Customer-Dedicated Enclaves.

Your Media Clean Room (MCR) lives in its own isolated VPC. Your project gets a private network slice—no shared tenancy, no cross-tenant traffic.

Bring Your Own Keys.

You supply and control the encryption keys via Google Cloud KMS or Cloud HSM. Anami operators and Google Cloud administrators cannot access your keys or decrypt your data—ever.

Zero-Trust Compute.

We run your workloads on Confidential VMs (Intel SGX and AMD SEV-ES) and Shielded GKE nodes. Your container images are cryptographically measured at boot by Binary Authorization and Google’s Verified Boot. Only your exact image hash can unlock the TEE, preventing any rogue code from ever executing.

Remote Attestation & TEE Reports.

Before each job, you receive a hardware-signed attestation report proving that your container image is the only software running inside the enclave. This end-to-end Trusted Execution Environment (TEE) ensures your proprietary model weights and our captured video data never co-reside in the clear.

Network & Data Protections.

VPC Service Controls restrict all ingress/egress to your private endpoints.

Firewall policies enforce least-privilege access down to IP and port.

Data at rest is encrypted with your key; data in transit uses mTLS with customer-managed certificates.

With Anami, you get the industry’s strongest isolation: your data or your models live together in a verifiable, hardware-rooted vault—fully under your control.