SEV-SNP on ICP: Is canister state now confidential?

Developers
1

I’m trying to understand the current security model for production application subnets.

Should canister state still be considered readable by a malicious node provider, or does confidential execution / SEV-SNP now protect canister memory on production subnets?

The reason I’m asking is that I’m evaluating whether storing sensitive application state in canister memory is considered safe today, or whether developers should still assume that node providers may inspect canister state.

2

The SEV subnets should be secure from inspection, but others are not.

3

Thanks, that helps.

How can a developer verify whether their canister is running on an SEV/confidential subnet?

And can existing canisters be migrated to such a subnet, or do they need to be deployed there from the start?