A Confidential VM is a Compute Engine VM that uses a
[specific machine type](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#machine-types)
and keeps your sensitive code and other data encrypted in memory during
processing, that is, it performs *encryption-in-use* .
Together with [*encryption-at-rest*](https://docs.cloud.google.com/docs/security/encryption/default-encryption)
and [*encryption-in-transit*](https://docs.cloud.google.com/docs/security/encryption-in-transit),
Confidential VM can help keep your data and applications encrypted at
all times.

For a more detailed conceptual overview, see
[Confidential VM overview](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/confidential-vm-overview).

To get started using Confidential VM, see [Create a Confidential VM instance](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/create-a-confidential-vm-instance).

You can manage your Confidential VMs in some of the following ways:

- You can use organization policy constraints to
  [ensure that instances created in your organization are Confidential VMs](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/enforce-confidential-vm-use).

- You can use Cloud Monitoring and Cloud Logging to
  [monitor and validate your Confidential VM instances](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/monitor-integrity).

- You can use shared Virtual Private Cloud (VPC) networks, organization policy
  constraints, and firewall rules to [set up a security perimeter](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/restrict-confidential-vm-interaction)
  that ensures your Confidential VM instances can only interact with
  other Confidential VM instances.

- With the A3 machine type, you can create a Confidential VM instance
  that uses Intel TDX and has an attached NVIDIA H100 GPU. For more information,
  see [Confidential VM supported configurations](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations).

- With the G4 machine type, you can create a Confidential VM instance
  that uses AMD SEV and has an attached NVIDIA RTX PRO 6000 GPU. For more
  information, see
  [Confidential VM supported configurations](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations).

For enhanced block storage security with Confidential VM, you can use
[Confidential mode for Hyperdisk Balanced](https://docs.cloud.google.com/compute/docs/disks/disk-encryption#conf_hdb).
Confidential mode for Hyperdisk Balanced adds another layer of security by enabling hardware-based encryption
of disk data. Hyperdisk volumes in Confidential mode use
[Cloud HSM](https://docs.cloud.google.com/kms/docs/hsm) and Trusted Execution Environments (TEE) to
provide additional cryptographic isolation. For more information about TEEs, see
[Trusted Execution Environment Explainer](https://services.google.com/fh/files/misc/confidential_computing_overview.pdf).