Confidential computing.
Run workloads in hardware-isolated enclaves — data encrypted in use and attestable — so even the operator can't see it.
Hardware-isolated enclaves keep data encrypted in use, not just at rest and in transit, with remote attestation to prove what's running. The boundary for the most sensitive data, multi-party computation and sealed model serving.
- Category
- Identity & security
- Deployment
- Managed → air-gapped
- Governance
- IAM · encryption · audit
Encryption at rest and in transit leaves one gap: in use.
Data is encrypted on disk and on the wire as a matter of course. The exposure that remains is the moment it's actually being processed — decrypted in memory, visible in principle to the host, the hypervisor and the operator. For the most sensitive workloads, and for anyone who has to prove an operator can't see the data, that gap is the whole problem. Confidential computing closes it: the workload runs in a hardware-isolated enclave where memory stays encrypted while it executes.
Remote attestation: prove what's running before you send it anything.
An enclave is only useful if you can verify it. Aether's enclaves support remote attestation — a cryptographic proof of the exact code and environment running inside, which a client checks before releasing data or keys to it. You're not trusting a claim that the environment is secure; you're verifying it, every time, so a tampered or substituted workload simply never receives the data.
Sealed model serving — even the operator can't extract the weights.
The most distinctive use here is serving a model so that neither the host nor the tenant can extract it. The weights and the data meet only inside the attested enclave; the operator running the infrastructure can't read either. That makes multi-party computation real — two parties compute on combined data without exposing it to each other — and lets you run the most sensitive inference and the most regulated data on infrastructure you don't have to fully trust, because the hardware enforces what policy alone can't.
Run inference in an attested enclave: the client verifies the environment, then releases data the operator can never see.
import { aether } from "@aether/sdk";
const enclave = await aether.confidential.enclave("aether-40b");
const proof = await enclave.attest(); // cryptographic env proof
if (!verify(proof, expectedMeasurement)) throw "untrusted enclave";
// Data is released only to the verified enclave; sealed in use.
const out = await enclave.run({ input: patientRecord });The data is released only after the enclave proves what it is, and it's encrypted in memory while the model runs — so the host, the hypervisor and the operator can't read it. On a normal endpoint, "the provider can't see your data" is a promise; here it's a hardware-enforced, attested fact.
Three steps to running.
Run a workload in a CPU or GPU trusted execution environment.
Prove the code and environment cryptographically before any data is sent.
Memory stays encrypted in use — even the operator can't read it.
Confidential computing, in full.
CPU/GPU trusted execution environments isolate the workload.
Memory stays encrypted while the workload runs.
Cryptographically prove the code and environment before sending data.
Serve a model so neither operator nor tenant can extract it.
Provision it in a few lines.
Every service is reachable from the same SDK, CLI and infrastructure-as-code — one identity, one bill, one audit trail across the whole catalog.
# Provision confidential computing on Aether Cloud
aether identity-security create \
--service confidential-computing \
--name app \
--region us-1 \
--deploy managed # or vpc | on-prem | air-gappedAt a glance.
- Isolation
- CPU / GPU TEE
- Encryption
- In use, not just at rest
- Attestation
- Remote, cryptographic
- Model serving
- Sealed — non-extractable
- Use
- MPC · sensitive data
Built for real work.
Sensitive data processing
Multi-party computation
Protected model inference
On one model, not stitched together.
The usual stack runs confidential computing in one product, the model in another and the data in a third — and the seams between them are the cost. Aether Cloud runs it on the same platform that serves the model, governs your identity and deploys into your boundary, with the rest of the catalog one hop away.
No stitching a vector DB to one place, a warehouse to another and a model to a third — confidential computing sits next to the rest of the catalog, one identity, one bill.
The provider that runs Aether runs your confidential computing — so the data and the model never leave the same governed boundary to talk to each other.
Need a capability that isn’t here yet? The model writes and deploys it into the same boundary — the catalog is a starting point, not a ceiling.
Good to know.
Hardware-isolated enclaves with in-use encryption and attestation — plus sealed serving of the Aether model, so neither operator nor tenant can extract it.
Data while it is being processed — closing the gap that at-rest and in-transit encryption leave open.
Yes — sealed model serving keeps the weights and the data private even from the host.
Your boundary, your choice.
Pairs well with.
Fine-grained identity and access management with SSO, SCIM and short-lived credentials.
Centralized secrets with rotation, scoped access and full audit of every read.
Managed and customer-managed keys, HSM-backed, for encryption across every service.
Encryption in transit and at rest by default, with bring-your-own-key and envelope encryption.
Continuous posture management, findings and recommendations across your cloud footprint.
SOC 2 / ISO 27001 controls, evidence assembly and an immutable audit trail with provenance.
Run Confidential computing on Aether Cloud.
Run workloads in hardware-isolated enclaves — data encrypted in use and attestable — so even the operator can't see it. Deployable managed, in your VPC, on-prem or fully air-gapped — talk to us about the configuration your workloads and your boundary require.