Privacy

CRE has two features designed to keep part of a workflow confidential from Workflow DON node operators during execution. Both run inside a secure enclave, a running instance of a Trusted Execution Environment (TEE), and fetch secrets from the Vault DON instead of the regular Workflow DON runtime.

Privacy features

• Confidential Workflows (private beta): Runs a handler's full callback logic inside a TEE, for workflows where more than a single request is intended to remain confidential: risk thresholds, proprietary scoring, multi-step reasoning over sensitive inputs.
• Confidential HTTP: Executes a single outbound HTTP request inside a TEE, with secrets injected via templates and an optional encrypted response.

Guides

• Making a Workflow Confidential: Step-by-step guide to registering a TEE handler.
• Making Confidential Requests: Step-by-step guide to making a single confidential HTTP request.

Learn more

• Requesting Confidential Workflows Access: How to get enrolled in the private beta.
• Key Terms: Definitions for TEE, enclave, Vault DON, and confidential execution.