Confidential AI: what enclaves protect, and what your confidentiality clause asks
Confidential AI means two things: enclaves that hide data from the cloud operator, and whether a tool keeps what you type confidential at all.
At a glance
- “Confidential AI” names two different things: confidential computing, which hides data from the cloud operator while it is processed, and whether an AI tool keeps what you type confidential.
- Confidential computing protects your data from the company running the servers. The AI provider still receives and processes your prompt.
- Under the GDPR, a provider that processes personal data for you is a processor whether or not it uses an enclave, and encryption is one security measure among several that the GDPR lists.
- For a CRO, the clause that decides is usually in the sponsor’s confidentiality agreement (CDA), master services agreement or quality agreement, and it turns on who receives the material, not on how it is encrypted. Read the clause first, then pick the tool.
- A small firm has three real choices: a public AI assistant, an enterprise cloud plan with a contract, or a device in the office that a vendor installs and maintains. Only the third keeps sponsor material away from an AI company.
Confidential AI means two different things. One is confidential computing, a hardware technique that hides your data from the company running the cloud servers while it is processed. The other is whether an AI tool keeps what you type confidential at all. A CRO or medtech firm bound by a sponsor’s confidentiality clause needs the second answer, and an enclave doesn’t change it: the AI provider still receives the material. So the buying decision is about who receives the protocol or monitoring report, and that narrows to three options.
Two meanings of “confidential AI”
Confidential computing: protecting data in use from the operator
Data is usually encrypted in two states: at rest, on a disk, and in transit, across a network. While a server works on it, it is normally decrypted in memory, where whoever controls the server could in principle inspect it. Confidential computing closes that gap. The processing happens inside a sealed area of the processor, often called an enclave, which even the operator of the server cannot read.
A second piece, remote attestation, lets the user’s software check what is running inside that sealed area before it sends anything. Privatemode, an AI service built this way, describes it in its documentation (read October 20, 2026): prompts and responses are processed only inside hardware-isolated confidential computing environments, the company says neither it as operator nor the infrastructure provider can access them, and the client checks this through remote attestation before sending data. Products sold under names such as Fortanix Confidential AI belong to this first meaning too.
Confidential computing protects you from the people who run the infrastructure. It is a strong answer to “could a cloud administrator read my data while it is processed?”
Tool confidentiality: what an AI service does with your inputs
The second meaning is the everyday one. When you paste a monitoring report into a chatbot or let a meeting assistant record a call with a sponsor, what happens to that material? Is it stored, for how long, who at the company can read it, and does it train future models? These are questions about the provider’s policies and contracts.
Most people searching “is ChatGPT confidential” or “Otter AI confidentiality” are asking this second question.
What confidential computing does and does not change
An enclave changes who can see data during processing. It does not change who is doing the processing. The AI provider still receives your prompt, runs its model on it and returns an answer. For a firm bound by a confidentiality clause, that is the fact that matters.
The GDPR’s definitions make the point for EU and UK readers. Processing is defined broadly, covering operations such as collection, storage, consultation, use and disclosure by transmission. A processor is a body that processes personal data on behalf of the controller. A provider running your prompt inside an enclave is still processing it on your behalf, so it is still your processor, and the GDPR still requires a contract with it that sets out the subject matter, duration, nature and purpose of the processing.
Encryption has its own place in the law. The GDPR requires controllers and processors to take security measures appropriate to the risk and lists the pseudonymisation and encryption of personal data among them, next to the confidentiality, integrity, availability and resilience of systems and regular testing of the measures. Confidential computing is a strong measure of that kind. It is a way to secure processing, and the question of whether the processing should happen at all remains.
NIST’s profile for generative AI frames the risk the same way. NIST AI 600-1 describes the data privacy risk of generative AI as impacts due to leakage and unauthorized use, disclosure or de-anonymization of personal or sensitive data. It also notes that third-party generative AI integrations may give rise to increased data privacy and information security risks. An enclave reduces one route to leakage. It doesn’t remove the third party.
Is what you type into ChatGPT, Otter or Read confidential?
Each vendor answers this in its own terms. These summaries come from each vendor’s own pages, read on October 20, 2026. Policies change, so check the current version before you rely on one.
ChatGPT
OpenAI’s enterprise privacy page (updated January 8, 2026) says business data from ChatGPT Business, Enterprise and the API isn’t used to train its models by default. It also says OpenAI uses data from versions of ChatGPT for individuals in training. On ChatGPT Business, OpenAI’s access to stored conversations is limited to authorized employees for engineering support, abuse investigation and legal compliance, and to specialized contractors who review for abuse and misuse. Deleted conversations are removed within 30 days, unless longer retention is required by law or needed to protect its services. So a business plan is confidential in the sense of “not used for training and access-controlled”. It is not confidential in the sense of “never seen by anyone outside your firm”.
Otter
Otter’s privacy policy (effective June 16, 2026) lists training its proprietary AI on de-identified audio recordings and transcriptions as one of its purposes. It lists artificial intelligence service providers that support some product features, and data labeling providers that create training and evaluation data, among the parties it shares data with.
Read AI
Read’s privacy policy (last updated June 29, 2026) says it uses information to train and improve its models consistent with your account settings, and offers a Customer Experience Program you can opt in to. It lists AI tools among the service providers that may receive data.
