Subscribe on AWS Marketplace, install the Enigmata Cipher SDK, encrypt every training and inference call without changing your model.
Enigmata Cipher Secure Mode for SageMaker ships as two AWS Marketplace listings (a Processing Algorithm and an Inference Model Package) plus a free Python SDK. Customer-managed AWS KMS holds every key; our network-isolated containers never call out. Encrypted data preserves equality, order, and cosine similarity, so downstream models keep their accuracy. Your plaintext never needs to leave your premises. Run Enigmata Cipher’s signed confidential-VM image on-prem to encrypt your data, and upload only ciphertext to S3. AWS sees ciphertext, never plaintext.
Accuracy difference between plaintext and encrypted training on the published vector ML benchmark (binary classification on Gaussian-clustered embeddings).
Outbound network calls from the Marketplace containers; both run with EnableNetworkIsolation=True.
Vector payload compression at the default token length (a 1536-dim f32 embedding becomes a 256-bit token, 32 bytes on the wire).
Lines of Python to bind a SageMaker pipeline to a customer-managed KMS key.
What this unlocks for you
Encrypted training, intact accuracy
Run XGBoost, scikit-learn, PyTorch, or your own algorithm on Enigmata Cipher-encrypted columns and keep your model quality. Equality, order, and cosine similarity all survive encryption.
Encrypted inference, no rewrites
Wrap your existing sagemaker.Model and the endpoint encrypts requests before your model ever sees them. Same code path for training and inference.
Customer-owned keys, end-to-end
Your KMS CMK gates every encryption context. We never see key material; the seed exists only inside your SageMaker container.
One subscribe, every pipeline
Both the Processing Algorithm and the Inference Model Package install via standard AWS Marketplace subscription. No vendor IAM role assumed in your account.
Three pillars, preserved
Text: equality preserved
Joins, group-by, and exact-match lookups work directly on encrypted values. Identical plaintext always produces the same encrypted token.
Numeric: order preserved
Sorts, range filters, percentiles, and tree-model splits work on encrypted numbers. Magnitude is hidden; ordering survives.
Vector: cosine similarity preserved
RAG and k-NN retrieval rank encrypted embeddings the same way they’d rank plaintext, with an estimator error that shrinks as token length grows.
How customers install it
Subscribe to Enigmata Cipher Encryption (Processing) and Enigmata Cipher Encryption (Inference) in the AWS Region you train and serve from.
Install the Enigmata Cipher SDK in your SageMaker notebook or Pipelines repo.
Bind a KMS key and a column schema to a key context with the Enigmata Cipher SDK, pointing it at your KMS key ARN and an S3 artifact location. On-prem: the signed Enigmata Cipher confidential-VM image attests to your KMS and persists the wrapped manifest to your S3 bucket so SageMaker can read it. In-AWS alternative: the SDK calls KMS from your SageMaker notebook, HKDF-derives a seed, and persists the same wrapped manifest to your S3 bucket with SSE-KMS.
On-prem: run the confidential-VM image against your source data and write ciphertext directly to S3. SageMaker training and inference consume it exactly as if it had been written by the in-AWS path. In-AWS alternative: add the Enigmata Cipher SDK's processing step to your pipeline for training-time encryption, or wrap your existing model with the SDK before you deploy it for inference-time encryption. No other changes.
Where it fits
Best fit: existing SageMaker customers who need to encrypt training data, inference inputs, or both, and who can’t afford a measurable accuracy hit or a model rewrite.
Financial Services
Fraud and credit-risk models on PII-laden customer records, encrypted before they enter the training job and at every inference call.
Healthcare
Clinical embeddings and tabular ePHI feed prediction models without leaving the protected representation; recovery requires the customer’s KMS key.
Legal
Contract-clause classifiers and retrieval models that run on encrypted excerpts. Your firm’s documents never enter a vendor model in plaintext.
Regulated Telecom + Energy
Subscriber and grid-operations models trained on data with strict data-residency obligations; encryption stays inside the customer’s region and account.
How it compares
The honest framing of every other option.
| Approach | What you get |
|---|---|
| Tokenization vaults (Skyflow, Protegrity) | A SaaS API you call from your training and inference code. Adds a network hop on every call, and the vault has to be available for your model to work. |
| Database-side encryption (Baffle, Vault Transit) | Protects data at rest in RDS or Postgres but not inside SageMaker compute. Your training job still sees plaintext. |
| Synthetic training data | Avoids the encryption problem by avoiding the real data. Models drift from production behavior and inference still needs the real values. |
| FHE / MPC research stacks | Strong privacy guarantees, but every model has to be ported to a restricted circuit and inference latency goes up by orders of magnitude. |
| Enigmata Cipher | A SageMaker-native artifact: subscribe on Marketplace, install a pip package, keep your model. Determinism is the feature, not the bug. |
Key capabilities
- Drop-in for any existing SageMaker Pipeline. No model rewrite, no data migration.
