A European subsidiary will process customer records in a global provider's Frankfurt region, and legal asks for supplementary measures on top of the transfer mechanism. The platform team proposes confidential computing: workloads in hardware-encrypted memory with remote attestation. What does that buy against a foreign lawful-access request, and what is still open?

What it buys

Memory is encrypted by the CPU and the hypervisor cannot read the workload's plaintext while it runs. Remote attestation lets a key-release service refuse to hand over keys unless the measurement of the booted image matches one you expect. That closes a path nothing else closes: a provider administrator reading plaintext out of a running machine. Encryption at rest and in transit never addressed it, because the data is decrypted precisely where the operator has access.

What it costs

A narrower menu of instance types and regions, and a compute overhead that vendors generally report in the single-digit percentages for ordinary workloads and higher for memory-bandwidth bound ones, which means you benchmark rather than assume. The attestation and key-release service becomes a hard runtime dependency: if it is unavailable, workloads cannot start, so it needs its own availability target and a documented failure stance. Debugging gets worse, because memory dumps and attaching a profiler are the things the enclave is designed to prevent. And key-release policy becomes code that somebody has to review like code.

What is still open

• Key custody. If the key-release service and the root keys sit in the provider's key management service, a compulsory order against the provider still reaches plaintext. The decisive question is not where the enclave runs; it is who holds the key-release decision and under which jurisdiction's law they sit.
• The control plane. Whoever can deploy a new attested workload with a policy that releases keys to it has the data. Pin attestation policies to measurements of images you build and sign, and alert on any change to the accepted measurement set. Otherwise the enclave protects you from the administrator but not from a deployment.
• Everything outside the enclave. Managed database storage, logs, traces, backups, the support path and the operator tooling. Confidential computing typically covers the compute step, which is the smallest part of the surface, while the transfer analysis is about all of it.

The decision rule

Choose confidential computing when the threat you care about is the operator and the workload is compute-shaped and self-contained. Choose externally held keys plus a deliberately bounded data set when the threat is legal compulsion, because that changes who can be ordered to act rather than making the order technically harder. Choose a single-region deployment with contractual controls, in-region support staffing and no foreign administrative access when the data set is small enough that the simple answer is available, which it usually is.

When this is the wrong answer

For most products, cutting what crosses the boundary removes more risk in a week than any cryptographic measure does in a quarter. Send derived features instead of records, keep free text and identifiers on the in-region side, aggregate before export. A platform team that reaches for enclaves before it has drawn the data flow is protecting a smaller surface at a higher cost, and the transfer finding will come back for the logs, the backups and the support rota, which the enclave never touched.