What these answers have in common
None of this makes these tools unusual. Most cloud AI services work this way. A meeting recorder adds one more consideration: it captures what everyone on the call says, including the sponsor’s team, who may not have agreed to it.
Reading a sponsor confidentiality clause against an AI tool: the questions to ask
For a CRO, “the clause” is rarely one sentence. It is spread across the confidentiality agreement (CDA) signed before the study, the master services agreement, and the quality agreement, which often lists the subcontractors and computerised systems the sponsor has accepted. We can’t interpret your contract, and you should take legal advice on a specific clause. What we can do is give you the questions that turn those documents into a decision.
- What does the clause forbid: disclosure to any third party, or only “public” tools? A clause against third-party disclosure covers a business AI plan as much as a free one.
- Does it allow subcontractors or service providers with the sponsor’s consent, and does the quality agreement name them? If so, the route is consent for a named tool, in writing, added to the agreement.
- Does the material include personal data? If it does, a processor contract under the GDPR is needed on top of whatever the sponsor agreement says.
- Does the tool keep a copy, where, and for how long? Retention settings and deletion periods are in the vendor’s own documentation.
- Can anyone at the vendor read it, and in what circumstances? Abuse review and support access are common exceptions to “nobody looks”.
- Does it train on your inputs, by default or by setting? Check the plan you are on, not the vendor’s best plan.
- Does an enclave or encryption change any of the above? Usually it doesn’t, because the clause is about who receives the material.
NIST AI 600-1 suggests organizations inventory all third-party entities with access to organizational content and establish approved lists of generative AI technology and service providers. That approved list is the practical outcome of these questions: each tool goes on it with the sponsors and data types it is cleared for.
Three choices, and what each one sends out
Once the clause is read, a firm without its own IT department is choosing between three kinds of tool. Two working habits apply whichever you pick: keep sponsor material out of AI tools where the clause says so, and remove the confidential parts of a short extract before using a cloud tool (this fails for whole documents, where the confidential content is the point).
A public AI assistant. Free and personal plans, and the meeting recorders above on their default settings. Cheap and capable, but the vendor receives everything and may train on it. Fit for job adverts and public guidance, not for a sponsor protocol.
An enterprise cloud plan with a contract. ChatGPT Business or Enterprise, Microsoft Copilot under your Microsoft 365 agreement, or a confidential computing service such as Privatemode. You get a data processing agreement, no training by default and controlled access. The vendor still receives the prompt, so this works when the sponsor has approved that vendor in writing, and a sponsor can refuse.
A device in your office, run by a vendor. The AI model runs on a device at your premises, so no AI company receives the prompt. A small firm can’t set up a server and a model itself, and doesn’t need to: the vendor delivers the device, connects it and maintains it. What you check is what that vendor can see and whether it belongs on your quality agreement.
| Public assistant | Enterprise cloud plan (including enclaves) | Device in your office, run by a vendor | |
|---|---|---|---|
| Who processes the prompt | The AI provider | The AI provider | The device in your office |
| Can the infrastructure operator read it during processing | Yes | In principle yes, or no with enclaves if the attestation checks out | No AI company is involved. Ask what the maintaining vendor can see |
| Does the material leave your organization | Yes | Yes | No |
| Is the provider a GDPR processor for personal data | Yes | Yes | No AI provider involved. Ask whether the maintaining vendor is one |
| What the sponsor has to approve | Usually refused | The named cloud vendor | The maintaining vendor |
Our guides to on-premise AI and to AI on premise vs cloud cover the third choice in more depth, and private AI for business sets out the three things “private AI” is sold as.
Where IntraMuros fits
IntraMuros is the third choice. Mayet, a British software company that works for pharma, biotech, medical device and clinical research firms, ships a device to your office in a couple of days, configures it remotely in a few hours once it is plugged in, and connects it to your documents and email, and can connect it to software such as your eTMF, CTMS or eQMS, in the office or in the cloud. It is running within a week of signing. From then on Mayet patches, monitors and backs it up, and replaces it if it fails. Nobody at your firm installs or administers anything.
The model runs on the device, so no AI provider receives your prompts, documents or answers, which is the question the enclave left open. It also answers question 6: your documents and conversations are never used to train any AI model, by Mayet or anyone else. Staff use the agent, MURO, from a browser and have no admin access. They sign in with the Microsoft or Google work account they already have, and MURO works with each person’s permissions in every document and connected piece of software, so the team on one sponsor’s study gets answers only from that study’s files. Every answer shows the document it came from. The clinical operations page shows it at work on study files.
The price covers everyone in the firm, and maintenance is £1,000 a month or £10,000 a year for one device. The device is a one-off charge with set-up included: a CRO of 25, with study teams asking questions through the day, fits Enterprise at £12,000, and a firm of 5 to 10 people fits Base at £4,500. See how it works and pricing.
It is not the answer for every firm. If your sponsors have approved a cloud tool in writing, that tool is cheaper for a small team. If you only want AI for work that holds no sponsor material, a standard business plan does that for less.
Mayet connects to the device to update, monitor and back it up. Mayet is the one outside party that administers the device, so if a sponsor asks who outside your firm has access to it, that is the name to give them, and the one to add to your quality agreement.