Confidential computing on H100s, explained without the hype
What a protected GPU can promise, what it can't, and how you check it before sending anything.
Oct 15, 2026 · 8 min read · ZCode team
Fig. 01 — hover the figure
Confidential computing runs a program inside hardware-protected memory that the machine's operator can't read. Modern NVIDIA GPUs such as the H100 can join that protection when paired with a CPU that supports it.
Attestation is the point
The hardware can produce signed evidence of exactly what's running. The idea is that your client checks that evidence before releasing any data, and refuses to fall back to an ordinary server if the check fails.
What it doesn't mean
- It isn't encryption during computation: data is decrypted inside the protected environment to be processed.
- It protects against defined infrastructure threats, not every possible attack.
- A GPU label on a product page isn't enough; the whole CPU and GPU setup has to support it.
Where ZCode is
Live in beta. ZCode rents enclaves from Tinfoil rather than running its own GPUs: your browser checks the signed evidence, encrypts to the enclave, and refuses to send anything if the check fails. ZCode's server can't read your question. Publishing our browser code, so you can check that too, is next.