How does a confidential app get paid for work on data it never sees?
PoCo matches signed orders into an onchain deal, runs the task in an Intel TDX Trust Domain and verifies the proof. ๐
Building a confidential app used to mean complex TEE configuration, manual compliance checks and debugging after deployment.
The iApp Generator removes that setup.
๐ธ Ready-to-use templates in Python or JavaScript
๐ธ Automated TEE setup
๐ธ Built-in checks against the iExec iApp framework before you deploy
An iApp is the part of your application that handles protected data, running inside a TEE.
Run code on someone elseโs machine, and three things can go wrong:
You lose control of the data.
The operator can read it while it runs.
You get an output, but no proof of how it was produced.
iExec PoCo removes the operator from the trust equation.
Every access to protected data needs explicit authorization.
With DataProtector, you choose the authorizedUser who can submit it, and how many times.
You stay the owner. The data remains protected.
Data isn't the only thing worth protecting. Your logic is, too.
Model parameters, scoring thresholds, API keys.
On iExec, an iApp's secrets are delivered only inside the TEE at runtime, never exposed to the machine running it.
A TEE isn't a file safe. It's an isolated computer.
Software runs inside. Data lives inside. The host, hypervisor, OS, even the cloud operator, can't read what's happening in there.
Intel TDX calls this a Trust Domain. Different TEE, same principle: protect computation, not just files.
What happens when you protect data with DataProtector?
1. Client-side encryption before anything leaves your machine
2. Encrypted payload uploads to supported storage (IPFS, Arweave)
3. Ownership registered on-chain
Three functions, three layers. On-chain โ publicly readable.
๐ https://t.co/CQNgctLv7U