# ICP Cloud Engines, explained without the jargon — for builders, in 3 pages **URL:** \ **Category:** Developers\ **Created:** [July 1, 2026, 9:34am UTC](https://forum.dfinity.org/t/icp-cloud-engines-explained-without-the-jargon-for-builders-in-3-pages/73870 "2026-07-01T09:34:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![AliSci](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/alisci/32/33799_2.png) [@AliSci](https://forum.dfinity.org/u/AliSci)\ **Post date:** [July 1, 2026, 9:34am UTC](https://forum.dfinity.org/t/icp-cloud-engines-explained-without-the-jargon-for-builders-in-3-pages/73870/1 "2026-07-01T09:34:56Z")
Coming off Rust backend canisters, I finally got what a “cloud engine” actually is. Wrote it down. What’s inside: 🔒 Privacy AWS can’t touch — encrypted computers where not even the operator can read your data (and you can prove it). 🌍 You choose the country — pin your data to the EU (or anywhere), so compliance is built in, not a promise. 🔓 Zero lock-in — move your app between computers, providers, and countries with no rewrite and no downtime. Plus the 8 things an engine unlocks, ranked — and the stuff that does NOT change (no GPU yet, WASM only, same canister limits). [Download the PDF](https://raw.githubusercontent.com/aliscie2/icp-cloud-engines/main/icp-cloud-engines-guide.pdf) ---
**Author:** ![ZackDS](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/zackds/32/40368_2.png) [@ZackDS](https://forum.dfinity.org/u/ZackDS)\ **Post date:** [July 1, 2026, 9:56am UTC](https://forum.dfinity.org/t/icp-cloud-engines-explained-without-the-jargon-for-builders-in-3-pages/73870/2 "2026-07-01T09:56:27Z")
Did you just ask Ai to do a summary ? Some observations : - No, a standard `t3.medium` instance does not support AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging). The `t3` family relies entirely on the **[AWS Nitro System](https://aws.amazon.com/ec2/nitro/)** for underlying virtualization and does not have the hardware-level SEV isolation enabled. [[1](https://aws.amazon.com/ec2/nitro/), [2](https://docs.aws.amazon.com/ec2/latest/instancetypes/gp.html), [3](https://aws.amazon.com/ec2/nitro/nitro-enclaves/faqs/), [4](https://www.enclaive.io/resources/unveiling-the-future-why-awss-confidential-cloud-with-amd-sev-snp-outshines-amazons-elastic-cloud)] So it is only true if you choose IC nodes that are Gen2 with SEV enabled and as far as I am aware there are none yet. Maybe in the near future. And AWS is as you can see tricky to say the least in order to configure a custom not general instance. \*edit 1 -As it is today : ![image](https://us1.discourse-cdn.com/flex023/uploads/dfn/original/3X/7/3/73cb953f88c78ba58558d955ac0b017c836c6442.png) 1. Again NO. Not yet at least. > [@On another topic](https://forum.dfinity.org/t/66298/190): > > Initially, it is up to the NNS to upgrade cloud engines the same way as normal subnets are upgraded. Later on, upgrades should under the control of the cloud engine owner. This is however not that easy as currently upgrades are only tested/guaranteed for consecutive versions. Hence, if a cloud engine owner would not upgrade for some time and then wants to catch up, they would have to run through many upgrades in a short time. ---
**Author:** ![ZackDS](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/zackds/32/40368_2.png) [@ZackDS](https://forum.dfinity.org/u/ZackDS)\ **Post date:** [July 1, 2026, 9:59am UTC](https://forum.dfinity.org/t/icp-cloud-engines-explained-without-the-jargon-for-builders-in-3-pages/73870/3 "2026-07-01T09:59:29Z")
One may even say that a cloud engine is just a `special` subnet with minimum 4 nodes that can be configured to run with less powerful hardware specs by choice. ---
**Author:** ![AliSci](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/alisci/32/33799_2.png) [@AliSci](https://forum.dfinity.org/u/AliSci)\ **Post date:** [July 1, 2026, 10:25am UTC](https://forum.dfinity.org/t/icp-cloud-engines-explained-without-the-jargon-for-builders-in-3-pages/73870/4 "2026-07-01T10:25:59Z")
Updated the ICP Cloud Engines guide — corrected two things the forum flagged: 1. SEV (encrypted nodes): moved from “live” to roadmap — there are 0 SEV nodes available today. 2. Owner-controlled upgrades: also roadmap — today the NNS still upgrades engines like any subnet. Now split into “real today” (sovereignty, single-tenant, no lock-in, hardware/size choice, flat cost) vs “coming” (SEV, owner-upgrades, GPU). PDF + README updated, same link: ---
**Author:** ![Benny1](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/benny1/32/37591_2.png) [@Benny1](https://forum.dfinity.org/u/Benny1)\ **Post date:** [July 2, 2026, 4:49pm UTC](https://forum.dfinity.org/t/icp-cloud-engines-explained-without-the-jargon-for-builders-in-3-pages/73870/9 "2026-07-02T16:49:50Z")
What about your mums??