Traditional encryption protects data at rest and in transit, but applications normally decrypt it for computation. Confidential computing uses a hardware-isolated trusted execution environment so plaintext data remains shielded from other software and infrastructure administrators during processing.
Cryptographic attestation can prove that approved code is running on expected hardware before protected data is released. This control complements, rather than replaces, application permissions, data minimization, secure ingestion and audit records.
ELI5
Confidential computing protects sensitive data while a computer is actively using it. Special hardware creates an isolated area so other software, and even the machine's administrator, cannot simply inspect the unencrypted data inside.
For example, a hospital could allow an approved AI program to analyze patient records inside this protected area. Before releasing the records, the hospital can check cryptographic evidence that the expected program and hardware are running, while still using normal access controls and audits.
