best confidential computing companies of 2027 are solving a problem that encryption at rest and in transit never touched: what happens to sensitive data while it is actually being processed. For years, data had to be decrypted in memory before an application could use it, which left it exposed to cloud operators, compromised hypervisors and malicious insiders. Confidential computing closes that gap by running workloads inside a hardware-isolated trusted execution environment (TEE), where memory stays encrypted and remote attestation proves exactly which code is running before any secrets are released.
The market has changed quickly. What began as CPU enclaves for key management now reaches entire virtual machines, Kubernetes clusters and, most importantly for the AI era, GPUs. NVIDIA now lists confidential computing support across its Hopper, Blackwell and Rubin generations, every major hyperscaler sells confidential VMs, and a new wave of confidential AI vendors promises that models, prompts and training data can be used by a provider without ever being visible to that provider.
At the same time, buyers have learned that TEEs alone rarely solve the business problem. Banks that want to share fraud signals, hospitals that want to train models on each other’s patient records, and governments that need cross-border analytics all need several privacy enhancing technologies working together, plus governance over who can run what. That is why this list mixes three kinds of companies: secure data collaboration platforms that combine TEEs with homomorphic encryption and federated learning, specialist confidential computing software vendors, and the cloud and silicon providers whose hardware makes everything else possible.
Confidential VMs, Confidential GKE Nodes, Confidential Space
Google Cloud
AWS Nitro Enclaves
Isolating keys and secrets inside EC2
Nitro Hypervisor enclaves with KMS attestation
AWS EC2
NVIDIA Confidential Computing
Protecting models and data on GPUs
Hopper, Blackwell and Rubin GPU TEEs
Cloud and on-premises GPU infrastructure
Intel
Silicon-level enclaves and attestation
Intel SGX, Intel TDX, Intel Trust Authority
Any Intel-based cloud or data center
Super Protocol
Verifiable multi-party confidential AI
Super Swarm TEE orchestration on Kubernetes
Multi-cloud and on-premises
enclaive
European sovereign confidential cloud
eMCP control plane, confidential VMs and Kubernetes
European providers, hyperscalers, on-premises
Best Confidential Computing Companies In 2027
1. Duality Technologies: Secure Data Collaboration And AI On Data You Cannot Move
Duality Technologies is a privacy-enhancing technology platform that lets banks, hospitals and government agencies analyze and train AI on data they cannot move, centralize or expose. It takes the top spot because it offers something few vendors on this list can: alongside TEE-based confidential computing, its core fully homomorphic encryption (FHE) provides cryptographic guarantees that do not depend on trusting the hardware. Teams pick the protection that fits each workload, and Duality combines FHE and federated learning natively in one platform, so data can stay both distributed and encrypted through a computation.
The product line is organized around outcomes. Secure Query runs privacy-preserving queries across decentralized datasets, and Zero Footprint Query runs SQL-like queries directly on encrypted records without decrypting them. Secure Collaborative AI handles cross-organization model training and inference, including federated learning through an integration with NVIDIA FLARE, with model updates aggregated under encryption rather than in the clear and differential privacy applied in training. Secure Federated Analytics produces statistics across silos. For generative AI, Duality supports private LLM inference and RAG over sensitive documents, combining FHE with TEE-based confidential computing so prompts, retrieved content and outputs never leave a trusted environment. The Duality Assistant Agent uses AI to research, generate insights and produce reports directly on sensitive data, and Duality 4.6 adds data harmonization (schema mapping, normalization and fuzzy matching) for multi-organization projects. Policy-based governance logs who ran which computation, when and under what controls, and teams integrate through an SDK, a REST API and connectors to existing data warehouses.
Duality is delivered as customer-managed software, so Duality itself never accesses the sensitive data. It deploys on AWS, Azure and Google Cloud, on-premises, in hybrid setups and fully air-gapped for classified environments, and customers keep control of their encryption keys. That is how Duality defines sovereign AI: data, models, keys and processing stay under approved organizational and jurisdictional control, even when collaboration spans clouds, institutions or borders. Its TEE work spans AWS Nitro Enclaves (with an AWS Marketplace listing), Azure Marketplace and Google Cloud, which names Duality among its Confidential Space customers. In partnership with Red Hat, Duality enables sovereign data analysis, on-premises AI security and secure cloud bursting, running on Red Hat OpenShift with Red Hat Confidential Computing, including confidential containers and attestation.
