The barrier to using AI in healthcare, finance and government is often not model quality but permission to use the right data. Hospitals, banks and research institutions hold exactly the kind of information that could make AI most useful, and exactly the kind they are not allowed to share.
Super Protocol builds confidential computing infrastructure that makes it possible to process sensitive data and run AI workloads without exposing the data, models or applications to the server owner, the cloud provider, or even to Super Protocol itself. The system is designed so that these guarantees can be independently verified rather than simply promised.
Yulia Gontar is Super Protocol’s Co-founder and COO. She spent 18 years at Intel leading projects around emerging technologies and championing confidential computing when it was still early-stage. We spoke about why trust is becoming an engineering property, not a matter of reputation.
Can you introduce yourself and tell us about your role?
I’m Yulia Gontar, Co-founder and COO of Super Protocol. We build confidential computing infrastructure that makes it possible to process sensitive data and run AI workloads without exposing the data, models or applications, not to the server owner, the cloud provider, or even to us, and this can be independently verified. At the same time, we preserve full infrastructure flexibility: you can run it in public clouds, private clouds or your own data centres, without being locked into a specific provider.
Before Super Protocol, I spent 18 years at Intel, leading large-scale projects around emerging technologies and championing confidential computing when it was still an early-stage technology. That’s also where I started working with the core team, laying the foundations for our later work together on Super Protocol.
Today, I lead operations and spend much of my time on business development, working with major technology companies such as NVIDIA, Intel and Google, plus infrastructure partners and customers in regulated industries.
How did your company come about and what was the motivation behind it?
Super Protocol was a natural next step after years of working with confidential computing and building real projects around secure data collaboration. The core team was already turning Intel’s early confidential computing capabilities in processors into working solutions. A key project was Aggregion, a data collaboration platform used by companies including Disney, P&G, PepsiCo and Pearson. In 2020, the company received Microsoft’s Country Partner of the Year award, and in 2022 it was acquired by a strategic investor.
What these projects made very clear was that the real challenge for data collaboration was trust. Before confidential computing, collaboration relied heavily on contracts, NDAs and promises not to copy or misuse data. But promises can be broken, and administrators of traditional infrastructure may still have technical access to the data, enough reason for compliance leaders at hospitals, banks and other regulated organisations to say no.
The real turning point came when confidential computing matured for AI workloads. To understand why, it helps to know that data has three basic states: at rest, in transit and in use. The first two have long been protected with encryption, but AI requires both sensitive data and the AI workload itself to be processed, and traditionally that processing could expose them to whoever operated the infrastructure. Confidential computing addresses that third state, making it possible to protect both data and AI during execution.
As confidential computing became a built-in capability of modern data centre CPUs and GPUs, technologies such as Intel TDX and AMD SEV-SNP could be paired with NVIDIA confidential GPUs to enable what we now call Confidential AI: data and AI stay protected while they’re being processed, and the execution environment can be verified all the way down to the chip, turning that earlier promise into something you can actually check.
Data, AI and compute are inherently fragmented, spread across cloud providers, companies’ own servers, and different jurisdictions. So the next step was making that guarantee work everywhere, not just within a handful of hyperscalers. Super Protocol automates what it takes to turn confidential-computing-capable infrastructure into such a verifiable environment, so organisations don’t have to rely on trust in any single party and can use or offer Confidential AI services without confidential computing expertise.
And this isn’t only about collaboration between organisations. A single organisation can face the same problem internally, when the AI or compute best suited to a task is only available externally, while its most sensitive data needs to stay under its own control. The goal is to let organisations use the best data, AI and compute wherever they live or need to run, without giving up confidentiality, ownership or control.
Can you describe your company’s mission and values?
Our mission is to make it possible to use the world’s most sensitive data without giving up control over it. Today, organisations and individuals alike are often forced into a false trade-off: give up privacy to get the benefit of AI, or keep the data protected and give up some of that benefit. We believe that trade-off is not fundamental; it is a technical problem, and technical problems can be solved.
Our values are very practical.
- Verifiability over trust. If we make a security promise, customers should be able to verify it independently rather than simply take our word for it.
- No privileged parties, including us. The system is designed so that infrastructure operators, cloud providers and Super Protocol itself do not need access to a customer’s data or AI workload. We don’t want confidentiality to depend on anyone’s good behaviour.
- Openness. A black box can’t be the foundation of trust. The code behind our guarantees has to be open and reproducibly built.
- Sovereignty and choice. A hospital, university, company or public institution should be able to use the AI and compute it needs without being forced to hand over its data or become dependent on a single provider or jurisdiction.
- Honesty about limits. No technology provides absolute protection. We believe trust is stronger when you are clear about what a system protects, what it can verify, and where its boundaries are.
Ultimately, we want privacy, control and access to powerful AI to reinforce one another rather than compete.
What are some of the most pressing social issues that your company is working to address through its technology?
