Four tiers of protection.

The smallest trusted-computing-base option. Only the code selected for secret handling runs inside the enclave, placing the host operating system, hypervisor, and administrator outside the workload's confidentiality boundary.

SGX has traditionally been hard to work with: the enclave boundary is expensive to cross and unfriendly to ordinary code. Canopy makes it practical. Coroutines let calls suspend across the enclave boundary without blocking a thread, and integration with kernel-side io_uring keeps I/O moving efficiently between the enclave and the outside world.

The whole guest operating system runs inside a confidential VM. This is far easier to adopt — existing applications run largely unchanged — but the trade-off is a larger attack surface: the entire OS is now inside the trust boundary, and you have to trust your system administrator not to compromise it.

It is the right middle ground when an application is too large or too entangled to refactor into a minimal enclave, but still needs hardware-attested confidentiality against the cloud provider and the wider infrastructure.

Confidential VMs are also a natural host for accelerated AI workloads. End-to-end confidential GPU processing additionally requires GPU attestation, protected device links, and policy that binds the GPU evidence to the VM; it is not implied by TDX or SEV-SNP alone.

A deployment profile for a conventional distributed system hardened at its edge. Services run as normal, while a hardware-attested gateway performs Layer 7 policy enforcement and anonymisation and presents evidence of the enforcement workload to each relying side.

It does not isolate the workload itself, but it controls and sanitises what crosses the boundary, and proves it is the genuine, unmodified firewall doing so. The pragmatic choice when the compute cannot move into an enclave but the traffic between systems still needs governing.

No hardware enclave at all — the established defences a well-run system already uses: TLS on the wire, authentication and authorisation, key management and secret hygiene. There is no attestation, so trust rests entirely on your operational discipline and the integrity of your hosts.

For workloads that handle high-value keys, this tier pairs naturally with a hardware security module (HSM): cryptographic keys are generated and used inside dedicated hardware and never leave it in the clear, raising assurance without moving the whole workload into an enclave. The right baseline when a deployment cannot use confidential-computing hardware, or simply does not need it yet.