Cloud security traditionally focuses on protecting data at rest and in transit. However, a critical gap remains safeguarding data while it's being processed. This article explores how confidential computing addresses this vulnerability, combined with the Open Sovereign Cloud from T-Systems, to deliver enhanced data protection, regulatory compliance, and complete control over your workloads.
Cloud adoption has matured to the point where security at rest and in transit is a given. Enterprises encrypt their databases, secure their networks, and rely on hardened infrastructure. Yet a gap remains: the moment data is processed in memory, it becomes vulnerable. For regulated industries such as healthcare, finance, and public administration, that moment is precisely when data is most sensitive.
This is where confidential computing comes in. By securing data “in use”, it closes the last critical gap in cloud protection. Combined with the Open Sovereign Cloud (OSC) by T-Systems, it delivers the highest level of digital sovereignty: data, operations, and technology governed entirely by European standards.
Confidential computing is a hardware-based security technology that protects data while it is actively being processed in memory. Its backbone is the trusted execution environment (TEE), a secure enclave within a processor that encrypts and isolates code and data. This isolation is enforced by the hardware itself, making it significantly more secure than relying solely on software-based protections.
Unlike encryption-at-rest (which protects stored data) or encryption-in-transit (which secures traffic between systems), confidential computing safeguards the very act of computation. Data remains encrypted and inaccessible, even to cloud operators or system administrators with elevated privileges.
Think of confidential computing as creating a secure, isolated room within your processor where sensitive data can be processed without being exposed to other software, the operating system, or even the cloud provider's infrastructure.
In today's regulatory landscape, particularly within Europe, organizations face increasing pressure to protect sensitive data throughout its entire lifecycle.
The OSC was built on a principle: sovereignty in data, operations, and technology. Enterprises in Europe cannot simply outsource their most sensitive workloads to global hyperscalers without considering European Union (EU) regulations such as General Data Protection Regulation (GDPR), Network and Information Security 2 (NIS2), or sector-specific mandates such as German Federal Financial Supervisory Authority (BaFin) or Society for Telematics Applications of the Health Card (Gematik).
The challenge is trust.
Customers need absolute assurance that their cloud provider, or anyone with infrastructure-level access, cannot peek into sensitive datasets. Confidential computing bridges that trust gap.
By placing data in TEEs, enterprises retain full control. Sovereignty is no longer just about where the data is stored, but also about who can process it and under what conditions. In this model, even the sovereign cloud operator cannot access customer workloads.
Confidential computing is powerful, but it does not absolve enterprises of their broader security obligations.
A sovereign cloud strategy must still include:
Confidential computing enhances these measures, but does not replace them. Think of it as an extra layer that secures the most vulnerable point in the data lifecycle.
Confidential computing is not a standalone feature, it is becoming a part of the broader sovereign cloud strategy. Standards and certifications from organizations such as the Confidential Computing Consortium, BSI, and ISO will help enterprises trust, audit, and port workloads across environments.
In the future, confidential computing will converge with AI/ML workloads, data spaces, and cross-border federated services, providing verifiable assurance that sovereignty and innovation can coexist.
Confidential computing closes the last critical gap in cloud protection, securing data in use. Within the OSC, it ensures provider exclusion, regulatory compliance, and digital independence for Europe’s most sensitive workloads. But it is not a silver bullet. Applications must still manage identities, keys, and data lifecycles responsibly. End-to-end security comes only from combining sovereign cloud infrastructure, confidential computing, and robust enterprise security practices.
At T-Systems, sovereignty is in our DNA. With managed services, geo-redundant German data centers, and confidential computing capabilities, we help customers in healthcare, finance, and the public sector innovate securely. As BARMER’s case demonstrates, the OSC is not a theoretical concept, it is already protecting millions of citizens today.
The message is clear: confidential computing transforms sovereignty from a legal promise into a technical guarantee. It gives enterprises control over their data, wherever and however it is processed.
