When should you reach for Confidential Computing (a TEE) — what are its main use cases?

When you must process highly sensitive data on infrastructure you don't fully trust, and need the data protected even while it's in use (decrypted in memory).

Most encryption protects data at rest (on disk) and in transit (over the network) — but leaves it exposed in use, decrypted in RAM where the OS, hypervisor, or a cloud admin could read it. A Trusted Execution Environment (TEE) closes that third gap with a hardware-isolated enclave. Reach for it when:

1. You run on untrusted infrastructure — analysing sensitive data on a public cloud or a third party's servers, where you don't trust the host OS/hypervisor or the operator.
2. The data is highly sensitive during analysis — medical records, keys, financial data that must stay protected the entire time it's being computed on, not just when stored.
3. The analysis code itself isn't fully trusted — the enclave constrains what the running program can leak or exfiltrate, and remote attestation lets the data owner verify exactly what code is running before sending data in.

Tip: TEE is the answer to "I need to compute on secret data, but I don't trust the machine doing the computing." It protects data in use, the gap that at-rest/in-transit encryption leaves open.