Confidential Computing's Role In Ending SaaS Data Breaches

Anand Kashyap is CEO and cofounder of Fortanix, a global leader in data security and a pioneer of confidential computing.

SaaS providers claiming they can’t "see" user data is often a convenient myth rather than a reality. While privacy-preserving technologies such as end-to-end encryption exist, they’re limited to specific use cases like peer-to-peer messaging.

Two uncomfortable truths often go overlooked. First, most SaaS applications fundamentally require access to user data to function. Second is the "privacy paradox," where users are concerned about data privacy but freely share their info out of convenience.

These realities create an inherent vulnerability that traditional privacy approaches have failed to address effectively.

As SaaS data breaches continue to rise, existing privacy measures, such as encryption during data storage or transfer alone, will not be enough. Data is exposed the moment it’s processed, making SaaS providers vulnerable to data breaches, government subpoenas or even insider threats.

The widespread visibility of user data in the cloud is a flaw in the foundational design of SaaS models, and an urgent solution is needed.

Why SaaS Models Struggle With Data Protection

Few SaaS applications can operate effectively without accessing the information they manage. This creates vulnerabilities at multiple levels, including data visibility during processing. Most of today’s SaaS platforms process user data while unencrypted, making it accessible to the provider and creating a weak link.

Further risks may be created via actions like government subpoenas when SaaS providers must hand over customer data—without informing users in many cases. No matter how strong the encryption for data is while it’s at rest or in transit, governments can access data during processing.

In addition, current cloud technologies aren’t designed to provide proper data invisibility. While they offer operational efficiency and the ability to scale up or down quickly, they often expose data to the provider and, in worst-case scenarios, unauthorized actors.

These factors illustrate the pressing need to shift how SaaS providers approach privacy.

How Confidential Computing Can Impact SaaS Security

In recent years, a new approach to data privacy has emerged that enables data to remain encrypted even during processing, addressing the core vulnerability in SaaS models.

The technology is confidential computing, which uses secure enclaves—hardware-based, isolated environments within a CPU called trusted execution environments (TEE)—to process encrypted data without exposing it to anyone. Operating systems or cloud providers hosting the application can’t access the data, and it remains protected even if the overarching infrastructure is compromised.

Confidential computing for SaaS can help ensure that customer data remains inaccessible to the cloud service provider while still allowing secure processing, meaning that organizations can process or collaborate on sensitive data while it remains protected in use.

For SaaS, this can mean:

• Enhanced Privacy: Ensuring data remains invisible to the service provider removes SaaS providers from the role of "data processor," making it easier to comply with regulations like GDPR.

• Improved Security: A SaaS provider storing only encrypted data reduces the risk of data breach or unauthorized access.

• Seamless Integration: Unlike other technologies that attempt to preserve privacy, confidential computing can slip into existing SaaS models without requiring extreme changes in user behavior or application architecture.

• Data Sovereignty: Confidential computing can help ensure data is managed, processed and stored according to the laws of the country or within the region from which it originated.

How Confidential Computing Compares To Other Approaches

A couple of other privacy-enhancing technologies have also emerged. Let's look at how they compare to confidential computing:

• Fully homomorphic encryption (FHE) allows computations directly on encrypted data without decryption but often causes significant performance overheads due to its computational complexity.

• Multi-party computation (MPC) enables secure computations across distributed parties without revealing individual inputs but is limited in scalability due to complex protocols and communication.

• Differential privacy focuses on adding noise to data to protect individual records during statistical analysis, which can work well for specific use cases but not for general-purpose secure computation.

Confidential computing is often more practical and performant than these alternatives, as TEEs leverage hardware acceleration for low-latency, high-throughput processing, making it more feasible for real-time and large-scale applications. Further, its compatibility with existing software frameworks can simplify integration, creating a balance between robust security and operational efficiency.

A Bright Outlook Despite Some Challenges

Confidential computing, however, isn't without challenges that must be addressed to fully realize its potential:

• Hardware Vulnerabilities: Secure enclaves rely on hardware integrity, meaning threats like side-channel attacks could compromise data. Hardware providers continually improve security, but—as is the case with data-specific threats—new and evolving vulnerabilities remain a concern.

• Implementation Barriers: Adoption remains limited by the availability in both cloud environments and on-premises infrastructure. Wider deployment requires further investment and innovation.

• Regulatory Catchup: Governments and other regulatory bodies have just begun to explore confidential computing, and a lack of solid and consistent mandates or incentives slows adoption.

These challenges are being addressed. By doing so, the opportunity that confidential computing provides to mitigate SaaS data breaches is enormous.

What a Regulatory Roadmap Could Look Like

To make confidential computing a cornerstone of SaaS privacy, governments should mandate its use for applications handling sensitive personal data. Such regulations would accelerate adoption and improve privacy standards across industries.

In response, cloud providers and hardware manufacturers should invest in research and development that prioritizes secure enclave technology to address current vulnerabilities and ensure reliability at scale. Policymakers could also incentivize SaaS providers to adopt confidential computing, such as streamlined compliance with GDPR, CCPA and similar regulations.

The Future Of SaaS Privacy

The time has come for tech leaders and lawmakers to embrace confidential computing as a core component of data privacy strategies. The future of privacy-preserving SaaS may depend on this transition, and the necessary tools are already available.

For the global tech community, overcoming the hurdles mentioned above will help confidential computing be embraced as a standard for privacy. This can protect users from breaches, prevent unauthorized data access and rebuild trust in the SaaS model for the next generation of digital services.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?