Skip to main content

What is a Secure Enclave?

A secure enclave is an environment that provides for isolation of code and data from OS using hardware-based CPU-level isolation. Secure enclaves offer a process called attestation to verify that the CPU and apps running are genuine and unaltered. Secure enclaves are one implementation of the concept of Confidential Computing.

Confidential Computing

Confidential Computing is the protection of data in use by performing computation in a hardware-based Trusted Execution Environment (TEE) within a Secure Enclave. The terms TEE and Secure Enclaves are sometimes used interchangeably.

Confidential Computing is a cloud computing technology that isolates sensitive data in a protected enclave during processing.

What are the components of the Cape Trusted Execution Environment?

Enclave Runtime

The Cape runtime is a secure conduit within the enclave that is the only means of data transmission between the enclave and the host the enclave runs on. It prompts the Cape user's function to run, and also runs the code that encrypts the user’s function as it passes into, and out of the enclave. Only runtime has access to your function and data. Cape, AWS, and any other third parties cannot access the information that’s been passed through to runtime.

Think of runtime as a guardian that lives inside the secure enclave. It acts as the bodyguard for your function, helping your function run within the enclave, but also providing your function with encryption in the form of a private key that resides only within the enclave. Using Cape’s CLI or Javascript or Python SDKs, you encrypt your function and data that will pass through runtime with the enclave's public key. Using runtime, you can confirm that you’re accessing the correct enclave using attestation.

It also encrypts your function and data both entering and exiting the enclave. Once your function leaves the enclave, runtime prepares your function for storage by encrypting it with AWS KMS before loading it into Cape’s infrastructure. Only the enclave can access the KMS key that’s been used to encrypt your now-stored function.

Nitro Enclaves

Cape uses AWS Nitro Enclaves’ isolated compute environment as a foundation for our Trusted Execution Environment.

For more information, see


In addition to the secure enclave encryption, Cape uses Hybrid Public Key Encryption (HPKE) to add an extra layer of security to your data as it passes into the enclave.

For more information, see


Before your function leaves the enclave, Cape encrypts your function with Amazon Web Services Key Management System (AWS KMS) before uploading your encrypted function to the Cape infrastructure.

For more information, see

Cape CLI

The Cape Command Line Interface makes it easy to interact with a secure enclave. Using the CLI, you can deploy, store, and run your functions using simple commands while being secure in the knowledge that your data is safe. Please note that Cape offers additional SDK options as well.

Why use Cape Privacy?

  • Easy-to-Use: Cape doesn’t require expertise in security or infrastructure.

  • Secure: Cape uses the strongest data encryption and secure processing within a Trusted Execution Environment.

  • Scalable: Cape auto-scales and is exposed through a simple CLI and SDKs.

  • Built for developers: If you can code, you can use Cape to build secure applications so that data and privacy breaches never happen.


We are actively soliciting feedback from our beta. Please use this form to provide feedback.