Use cases

    Software
    that can't leak.

    Enclava takes any container. Below are the workloads our users bring on day one — but the platform isn't opinionated about what runs on it. If it's a Linux container, it can run confidentially.

    Warm market · Featured

    Agents & key-holding workers

    Run agents, bots and background workers that hold long-lived API keys, signing keys or user data, without any of it being readable by the host. Your agent stays an ordinary CPU container, with cryptographic guarantees underneath.

    Good fit when you have
    • 01Agents that hold long-lived API keys
    • 02Bots and workers with signing keys
    • 03Wallet and payment backends
    • 04Tool servers that touch private data
    02

    Regulated SaaS

    Health, finance, legal, gov. Customers want cryptographic proof that even your engineers can't see their data. The alternative is rebuilding your stack on-prem for every deal — which kills your margins and your roadmap.

    Good fit when you have
    • 01HIPAA, GDPR, SOC2 + cryptographic trust boundary
    • 02Multi-tenant SaaS with per-tenant attestation
    • 03Audit trails that prove what code processed the data
    • 04Customers with data-residency hard requirements
    03

    Encrypted databases & stateful workloads

    Postgres, Redis, Mongo, Kafka — anything that holds state. Persistent volumes are encrypted with keys only the TEE can derive. Ops doesn't need root in your data; rogue insiders can't snapshot it; backups are sealed.

    Good fit when you have
    • 01Production databases with PII / PHI / PCI
    • 02Long-running workers and queues
    • 03Caches that hold session tokens
    • 04Self-hosted vector DBs over private corpora
    04

    Internal tools that handle PII

    Admin dashboards, support consoles, BI tools. Run them where the people who need them can use them — but where no one (including the cloud operator, including a compromised employee laptop) can quietly export the database.

    Good fit when you have
    • 01Customer support consoles
    • 02BI dashboards on raw user data
    • 03Internal admin tools
    • 04Data labeling / annotation platforms
    05

    Secret-bearing workers

    Workers that hold long-lived secrets: signing keys, payment processor credentials, webhook HMACs, third-party API tokens. The secrets live inside the TEE and are unsealed only at runtime; even the platform operator can't read them at rest.

    Good fit when you have
    • 01Code-signing pipelines
    • 02Payment-processing workers
    • 03Webhook senders/receivers
    • 04Third-party integration glue
    06

    Multi-party computation

    Two (or more) companies want joint analytics on each other's data without either side handing over the raw rows. Deploy the joint workload here; everyone verifies the same attestation; nobody can read the inputs — including us.

    Good fit when you have
    • 01Data clean rooms
    • 02Joint fraud / risk modeling
    • 03Federated analytics across orgs
    • 04Verifiable benchmarking between competitors
    07

    Self-hosting, but actually private

    Run open-source apps where the cloud operator can't see what you do. "Self-hosted" finally means it — without you having to operate Kubernetes, hardware, attestation, and key management yourself.

    Good fit when you have
    • 01Mattermost, Vaultwarden, Plausible, n8n
    • 02Personal note-taking and journaling
    • 03Private code forges and CI runners
    • 04Confidential community infrastructure

    Don't see your workload?
    It probably still fits.

    The platform takes any Linux container. If you can describe what you want to run, we can show you how it runs confidentially.