A due diligence team searches a data room for every contract mentioning a change-of-control clause. The results come back highlighted and ranked in under a second. The vendor’s homepage promises bank-level encryption and 256-bit AES. Somewhere between the upload and that search result, the document left its encrypted state. That gap is where most data room encryption claims stop holding up.
What “encrypted” usually means in a virtual data room
Most virtual data rooms protect documents two ways: TLS while the file travels from your browser to their servers, and AES-256 while it sits in storage. Both are standard, and both matter. Neither one covers what happens when someone uses the document.
Search indexing, page previews, watermarking, and OCR all require the platform to read the content of the file. A server can’t index text it can’t see, and it can’t stamp a viewer’s name and IP address across a PDF preview without rendering that PDF first. To do any of this, the platform decrypts the document, processes it in memory on its own servers, and re-encrypts it afterward.
During that window, the file sits as plaintext on infrastructure the vendor controls. A vendor engineer with server access, a misconfigured backup, a compromised admin account, or a legal order compelling the vendor to hand over data could all reach that plaintext.
For a due diligence process involving financial statements and cap tables, that decryption window carries the real risk.
Where the gap starts to matter
Picture a Series B due diligence process. The buyer’s legal team runs forty searches across three hundred uploaded documents over two weeks. Each search touches the indexed, decrypted version of those files sitting on the vendor’s search infrastructure.
If the target company operates in the EU and the data room vendor is a US company, the CLOUD Act adds another layer. US authorities can compel the vendor to produce data it holds, including data stored on EU servers. GDPR-compliant hosting doesn’t close that gap on its own if the underlying platform sits under US jurisdiction.
None of this requires a breach to become relevant. It only requires someone with legitimate infrastructure access, or legal authority over that infrastructure, to look.
What confidential computing changes
Confidential computing runs the parts of the process that need to read your document, preview rendering and watermarking among them, inside a hardware-isolated enclave rather than on general-purpose servers. Intel SGX and AMD SEV are the two implementations behind most current confidential computing platforms, including Subnoto’s.
The distinction that matters: the vendor’s own infrastructure, including root-level admin accounts, cannot read what happens inside the enclave. The enclave decrypts the document, does its job, and re-encrypts the result inside a boundary the host operating system and the cloud provider can’t see into. Before any decryption happens, the enclave proves cryptographically what code it’s running, a process called remote attestation, so the system can verify it’s running the enclave code and not a substitute designed to leak data.
Subnoto’s data room runs preview rendering, watermarking, and access logging inside the enclave today. Search isn’t part of the product yet, so it isn’t one of the protections described here until it ships.
Why not just use zero-knowledge encryption?
Zero-knowledge encryption is the other model that avoids server-side decryption. Tresorit, among the few vendors offering data room features built on it, encrypts files on the user’s device before upload, so the provider never holds a readable copy. That closes the same gap confidential computing closes, through a different mechanism.
The cost shows up immediately. A server that never sees plaintext can’t index it. Full-text search, previews, and OCR all disappear along with the provider’s access, and reviews of zero-knowledge data room products note this directly: deal-specific workflows like search and bulk indexing lag behind dedicated VDR platforms.
Confidential computing is built around a different trade. The enclave gets access to the plaintext long enough to render a preview or apply a watermark, then the boundary closes again, without exposing that plaintext to the vendor’s general infrastructure at any point.
Standard encryption vs. confidential computing, side by side
| Standard virtual data room | Confidential computing data room | |
|---|---|---|
| Data in transit | Encrypted (TLS) | Encrypted (TLS) |
| Data at rest | Encrypted (AES-256) | Encrypted (AES-256) |
| Data during search and indexing | Decrypted on vendor servers | Processed inside hardware-isolated enclave |
| Data during preview and watermarking | Decrypted on vendor servers | Processed inside hardware-isolated enclave |
| Vendor admin access to plaintext | Technically possible | Blocked by hardware isolation |
| Verification the claim is true | Vendor’s word | Cryptographic attestation |
The search and indexing row describes what the confidential computing model makes possible. Subnoto’s data room doesn’t have search yet, so that row applies to preview, watermarking, and access logging today, not to search.
What confidential computing doesn’t solve
Confidential computing protects your documents while the platform processes them. It doesn’t protect you from what happens after someone downloads a file to their own laptop, forwards a link to the wrong person, or hands over their login to a phishing page. Access control, permission settings, and basic security hygiene on the buyer’s and seller’s side still carry most of the weight in an actual deal.
Confidential computing isn’t a substitute for an NDA either. It reduces the number of parties who can technically reach your data. It doesn’t create a legal remedy once a document leaves the room.
Questions worth asking any data room vendor
Before choosing a platform for due diligence, fundraising, or an M&A process, ask the vendor directly:
What happens to a document the moment someone searches it or opens a preview? If the answer involves the platform’s own servers processing plaintext, ask how long that data persists and who has access to it.
Can vendor employees or administrators technically access document content? Most vendors will say access is restricted by policy. Policy restricts what employees are supposed to do. Hardware isolation restricts what’s technically possible.
Who holds the encryption keys? If the vendor holds both the encrypted data and the keys to decrypt it, the encryption protects against outside attackers but not against the vendor itself, or anyone who compels the vendor to act.
If a vendor claims confidential computing or hardware-level isolation, ask for details on remote attestation. A vendor that can explain how attestation works for their specific setup is describing an architecture. A vendor that can’t is describing a marketing term.
Subnoto’s data rooms run preview, watermarking, and access logging inside SGX and SEV enclaves, so due diligence documents stay protected through the steps where other platforms decrypt them. Read more on how confidential computing works
