> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm/overview/features-and-benefits.md).

# Features and Benefits

IONOS CLOUD Confidential VM features and benefits: hardware encryption, attestation, disk encryption, and sovereignty.

<code class="expression">space.vars.ionos\_cloud</code> Confidential VMs provide hardware-enforced memory encryption, cryptographic attestation, and EU data sovereignty, without requiring trust in the cloud provider.

## Features

* **Hardware-enforced memory encryption:** AMD SEV-SNP CPU encrypts all VM memory with Advanced Encryption Standard (AES) using unique encryption keys that never leave the CPU or reach the hypervisor or administrators.
* **Cryptographic attestation:** Verify firmware, kernel, and configuration measurements with signed [<mark style="color:blue;">attestation reports</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#attestation-report) before releasing secrets or encryption keys to VMs.
* **Secure memory protection:** AMD Secure Nested Paging detects and blocks hypervisor attempts to replay, remap, or modify VM memory pages.
* **Data sovereignty:** Runs exclusively in <code class="expression">space.vars.ionos\_cloud</code> EU data centers; <code class="expression">space.vars.ionos\_cloud</code> holds no encryption keys, technically excluding the provider from key management.
* **Firmware transparency:** [<mark style="color:blue;">SLSA Level 2 provenance</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#supply-chain-levels-for-software-artifacts-slsa-provenance) on [<mark style="color:blue;">OVMF</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#ovmf) firmware builds proves binaries were produced by public CI pipeline with immutable Sigstore Rekor records.

## Benefits

* **No provider trust required:** Security does not depend on <code class="expression">space.vars.ionos\_cloud</code> policies, contracts, or audits. The CPU enforces the boundary, removing the provider as a point of failure in your trust model.
* **Verifiable compliance posture:** Hardware isolation and cryptographic attestation produce verifiable technical evidence for regulatory audits, replacing policy assertions with cryptographic proof.
* **Runtime tamper detection:** Any modification to your software stack, whether from a misconfiguration or supply chain compromise, results in attestation failure before secrets are released, ensuring you know exactly what is running in your environment.
* **Independent platform verification:** Firmware provenance is publicly logged and verifiable by anyone. You can verify <code class="expression">space.vars.ionos\_cloud</code>'s claims about the platform using any attestation service. For more information, see [<mark style="color:blue;">SNPGuard</mark>](https://github.com/ionos-cloud/snp-guard).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm/overview/features-and-benefits.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.