Confidential computing in data center: what changes when your data is encrypted in use

Encryption at rest and in transit has been standard in professional data centers for more than a decade. What changed from 2022 to 2026 is encryption in use: data encrypted inside a hardware enclave in the CPU, without the OS, hypervisor, or data center operator being able to read it.

This article breaks down what changes when implementing confidential computing, which attacks become impossible, which certifications apply (CCC, NIST SP 800-193, LFPDPPP in Mexico), and when a deployment in Latam is worth it.

What is confidential computing (in 60 seconds)

Confidential computing is a security model where computation occurs inside a TEE (Trusted Execution Environment) in the processor, not in memory accessible to the OS. The dominant current TEEs: AMD SEV-SNP (Secure Encrypted Virtualization, present in EPYC 3rd generation onwards) and Intel TDX (Trust Domain Extensions, present in Xeon Scalable 4th generation onwards). Both create an encrypted enclave inside the CPU, where code runs with the guarantee that neither the hypervisor, the server administrator, nor the data center operator can read the enclave memory.

Operational difference with traditional encryption: at rest protects data on disk; in transit protects data on the network. In use protects data while the CPU performs computations on it. That difference is what makes confidential computing confidential.

Which attacks become impossible and which remain possible

With confidential computing correctly implemented, the following become unviable: secret extraction via physical RAM dump; inspection of CPU state by admin access to the hypervisor; installation of implants in the guest OS; theft of API keys in use; attacks via compromised OS firmware (BootGuard, Intel TXT, AMD Secure Boot).

Remain possible: physical hardware compromise (fault injection or side-channel attack on the CPU); CPU firmware compromise (requires collaboration with the manufacturer, very rare); social engineering on the operator; microarchitectural side-channel attacks such as Spectre and Meltdown (partially mitigated, not eradicated); manufacturer supply chain compromise. Confidential computing closes software and administration attacks, not physical hardware attacks.

Operational changes for a data center in Mexico

A confidential computing deployment implies four operational changes that are almost undocumented:

1. The client hypervisor must be compatible with SEV-SNP or TDX. KVM, VMware vSphere 8 (correct license), Microsoft Hyper-V 2022 with Windows Server 2022 Datacenter, and OpenShift with specific operators support confidential VMs. The server BIOS must explicitly enable SEV-SNP or TDX; new Dell PowerEdge, HPE ProLiant and Supermicro ship with this enabled by default.
2. The CPUs must be of the correct generation. For AMD SEV-SNP you need EPYC 7003 (Milan) or later; 7002 (Rome) only supports SEV without SNP. For Intel TDX you need Xeon Scalable 4th generation (Sapphire Rapids) or later. Upgrade cost if your fleet is older: between 1.5x and 2.5x the cost of a new server. In Mexico, main operators (KIO, Triara, Ascenty, ODATA, Axtel) already have compatible servers in Tier III and Tier IV.
3. Attestation and cryptographic sealing infrastructure. Each TEE generates an attestation report signed by the manufacturer (AMD or Intel) that proves the enclave was created with a specific firmware and microcode version. Those reports must be verified by the client application before loading secrets into the enclave. Most used library: Constellation (OpenSSL-compatible, AMD). Implementing and maintaining this pipeline is 4 to 8 weeks of engineering work for an experienced team.
4. The Confidential Computing Consortium (CCC) certification is optional but differentiating. CCC publishes technical specification and an attestation review program that demonstrates a cloud operator meets specific requirements. For operators in Mexico, certifying with CCC for European or US enterprise clients is real commercial leverage, although it takes between 6 and 12 months and costs between USD 50,000 and 180,000.

When confidential computing IS worth deploying

Four cases where the ROI is justified:

1. Loads where the client requires that the operator cannot access data in use (financial, HIPAA health data, industrial secrets). CCC certification or independent attestation covers the requirement.
2. Regulation applicable to data in use (LFPDPPP in Mexico for sensitive personal data, GDPR in Europe, HIPAA in the US; authority in Mexico: INAI). Encryption at rest does not meet the standard; encryption in use does.
3. Multi-tenancy in hyperscale where multiple clients share a physical server: confidential computing guarantees real isolation between them.
4. Federated AI training where multiple clients contribute gradients without revealing their own datasets: confidential computing enables computation over encrypted data.

When confidential computing is NOT worth it yet

Three cases where to wait:

1. Legacy loads without re-architecture. Confidential computing requires attestation and secret management that few legacy loads have. Migrating a traditional monolith to confidential VMs takes between 2 and 6 months of rework.
2. GPU workloads where TEEs still mature. NVIDIA H100 and A100 support confidential computing partially (attestation report), but with performance overhead between 5% and 15% and limited compatibility with ML frameworks. For large model training it is useful but does not solve the complete case; wait for Blackwell and subsequent generations.
3. Data centers where the operator is trusted by the client. If your SLA and contract confirm that only authorized personnel access the hypervisor with robust controls, confidential computing adds a layer but is not mandatory. Evaluate cost of change against residual risk; in Latam many enterprise clients are comfortable with their operators.

The Mexican regulatory data point

LFPDPPP and its regulation cover sensitive personal data: health, biometric, financial, patrimonial, minors. INAI is the regulatory authority. For data at rest the standard is disk encryption; in transit, network encryption. For data in use LFPDPPP does not explicitly require confidential computing but does require appropriate measures according to the state of the art. The international standard (cited in INAI resolutions) recognizes encryption in use with TEE as a reasonable measure for multi-tenancy. Summary: not mandatory by law in Mexico today, but it is the strongest technical answer for clients requiring reasonable protection of data in use.

Sources

1. Confidential Computing Consortium (CCC): technical specification and membership for operators — https://confidentialcomputing.io/
2. NIST SP 800-193: Platform Resiliency Guidelines (reference for attestation and firmware) — https://csrc.nist.gov/publications/detail/sp/800-193/final
3. Linux Foundation: documentation of confidential computing projects — https://www.linuxfoundation.org/
4. AMD SEV-SNP: official developer documentation (attestation and APIs) — https://www.amd.com/en/developer/sev.html
5. Microsoft Azure Confidential Computing: public deployment model documentation — https://learn.microsoft.com/en-us/azure/confidential-computing/overview