The deployments are concrete. In partnership with Mastercard, Duality’s FHE-enabled solution was validated in a case study published by Singapore’s IMDA, meeting requirements for cross-border data sharing and financial crime detection across the US, UK, India and Singapore. Duality supplied the PET platform for an international rare cancer research collaboration between NHS England’s National Disease Registration Service and the US National Cancer Institute, with the UK Department for Science, Innovation and Technology, analyzing data across borders without moving it. It has supported multi-hospital clinical trial recruitment in work with Dana-Farber and major pharmaceutical partners, and with Oracle Financial Services it offers privacy-protected AML and counter-terrorist financing investigations. Gartner has named Duality a Cool Vendor.
The cryptography pedigree is unusually deep. Duality was co-founded by Turing Award recipient Prof. Shafi Goldwasser, a co-inventor of probabilistic encryption; MIT’s Prof. Vinod Vaikuntanathan, a co-inventor of widely used FHE schemes; CTO Dr. Kurt Rohloff, co-founder of the PALISADE homomorphic encryption library; CEO Dr. Alon Kaufman, formerly RSA’s global director of data science and innovation; and Chairwoman Rina Shainski. Duality is a major contributor to and driving force behind OpenFHE, the open source FHE library released under the BSD 2-clause license and developed with more than a decade of DARPA support, and several Duality team members, including Kurt Rohloff and Yuriy Polyakov, hold leadership roles in the project. Intel, Samsung and MIT have contributed to OpenFHE, and Google has integrated its open source FHE Transpiler with it.
2. Fortanix: Confidential Computing Manager And Confidential AI
Fortanix says it pioneered confidential computing in 2016, and it remains one of the few vendors that pairs enclave management with a full data security stack. Its Confidential Computing Manager handles trusted execution environment orchestration, composite attestation and secure key release, building on Intel SGX and the company’s Runtime Encryption technology. The open source Enclave Development Platform gives developers a route to building their own enclave applications.
Data Security Manager (DSM) covers the key management side: HSM services, tokenization, secrets management, code signing, file and database encryption, BYOK, Google EKM and AWS External Key Store support. That combination matters because confidential computing only works if keys are released to attested workloads, and Fortanix can manage both halves.
The newer focus is Confidential AI, aimed at AI labs, AI factories and sovereign AI clouds.
NVIDIA highlights Fortanix and Deepgram for private voice AI in regulated on-premises environments, and Fortanix publishes case studies with Deepgram, Goldman Sachs, NEC, BeeKeeperAI and Blackbaud. The company lists SOC, ISO, PCI DSS and FIPS compliance, with offices in Santa Clara, Eindhoven, Bengaluru and Singapore.
3. Anjuna Security: Lift And Shift Into Enclaves Without Rewrites
Anjuna’s core pitch is that existing applications should not need to be rewritten to gain confidential computing protection. Anjuna Seaglass is a platform for running workloads in TEEs across AWS, Microsoft Azure and Google Cloud, including AWS Nitro Enclaves and Azure Confidential Computing, with AMD, Intel and NVIDIA among its hardware partners. AWS itself names Anjuna as a Nitro Enclaves customer building confidential computing software on that foundation.
The product family has grown beyond Seaglass. Anjuna Northstar is an AI data fusion clean room for multi-party data collaboration, and Anjuna Overwatch provides governance and real-time policy enforcement for agentic AI. Public case studies include Parfin for digital asset custody and the U.S. Navy for a secure AI course, which shows the platform’s reach across financial services and defense.
4. Edgeless Systems: Open Source Confidential Kubernetes And Private AI
Edgeless Systems is a German vendor with a strong open source footprint on GitHub. Contrast runs confidential containers on Kubernetes, MarbleRun is a control plane for confidential microservices, and EGo is an SDK for building enclave applications in Go. For teams that want to inspect and self-host their confidential computing stack, Edgeless offers one of the most transparent options available.
Its commercial headline product is Privatemode AI, which lets organizations use generative AI models while prompts and data stay encrypted end to end inside confidential computing environments. Edgeless names Bosch, Capgemini, Intel, NVIDIA, STACKIT, Airbus and T-Systems among the organizations it works with, and it cites Germany’s ePA electronic health record system as a case study, a demanding reference for any vendor in regulated healthcare.
Zurich-based Decentriq applies confidential computing to one of its most commercially successful use cases: the data clean room. Its clean rooms let advertisers, publishers, retailers and agencies run joint analysis on first-party data without exposing raw records to each other or to Decentriq, which the company describes as trustless. The platform uses confidential computing together with homomorphic encryption.
