Collaboard uses Constellation to safely host sensitive data on public clouds

Hosting Collaboard on public clouds and offering it as software-as-a-service (SaaS) has many benefits, including easier customer onboarding, simplified scaling, and seamless maintenance. However, some Collaboard customers, including a large German public sector organization, have very strict security and data privacy requirements that prohibit the use of public clouds like Azure, AWS, or Google Cloud. The question was: Is there a secure way to run Collaboard on hyperscalers while guaranteeing that hackers in the infrastructure and compromised or rogue cloud admins cannot access any data?

The Collaboard team identified confidential computing (CC) as a possible solution to this problem. With CC, data stays encrypted throughout its lifecycle: at rest, in transit, and in use. The technology makes it possible to isolate workloads from the underlying infrastructure, making public clouds as secure as on-prem.

To take advantage of these benefits, Collaboard created a confidential setup for their public sector customer. Their approach combined Microsoft Azure's confidential virtual machines with Constellation, the world’s first always-encrypted Kubernetes. Constellation allowed the Collaboard engineering team to implement end-to-end confidentiality, including network, storage and key management, while having a normal Kubernetes experience and keeping the containerized application as it was. The end users themselves reported no change or slowdown in the application's performance

Running Collaboard with Constellation on Azure was a win for Collaboard. The integration was easy, enabling real-time collaboration between the customer’s teams. With the flexibility to spin up the application in different environments and a consistent user experience, Collaboard was able to deliver a secure product that increases the working efficiency for the most security-conscious organizations.