Start on Cloud

Home / Products / Compute on data

Confidential Microservices

Run your services sealed.

The default way to run code on Calimero. Write a service in Rust or JavaScript, deploy it to attested nodes, and clients call it over a sealed channel after checking the node. Each answer carries a receipt signed by an attested key.

Start free on Calimero Cloud Book a walkthrough

Compute on data · Works with Confidential Functions, Confidential Database, Confidential Gateway · Same meters as every product

02 · Use case

A patient-records API your customers' security teams can sign off

Who it's for: Health and fintech software companies.

Today

Every enterprise deal ends in a security review that asks who can read customer data. The honest answer today is a handful of engineers and the cloud provider, kept in check by policy and access logs, and the review drags on for weeks.

With Confidential Microservices

The team compiles its existing records API to WebAssembly and deploys it as a Confidential Microservice. It keeps the same endpoints, and each instance runs on three attested nodes with one ordered log. Clients check a node's attestation before connecting, and records are only ever readable inside the sealed node.

What you get

  • An answer to "who can read our data" backed by attestation, not policy
  • The same API and clients, replicated across three nodes and kept online
  • Records nobody, including your own engineers or us, can read

03 · How it works

Four steps, all inside attested nodes.

  1. 01 · Build

    Write a service in Rust or JavaScript and compile it to WebAssembly.

  2. 02 · Deploy

    Publish the signed package to Calimero Cloud or to a cluster of your own.

  3. 03 · Call

    Clients verify the node's attestation, then call it over a sealed channel.

  4. 04 · Prove

    Every answer carries a signed receipt naming the code and the node.

04 · Built in

What it inherits from the engine.

Confidential Microservices runs on the same confidential engine as every Calimero product, so it comes with the same proof.

  • Attested hardware. Clients verify the node's image before sending anything.
  • Sealed end to end. Nobody, including us, can read data inside a sealed node.
  • Signed receipts. Every answer can be checked offline, later, by anyone.
How we prove itAll products

05 · More in Compute on data

Works on the same engine.

See Confidential Microservices running on attested hardware.

Book a technical walkthrough and we'll map your data flow, or start free on Calimero Cloud.

Book a walkthrough Start free on Calimero Cloud