- Customer-managed AWS KMS; the seed is HKDF-derived and never extracted from the customer’s compute.
- Native AWS Marketplace listings (Algorithm + Model Package); install with a single subscribe and the Enigmata Cipher SDK.
- Three pillars preserved: equality for joins and group-by, order for sort and ranges, cosine similarity for retrieval and k-NN.
- Network-isolated containers; zero outbound calls, no third-party telemetry, no key custody on our side.
- Per-row marketplace metering on inference so batch invocations bill fairly.
Technical detail
What the two Marketplace containers actually do.
The signed Enigmata Cipher confidential-VM image reads your plaintext from on-prem storage, applies a column-level schema, and writes ciphertext to your S3 bucket. Plaintext never leaves your facility, and SageMaker training reads ciphertext from S3. Encrypted columns become Utf8 strings; vector columns become JSON-encoded vector tokens with the underlying bits exposed for ML feature extraction; passthrough columns keep their original Arrow type. As an in-AWS alternative, the Processing Algorithm container reads a CSV or Parquet dataset from your S3 input channel, applies the same column-level schema, and writes an encrypted copy to your S3 output channel; both paths produce identical ciphertext. The Inference Model Package is an axum-based HTTP server that fronts your model in a SageMaker inference pipeline: /invocations accepts the same record shape your model already expects, encrypts schema-declared columns in place, and forwards the result to the next container. Both the on-prem image and the in-AWS containers consume the same seed and schema files that the Enigmata Cipher SDK writes to your S3 bucket; the SDK is the only thing that ever calls KMS.
- Processing Algorithm container: CSV + Parquet input/output, batch size 2,048 rows, deterministic across invocations under the same seed.
- Inference Model Package container: axum HTTP server on port 8080, /ping + /invocations, per-row metering header on every response.
- A shared Rust core drives column-by-column encryption from a schema that round-trips with the Python SDK byte-for-byte.
- Encrypted vector cells round-trip as self-describing JSON tokens that carry the encrypted bits, their length, and a context fingerprint, with the bits ready for SimHash feature unpacking in any ML framework.
- The Python SDK exposes both server-side (processing-step and model-wrapping) and client-side (in-process encryption) paths from the same key context, so your training and inference code see the same token shape either way.
What it needs
An AWS account with SageMaker, KMS, and S3. The container runs with EnableNetworkIsolation=True (an AWS Marketplace requirement), so no outbound network is needed.
Who holds the key
Run encryption on-prem and the customer’s KMS releases the seed only to an attested, unmodified Enigmata Cipher confidential-VM image. Plaintext never leaves the customer’s facility and the seed never reaches AWS. Run encryption in AWS as the alternative and the customer’s KMS CMK never leaves AWS KMS: Enigmata Cipher’s deterministic seed is HKDF-derived from a one-shot KMS data key, AEAD-wrapped under the same CMK, and stored in the customer’s S3 bucket with SSE-KMS. SageMaker downloads the seed via the customer’s execution role; the network-isolated container could not exfiltrate if compromised.
How it’s billed
AWS Marketplace billing. Processing Algorithm: hourly per instance with a 14-day free trial. Inference Model Package: per-inference, metered with the X-Amzn-Inference-Metering header so a batch invocation counts as N units. EC2, KMS, and S3 charges remain on the customer’s AWS bill.
The offer
Prove it in 60 days.
Prove it in 60 days. Bring the SageMaker pipeline you can’t migrate because legal won’t let the training data out of your VPC. We’ll wire Enigmata Cipher in front of your existing model, run a parity benchmark against your plaintext baseline, and ship the CISO + procurement dossier needed to operate it in production.
- Encryption-parity benchmarkSide-by-side accuracy comparison of the customer’s plaintext baseline vs. Enigmata Cipher-encrypted training on the same dataset.
- Key-custody attestationDiagram + IAM policy walk-through showing the CMK never leaves AWS KMS and the seed never leaves the customer’s compute.
- Marketplace + network-isolation evidenceListing screenshots, container scan results, and a SageMaker job log proving EnableNetworkIsolation=True throughout.
- CISO + procurement dossierVendor-handling delta, data-flow diagram, and incident-response playbook tailored to the customer’s AWS account topology.