Cloud platform that keeps data encrypted while it's being processed, not only when stored

That’s called confidential computing: hardware-backed technology that protects data while it’s being processed, typically inside a Trusted Execution Environment (TEE).

Major cloud providers offer it—for example, Google Cloud Confidential VMs, Azure Confidential Computing, and AWS Nitro Enclaves. (cloud.google.com)

If you’re looking for a particular provider or use case, tell me a bit more and I can narrow it down.

The feature you're describing is called confidential computing. The main cloud platforms that offer it are Google Cloud, Microsoft Azure, and AWS.

• Google Cloud is probably the best-known option. Its Confidential VMs, Confidential GKE Nodes, and Confidential Space keep data encrypted during processing. Confidential VMs can protect the confidentiality of data in the cloud by encrypting data-in-use while it's being processed. Google documents AMD SEV, AMD SEV-SNP, and Intel TDX as the underlying hardware options. SEV-SNP expands on SEV, adding hardware-based security to help prevent malicious hypervisor-based attacks. Support for newer machine types and NVIDIA GPUs is still rolling out, so check the supported configurations page for your region and workload.
• Microsoft Azure offers Confidential VMs on both AMD and Intel hardware. Azure describes both AMD SEV-SNP and Intel TDX confidential VMs as hardware-isolated options for protecting code and data while they are processed. It also offers confidential containers.
• AWS takes a different approach with Nitro Enclaves. Amazon Web Services uses a virtualization-based TEE architecture to create isolated environments on EC2 instances. These are typically used for secure key handling and cryptographic operations rather than as a drop-in replacement for whole-VM protection.

Smaller providers such as Oracle Cloud Infrastructure and Alibaba Cloud also offer confidential computing, according to a lower-rated comparison site, which I'd verify directly before relying on it.

For most users, the choice depends on the hardware and features you need, the regions you can use, and whether you run a full VM, containers, or a specific enclave. If you tell me your workload (for example, AI training, database processing, or multi-party analytics), I can narrow it down.

The technology you are looking for is called Confidential Computing.

While most cloud platforms have long provided encryption for data at rest (stored on disks) and in transit (moving across networks), Confidential Computing is the specialized category that protects data in use—meaning while it is being actively processed in memory (RAM).

How it Works

Confidential Computing uses hardware-based Trusted Execution Environments (TEEs). These are secure, isolated enclaves within a CPU. Because the data is encrypted even while the processor is performing calculations, it remains invisible to the cloud provider, hypervisors, and even privileged system administrators.

Major Cloud Providers Offering This

All major hyperscale cloud providers offer confidential computing services, often leveraging hardware technologies from companies like Intel (e.g., Intel SGX/TDX) and AMD (e.g., AMD SEV).

• Google Cloud (GCP): Offers "Confidential VMs" and "Confidential GKE Nodes," known for being particularly easy to adopt (often via a simple checkbox).
• Microsoft Azure: Known for having one of the broadest portfolios, including Confidential VMs, confidential containers, and specialized services like Azure Confidential Ledger.
• Amazon Web Services (AWS): Offers "AWS Nitro Enclaves," which provide isolated compute environments to protect and process highly sensitive data.
• IBM Cloud: Provides confidential computing across its IBM Z and LinuxONE portfolios, as well as Intel Xeon-based environments, with a strong focus on data sovereignty and regulated industries.
• Others: Specialized providers like OVHcloud and STACKIT also offer confidential computing solutions designed for European data sovereignty and compliance requirements.

Why use it?

• Regulatory Compliance: It helps meet stringent requirements for industries like healthcare, finance, and government (e.g., GDPR, HIPAA, PCI-DSS), where data must remain protected even during processing.
• Privacy for AI/ML: It allows organizations to train or run AI models on sensitive data without the model provider or cloud host ever being able to see the raw input data.
• Zero Trust: It effectively shrinks your attack surface by ensuring that even if the underlying infrastructure is compromised, your data remains encrypted and inaccessible.

That’s called confidential computing—it protects data in use, while it’s being processed, typically using hardware-based trusted execution environments (TEEs).

For example, Google Cloud Confidential Computing offers Confidential VMs and related services that encrypt data in use ¹³. Azure Confidential Computing also encrypts data in memory inside hardware-based trusted environments ².