On top of the clean room foundation, the Collaborative Audience Platform handles audience building, segmentation and activation. Named customers and partners include IKEA Austria, Ad Alliance, Publicis Media, Goldbach, PostFinance, Sportradar and willhaben. Decentriq also pitches healthcare, financial services, insurance and defense use cases, but media and advertising remain its strongest proof points.
Microsoft offers the widest set of managed confidential computing solutions of any hyperscaler. Options run from VMs with application enclaves to confidential VMs that need no code changes, GPU-enabled confidential VMs, and confidential containers on Azure Kubernetes Service or Azure Container Instances. Supporting services include Microsoft Azure Attestation for remote verification, Azure Key Vault Managed HSM, Azure confidential ledger and Trusted Launch for generation 2 VMs.
Azure also pushes confidential computing into data services. Azure Databricks and Azure Data Explorer can run on confidential VM clusters, Azure SQL Always Encrypted supports richer confidential queries, and Azure Virtual Desktop can run sensitive Windows 11 workloads on confidential VMs. Microsoft calls itself Customer Zero for the technology and points to Signal as a customer story. If your estate already sits on Azure, this is the lowest-friction place to begin. Organizations planning a rollout often lean on one of the top Microsoft Azure partners and consultants for architecture help.
Google Cloud’s Confidential VMs encrypt data in use with AMD and Intel CPU technologies, and require no application changes. A3 Confidential VMs with NVIDIA H100 GPUs extend that protection to the accelerator, Confidential GKE Nodes bring it to Kubernetes, and Confidential Dataflow and Confidential Dataproc run data pipelines and Spark clusters on confidential infrastructure. Google Cloud Attestation lets customers verify these environments remotely.
The standout service is Confidential Space, a managed TEE for joint data analysis and machine learning that isolates workloads even from the customer’s own operators. Google names Duality, TransUnion, Symphony, Self and others as Confidential Space customers, and publishes case studies with TransUnion, Fireblocks and Zonar. For multi-party analytics on Google Cloud, Confidential Space is the native building block.
AWS takes a distinctive approach with Nitro Enclaves. Rather than relying on a single CPU vendor’s extensions, it uses the Nitro Hypervisor to carve isolated VMs out of an EC2 instance, with no persistent storage, no interactive access and no external networking. Even root users on the parent instance cannot reach inside. The enclave communicates with its parent over a secure local channel and works across instances from different CPU vendors and with any programming language.
Attestation is tightly integrated with AWS KMS, so key material is only released to enclaves running approved code, and ACM for Nitro Enclaves keeps TLS certificates inside the enclave. There is no extra charge beyond the EC2 instance itself. AWS lists 1Password, Brave, Dashlane, Fireblocks, Okta, Itaú Unibanco and Evervault among its customers, alongside Anjuna and Fortanix building on top, and Duality’s platform also works with Nitro Enclaves. For teams comparing cloud platforms more broadly, our guide to cloud hosting and cloud server providers offers useful context.
Confidential AI depends on GPUs, and NVIDIA is the company that made GPU TEEs practical. Its confidential computing support spans Hopper, Blackwell and Rubin GPUs, with hardware-rooted attestation to verify compute assets within a zero-trust design. At rack scale, Vera Rubin NVL72 links 72 Rubin GPUs and 36 Vera CPUs over NVLink into a single protected domain, and NVIDIA says many supported workloads need no code changes.
NVIDIA is less a vendor you buy confidential computing from directly and more the foundation others build on. Google Cloud, Microsoft Azure, Fortanix, Anjuna, Edgeless Systems, Super Protocol and Red Hat all appear among its adopters, along with AI companies and GPU clouds such as CoreWeave, Lambda and Nebius. If your confidential AI strategy involves large models, the GPU generation you deploy determines what protection is even possible.
Intel supplies two of the most widely deployed TEE technologies. Intel Software Guard Extensions (SGX) provides application-level isolation with the smallest trust boundary, and Intel describes it as the most researched confidential computing technology in data centers. Intel Trust Domain Extensions (TDX) provides VM-level isolation, shielding the guest OS and applications from the host, hypervisor and other VMs. The open source Gramine library OS can run unmodified Linux applications on SGX.
Intel Trust Authority adds a zero-trust attestation service that verifies workloads independently of the cloud provider hosting them, which matters for organizations that do not want the same vendor running and vouching for their infrastructure. Intel cites Microsoft, BeeKeeperAI and Fortanix among its confidential computing customer stories, and SGX and TDX underpin many of the cloud services and software vendors on this list.
