Skip to content

Key terms

The following terms are used throughout the Opaque documentation:

Platform structure

  • Organization: The top-level unit for user management in Opaque, representing one or more users. Each user belongs to exactly one organization. See also role-based access control (RBAC).
  • Workspace: An isolated environment where users collaborate on shared data and compute. Opaque supports two workspace types: analytics and ML workspaces (for running jobs over encrypted data) and agentic AI workspaces (for building and running AI workflows with agents and LLMs). Each workspace enforces strict access controls and data boundaries.
  • Job: A computational task executed within a workspace using Opaque’s secure analytics engine. Jobs include Python- or SQL-based queries, machine-learning training, or inference—executed on encrypted datasets with results stored securely. Jobs are used in analytics and ML workspaces and require approval from all members in multi-user workspaces.
  • Dataset: An encrypted dataset added to a workspace. All datasets in Opaque remain encrypted at rest, in transit, and in use, ensuring full privacy throughout their lifecycle. The user who provisions a dataset controls access, but datasets can be shared with workspaces based on assigned permissions. In multi-member workspaces, data-processing jobs require the approval from all members before execution; in single-member workspaces, approval is not needed.
  • Synthetic data: Artificially generated data that mimics the structure and statistical properties of real datasets. Used in analytics and ML workspaces to develop and test jobs without exposing sensitive information. This enables users to refine workflows, test queries, and conduct analysis securely, supporting compliance with privacy regulations.
  • Workflow: An AI-driven process designed to accomplish a specific task through a sequence of actions. Workflows orchestrate large language models (LLMs), encrypted data, and reusable logic nodes to automate tasks such as answering questions, summarizing datasets, or decision support. Workflows differ from jobs in that they run persistently (until stopped), respond dynamically to input, and are executed in agentic AI workspaces. They offer modular logic, data retrieval, and model invocation under strong security and policy enforcement.
  • Agent: A goal-directed AI component that executes within a workflow to perform reasoning, data retrieval, or task decomposition. Agents can access LLMs, evaluate context, and retrieve relevant data using retrieval-augmented generation (RAG). Each agent operates autonomously within guardrails defined by the workflow and access policies, allowing for safe, auditable decision-making over sensitive data.
  • Service: A modular functionality within Opaque that enables secure, low-latency data processing for small, on-demand inputs. Services automate sensitive data handling while ensuring compliance through cryptographic audit trails. Opaque currently offers two services: data ingestion, which securely processes data from REST APIs, and data redaction, which removes or masks personally identifiable information (PII). Additional services, including user-created services, are planned for future releases.

Access and governance

  • Role-based access control (RBAC): A security model that restricts access based on user roles. In Opaque, these roles include:
    • Organization admin: Manages user roles and organization-wide settings.
    • Workspace admin: Creates workspaces, invites members, and manages workspace access.
    • Workspace member: Works within assigned workspaces, provisioning data, running jobs or workflows, and collaborating based on workspace policies.

Security and trust

  • Confidential computing: A security model that protects data even while it’s being processed, using hardware-based environments called trusted execution environments (TEEs). See also trusted execution environments.
  • Confidential AI: An extension of confidential computing that secures entire AI workflows—including data, models, and code—while enabling policy enforcement, collaboration, and verifiable auditability.
  • Trusted execution environment (TEE): A secure, hardware-based enclave that processes encrypted data. TEEs decrypt data only inside the enclave during computation, preventing access by external entities (e.g., cloud providers, administrators, or attackers). Opaque uses TEEs to maintain data privacy throughout computation.
  • Remote attestation: A cryptographic process that verifies a trusted execution environment (TEE) is genuine and running approved code. This allows users to safely share encryption keys and run jobs only in verified, secure environments.