> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm.md).

# Confidential VM

Run hardware-encrypted Virtual Machines on IONOS CLOUD using AMD SEV-SNP. Protect data in use from hypervisors, cloud operators, and administrators, with cryptographic proof.

<code class="expression">space.vars.ionos\_cloud</code> Confidential VM encrypts your VM's memory at the CPU level. Even with full administrative access to the physical host, the hypervisor sees only ciphertext.

It protects **data in use**, the third state of data that standard encryption does not cover. Encryption at rest protects stored data, and encryption in transit protects data moving over a network. Confidential VM closes the remaining gap by protecting data while it's being processed in memory.

Built for regulated industries, including financial services, healthcare, and legal that require cryptographic guarantees over contractual ones, this zero-trust architecture provides:

* **Hardware-Level Isolation:** Workloads run in a runs in a hardware-enforced [<mark style="color:blue;">Trusted Execution Environment (TEE)</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#trusted-execution-environment-tee) using [<mark style="color:blue;">AMD Secure Encrypted Virtualization with Secure Nested Paging (AMD SEV-SNP)</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#amd-secure-encrypted-virtualization-with-secure-nested-paging-amd-sev-snp) technology ensuring the hypervisor sees only ciphertext. For more information, see [<mark style="color:blue;">Use Cases</mark>](/cloud/compute-services/compute-engine/confidential-computing-vm/use-cases.md).
* **Exclusive Control:** <code class="expression">space.vars.ionos\_cloud</code> provides the physical host, hypervisor, and network. You retain complete control over your operating system, applications, encryption keys, and attestation policies.
* **Immediate Availability:** Directly available to all users in the **Germany / Frankfurt am Main (de/fra/2)** data center. To deploy, ensure you have an active <code class="expression">space.vars.ionos\_cloud</code> account in this location.

{% hint style="warning" %}
**Important:** Confidential VMs are designed to isolate your data from the underlying infrastructure. <code class="expression">space.vars.ionos\_cloud</code> supports the platform, but has no visibility into your guest operating system (OS), applications, encryption keys, or the contents of any custom image you upload. As a result, our support cannot extend to in-guest issues, including image content, OS configuration, or application-level problems. In alignment with the Confidential VM [<mark style="color:blue;">shared-responsibility model</mark>](/cloud/compute-services/compute-engine/confidential-computing-vm/overview/security-and-trust-model.md#shared-responsibility-model), managing and securing these internal components remains your responsibility.
{% endhint %}

## Why IONOS CLOUD Confidential VM

Confidential VM replaces that trust requirement with a cryptographic proof. Using remote attestation, you can verify the TEE's exact state, including the firmware, configuration, and startup measurements, before exposing sensitive data to it. No policy document or audit report is required.

<code class="expression">space.vars.ionos\_cloud</code> provides the infrastructure layer that enables this security:

* **AMD EPYC processors with SEV-SNP:** Runs on AMD EPYC processors with SEV-SNP (a hardware security feature built for confidential workloads), providing memory isolation between VMs and the hypervisor layer.
* **Secure launch infrastructure:** Reads the launch artifacts directly from your image and starts the Confidential VM under hardware-enforced isolation, preventing patching, injection, or inspection during launch.
* **Validated image upload:** Images are verified at upload time to confirm the `LAUNCH_ARTIFACTS` partition is correctly formed before the asset is registered.

## Product Overview

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><mark style="color:blue;"><strong>Overview</strong></mark></td><td>Understand the architecture, trust model, and end-to-end workflow for Confidential VM.</td><td><a href="/cloud/compute-services/compute-engine/confidential-computing-vm/overview.md">Overview</a></td></tr></tbody></table>

## Quick Links

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><mark style="color:blue;"><strong>Use Cases</strong></mark></td><td>Real-world scenarios for financial services, healthcare, legal, data marketplaces, and sovereign SaaS.</td><td><a href="/cloud/compute-services/compute-engine/confidential-computing-vm/use-cases.md">Use Cases</a></td></tr><tr><td><mark style="color:blue;"><strong>How-Tos</strong></mark></td><td>Create and manage Confidential VMs using the Data Center Designer.</td><td><a href="/cloud/compute-services/compute-engine/confidential-computing-vm/how-tos.md">How-Tos</a></td></tr><tr><td><mark style="color:blue;"><strong>API How-Tos</strong></mark></td><td>Step-by-step guides for creating and managing Confidential VMs, images, volumes, and attestation services using the <code class="expression">space.vars.ionos_cloud</code> API.</td><td><a href="/cloud/compute-services/compute-engine/confidential-computing-vm/api-how-tos.md">API How-Tos</a></td></tr><tr><td><mark style="color:blue;"><strong>Tutorials</strong></mark></td><td>Deploy an attested Confidential VM on <code class="expression">space.vars.ionos_cloud</code> using the SNPGuard open-source toolchain.</td><td><a href="https://docs.ionos.com/cloud/tutorials/compute-services/confidential-computing-vm/deploy-confidential-vm-with-snpguard">https://docs.ionos.com/cloud/tutorials/compute-services/confidential-computing-vm/deploy-confidential-vm-with-snpguard</a></td></tr></tbody></table>

## Developer Tools

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><mark style="color:blue;"><strong>IONOS CLOUD API</strong></mark></td><td>Access the CLOUD API documentation for Confidential VM.</td><td><a href="https://docs.ionos.com/cloud/api-reference/cloud-api-v6/">https://docs.ionos.com/cloud/api-reference/cloud-api-v6/</a></td></tr><tr><td><mark style="color:blue;"><strong>SDKs</strong></mark></td><td>Interact with the Confidential VMs using SDKs.</td><td><a href="https://docs.ionos.com/cloud/sdk-tools-home#client-libraries">https://docs.ionos.com/cloud/sdk-tools-home#client-libraries</a></td></tr></tbody></table>

## Frequently Asked Questions (FAQ)

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><mark style="color:blue;"><strong>FAQ</strong></mark></td><td>Answers to common questions about architecture, provisioning, security, billing, and troubleshooting.</td><td><a href="/cloud/compute-services/compute-engine/confidential-computing-vm/confidential-vm-faq.md">FAQ</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.