What is the difference between encryption in transit, at rest, and in use?

Encryption in transit protects data over networks (TLS); encryption at rest protects data stored on disks (FileVault); confidential computing protects data while actively being computed in CPU/RAM memory.

What is Apple's Secure Enclave?

The Secure Enclave is a dedicated coprocessor embedded in Apple Silicon chips with its own isolated memory, boot ROM, and hardware random number generator, dedicated to biometric and cryptographic operations.

How does Oyma benefit from Apple hardware security?

Oyma runs on Apple Silicon Macs where unified memory isolation and Secure Enclave cryptographic key management protect local note files and speech processing from unauthorized inspection.

What is Confidential Hardware Computing?

Confidential computing is an advanced cybersecurity paradigm that protects sensitive data while it is actively being processed in computer memory (RAM).

Historically, digital security addressed two static states: data in transit (protected by cryptographic protocols like TLS and HTTPS) and data at rest (protected by volume encryption like Apple FileVault or BitLocker). However, whenever software decrypted information to perform searches, calculations, or neural network inference, that data became vulnerable in plaintext within system memory. Confidential computing closes this vulnerability.

The architecture of a Trusted Execution Environment (TEE)

Confidential computing relies on specialized silicon hardware to instantiate a Trusted Execution Environment (TEE)—often called a secure hardware enclave:

[Host Operating System / Hypervisor] (Untrusted Boundary)
                     ↓
┌─────────────────────────────────────────────────────────────┐
│ Hardware-Isolated TEE / Secure Enclave (Cryptographic Vault)│
├─────────────────────────────────────────────────────────────┤
│ • Memory Encryption with Dynamic Hardware Keys (AES-XTS)     │
│ • Hardware Memory Controller Access Control                  │
│ • Cryptographic Remote Attestation                           │
│ • Isolated Boot ROM & Internal Microkernel                  │
└─────────────────────────────────────────────────────────────┘

Hardware memory encryption: The CPU memory controller transparently encrypts data as it moves between processor cache and physical DRAM, ensuring that physical RAM probes capture only ciphertext.
Kernel isolation: Even if the host operating system kernel or hypervisor is compromised by malware or rootkits, the hardware memory controller blocks the kernel from inspecting memory pages allocated to the secure enclave.
Cryptographic attestation: Hardware generates cryptographic certificates proving to external parties that specific software is running unmodified inside an authentic secure chip.

Confidential hardware on Apple Silicon

Apple has long been a pioneer in consumer hardware enclave design:

Apple Secure Enclave (SEP): A dedicated ARM coprocessor running an isolated microkernel (L4-based sepOS). It manages Touch ID biometrics, Apple Pay tokens, and FileVault disk volume encryption keys.
Unified memory memory protection: Apple Silicon enforces page-table memory protections in hardware, preventing arbitrary applications from reading the address spaces of neighboring processes.

Why local computing remains the ultimate enclave

While cloud providers (such as AWS Nitro Enclaves and Azure Confidential Computing) now offer confidential cloud VMs, running software locally on your personal Mac remains the ultimate confidential computing model:

You control the physical device and its power source.
There are no cloud hypervisors, foreign cloud engineers, or multi-tenant neighbors sharing your silicon.
Applications like Oyma execute Whisper speech transcription and SQLite search indexing entirely within local Apple Silicon memory.

With Oyma, confidential computing is not a complex enterprise cloud protocol—it is the simple, natural reality of running private software on your own Mac.