> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm/use-cases.md).

# Use Cases

IONOS CLOUD Confidential VM use cases for regulated industries and zero-trust workloads.

This topic covers real-world scenarios where <code class="expression">space.vars.ionos\_cloud</code> Confidential VMs protect sensitive workloads, from financial services and healthcare to multi-party data collaboration and sovereign processing. Each scenario describes a problem that standard cloud infrastructure cannot solve without trusting the provider, and how Confidential VM addresses it with hardware-enforced isolation.

## Scenario 1: Platform hosting

### Problem

Partners building custom confidential systems (such as confidential container orchestration, secure enclaves-as-a-service, or sovereign data processing layers) need a trust foundation their own users can verify independently. Selling trust demands an infrastructure layer that allows users to cryptographically verify security claims rather than rely on contractual promises.

### Solution

Deploy your custom orchestration stack on <code class="expression">space.vars.ionos\_cloud</code> Confidential VM to establish a hardware-encrypted VM substrate. This infrastructure layer allows your users to cryptographically verify the runtime environment. <code class="expression">space.vars.ionos\_cloud</code> provides the underlying hardware-encrypted execution state while you retain full control over your platform orchestration stack. The same hardware isolation applies to you as it does to your own users' workloads.

## Scenario 2: Sovereign data processing

### Problem

Workloads subject to strict data sovereignty mandates or foreign intelligence access concerns require complete protection against administrative data collection, independent of legal jurisdictions or contractual promises.

### Solution

Run sovereign workloads inside an AMD SEV-SNP environment to erect a hardware-enforced isolation barrier. Because AMD SEV-SNP enforces this boundary at the CPU level, <code class="expression">space.vars.ionos\_cloud</code> cannot comply with data production orders. The platform holds no VM memory keys, manages no disk encryption keys, and maintains no administrative path to view plaintext data, rendering third-party compliance technically impossible.

## Scenario 3: Regulated industry compliance

### Problem

Regulated industries, including financial services subject to DORA and NIS2, healthcare providers processing patient data, and manufacturers protecting proprietary intellectual property, require verifiable technical controls, not contractual promises. Standard cloud infrastructure exposes active workloads to the infrastructure operator, creating hypervisor-level risk that regulatory frameworks such as HIPAA and GDPR are designed to prevent.

### Solution

Run regulated workloads within Confidential VMs backed by AMD SEV-SNP, so operational personnel cannot access workload data. Access to workload data no longer depends on IONOS CLOUD's internal controls. To meet compliance audit requirements, register a [<mark style="color:blue;">measurement</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#measurement) policy within the attestation service to lock the expected firmware and software stack, producing a cryptographic audit trail of VM integrity at every startup. Apply [<mark style="color:blue;">LUKS2</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#luks) encryption to all persistent storage data volumes to protect data at rest. This is a customer-managed control entirely separate from hardware-enforced memory encryption.

## Scenario 4: Secure multi-party data collaboration

### Problem

Cross-organizational collaboration on machine learning models or sensitive data analytics requires one party to expose raw records or proprietary logic to the other. Distributed raw patient records violate GDPR data minimization principles and HIPAA minimum necessary standards, while data marketplaces force providers to expose raw data or users to reveal proprietary query logic.

### Solution

Deploy computation inside a Confidential VM so that no party, including <code class="expression">space.vars.ionos\_cloud</code>, can access underlying data assets. For federated learning, run a coordinator that aggregates model gradients instead of raw records; each contributing node verifies the coordinator's cryptographic attestation report before submitting, keeping raw records isolated within their native environments. For analytics and data marketplaces, load the sensitive dataset into a TEE-backed query engine. Users submit encrypted queries and receive only isolated outputs. Mutual attestation lets the data provider verify the engine is unmodified, and lets the user verify that their query logic is processed without exposure.

## Scenario 5: Verified multi-tenant SaaS isolation

### Problem

GDPR Article 25 requires data protection "by design and by default," meaning a multi-tenant SaaS architecture must supply cryptographically verifiable data isolation rather than relying on logical network segmentation or operational policies.

### Solution

Isolate individual user enterprise workloads into dedicated per-user Confidential VM s. Route each deployment to a user-controlled attestation service that maintains exclusive ownership of the Volume Master Key (VMK) and measurement policies. By hosting these instances within <code class="expression">space.vars.ionos\_cloud</code> EU data centers, you establish geographic data residency and present technical, verifiable proof of isolation that reduces platform liability.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ionos.com/cloud/compute-services/compute-engine/confidential-computing-vm/use-cases.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.