- The first, and the biggest, is medical data that’s locked away and therefore not saving lives. Diagnostic and medical AI models are often trained not on the data that matters most, but on the data that is easiest to access. That creates a systemic problem: a model trained on data from one country or one population may perform less well for others. To improve that, hospitals and research centres need to be able to learn across data held by multiple organisations, but privacy, regulatory and governance requirements often make direct data sharing extremely difficult. Confidential computing helps remove that blocker: organisations can work with sensitive data without exposing it to one another. For rare diseases, where a single centre may simply not have enough data on its own, that can make the difference between a study being possible or not.
- Privacy as the price of access to AI. Today, to benefit from many AI systems, individuals and organisations often have to hand their data to whoever operates the model. We don’t think the benefit of AI should come at the cost of control over sensitive information.
- Concentration of power over compute and data. If the only practical way to use powerful AI is to upload your data to one of a handful of providers, countries, hospitals and smaller teams lose real choice over who they work with. Confidential AI changes that, letting them use another party’s infrastructure without having to trust that party with their data.
- Insider risk and privileged access. Protecting data at rest and in transit is not enough if someone operating the infrastructure can still access it while it is being processed. Super Protocol helps close that gap by protecting data while it’s actually in use, regardless of who owns or administers that infrastructure.
- Autonomous AI agents, a fast-growing category. They are increasingly acting on behalf of people and organisations and may have access to messages, accounts, medical records and other highly sensitive information. Super Protocol lets their authority be enforced through verifiable technical boundaries, controlling what they can actually access and do, rather than relying only on policies whose enforcement cannot be independently verified.
How does your company measure the impact of its work in creating positive change?
We’re an infrastructure layer, so our impact is often second-order. We don’t carry out the research or deliver the outcome ourselves. We make it possible for others to do things they couldn’t safely do before. We look at impact on three levels.
- Technical proof. First, we measure whether the guarantees we provide are actually verifiable: successful attestation and verification, reproducibility, and independent security validation. For us, impact starts with proving that the technology does what we say it does.
- Unlocked use cases. This is probably the most important measure for us: projects that were previously blocked by data protection, infrastructure or trust constraints and can now move forward. That includes collaboration between organisations, but also a single organisation being able to use external AI or compute with sensitive data that previously couldn’t leave its control.
- Real-world outcomes. Ultimately, we look at what those newly possible projects achieve: whether research can proceed, more relevant data can be used, or AI can be applied where it couldn’t be before.
We try not to inflate the impact narrative. The simplest measure of success for us is how much valuable work that was previously blocked can now move forward.
In your opinion, what impact will technology have in creating a better future?
I think the biggest shift won’t simply be technology getting smarter. It will be trust increasingly becoming an engineering property rather than a matter of reputation. For decades, many digital relationships have ultimately depended on contracts, policies and trust between parties. That model becomes much harder to sustain in a world where more and more decisions are made by AI systems acting with real autonomy. “Trust us” is increasingly being replaced by “verify it yourself,” and I think that’s one of the most important shifts happening in technology today.
For AI specifically, in many of the areas where it could have the greatest impact, the bottleneck won’t just be model quality. It will be permission to use the right data. Healthcare, finance, education and government are exactly where AI could do enormous good, and exactly where data is most protected, often for entirely good reasons.
From there, there are two paths: either everything centralises around a handful of providers everyone is forced to trust, or computation becomes verifiable and organisations can keep their data under their own control while still benefiting from the best AI and compute available. That second path is becoming increasingly important with the rise of Sovereign AI, as countries and organisations look for ways to get the benefits of advanced AI without giving up control over their own data and infrastructure.
We’re optimistic about that direction, but we also know that technology by itself doesn’t guarantee that anything gets better. It changes what’s easy and what’s hard, what’s practical and what isn’t. Our job is to make privacy and verifiability the practical default, rather than the harder choice. Once that’s true, protecting sensitive data no longer has to come at the expense of what technology can make possible.
What advice do you have for other companies looking to use technology for good and create a positive impact in the world?
Start with a constraint people can’t work around, not a convenience they’d enjoy. The most valuable problems tend to sound like “legal won’t approve this” or “we’re not allowed to do that,” because years of unmet demand can build up behind them. Remove that blocker, and you often don’t need to create demand; it was already there, just held back.
Make your guarantees verifiable, not just declared. Ask yourself honestly what’s left of your privacy or security promise if your company changes ownership or receives a request it legally can’t refuse. Anything that rests only on your good intentions is fragile. Wherever you technically can, replace promises with something people can check for themselves.
Be open about the parts of your system that trust depends on. Asking people to trust a black box is often the exact problem you’re trying to solve.
Focus on what your technology makes possible, not the technology itself. Very few people wake up wanting encryption or infrastructure. They want the research, the collaboration, or the outcome that finally becomes possible because of it.
And be honest about your limits. No technology offers absolute protection, and the fastest way to lose trust in this space is to promise slightly more than you can actually prove.
—
Super Protocol works with NVIDIA, Intel and Google, alongside infrastructure partners and customers in regulated industries. The code behind their security guarantees is open and reproducibly built.
You can find out more at superprotocol.com.