11. Super Protocol: Verifiable Confidential AI Across Clouds
Super Protocol builds for a world where AI agents, apps and LLMs are hosted by one party but must remain unreadable to that party. Its tagline sums up the goal: provider-hosted, never provider-controlled. Workloads run in TEE-protected memory, encryption keys stay inside secure hardware, and before any data moves the system produces cryptographic proof of the code, configuration and hardware involved that outside parties can check.
Its core product, Super Swarm, connects isolated TEEs into a self-orchestrating environment built on standard Kubernetes and containers, enabling joint inference and fine-tuning across clouds and on-premises infrastructure. Super Protocol supports NVIDIA confidential computing on Blackwell GPUs and lists NVIDIA, Google Cloud, Intel, AMD, Arm, OVHcloud, Gcore and Canonical among its technology backers.
12. enclaive: Sovereign Confidential Cloud Made In Germany
enclaive targets European organizations that want data sovereignty without giving up hyperscaler scale. Its eMCP multi-cloud control plane deploys and attests confidential workloads across European providers, hyperscalers and on-premises infrastructure, covering confidential VMs (Buckypaper), confidential Kubernetes (Dyneemes), workload attestation (Nitride) and a vHSM for key custody. The platform runs on AMD, Intel and Arm processors with TEE support.
Keys are released only after an environment passes attestation, so cloud operators cannot read customer data. enclaive holds ISO/IEC 27001 certification and the TeleTrusT “IT Security made in Germany” seal, and its site features testimonials from Lufthansa Industry Services and others, with Cyberagentur, GovTech Deutschland, NATO DIANA and STACKIT among the organizations shown.
How To Choose A Confidential Computing Company
Do you need protection in use, or collaboration on data?
Start with the outcome. If you only need to stop a cloud provider or insider from seeing a workload, a confidential VM or enclave from your existing cloud may be enough. If several organizations, or several departments inside one, need to analyze or train models on each other’s data, you need a secure data collaboration platform that adds governance, approvals and auditing on top. That is the gap platforms like Duality are built to fill, and where pure infrastructure offerings usually stop.
Which trusted execution environment fits your workloads?
Application enclaves such as Intel SGX offer a minimal trust boundary but may need application changes, while VM-level TEEs such as Intel TDX and AMD-based confidential VMs protect whole operating systems with little or no refactoring. AWS Nitro Enclaves use hypervisor isolation instead of a CPU extension. For AI, check which GPU generation supports confidential mode and whether your provider offers it in your region.
Should you combine several privacy enhancing technologies?
In regulated settings, usually yes. TEEs are fast but rely on trusting the hardware vendor, homomorphic encryption keeps data encrypted during computation without that hardware trust, and federated learning avoids moving data at all. A vendor that supports several PETs lets you match the technique to each workload’s risk and performance budget instead of locking into one approach.
How will you verify what is running?
Attestation turns confidential computing from a marketing claim into something auditors can check. Ask how attestation evidence is produced, who verifies it, and whether keys are released automatically only to approved code. Independent attestation services such as Intel Trust Authority help when you do not want the infrastructure provider to vouch for itself.
Where must the data and the keys live?
Residency and sovereignty rules increasingly decide which confidential computing solutions are viable. Confirm whether the platform runs on-premises, in sovereign environments such as those built on Red Hat OpenShift or European providers, and across multiple hyperscalers. Just as important is who holds the keys: a customer-controlled HSM or key manager is often a regulatory requirement.
Is the vendor ready for confidential AI at scale?
Check whether the vendor can protect model weights as well as data, supports GPU TEEs, works with frameworks such as NVIDIA FLARE for federated learning, and can run inference on sensitive prompts without exposing them. Proof points from healthcare, financial services or government show a platform has passed demanding security reviews.
Conclusion
Confidential computing has moved from a niche hardware feature to a foundation for regulated AI and cross-organization analytics. The hyperscalers and silicon providers on this list make protected execution widely available, and specialists such as Fortanix, Anjuna, Edgeless Systems, Decentriq, Super Protocol and enclaive make it easier to adopt for specific workloads.
For organizations whose real goal is to unlock value from data they cannot move, share or expose, Duality Technologies stands out. By combining trusted execution environments with fully homomorphic encryption, federated learning and policy-based governance, and by deploying across AWS, Azure, Google Cloud and sovereign Red Hat environments, Duality turns confidential computing into secure data collaboration that delivers results. Choose based on the outcome you need, verify what the vendor publicly proves, and build on a platform that will still fit as your confidential AI ambitions grow.
