Data clean rooms using defined access in trusted execution environment

A computer system comprising:

• at least one hardware processor;
• and
• one or more non-transitory computer readable storage media containing instructions that, when executed by the at least one hardware processor, cause the computer system to perform operations comprising:
• creating an application on a data-provider platform, the application comprising one or more application programming interfaces (APIs) corresponding to one or more underlying code blocks;
• sharing provider data with the application on the data-provider platform;
• installing, in a trusted execution environment (TEE), an application instance of the application, the application instance comprising one or more APIs corresponding to the one or more APIs in the application on the data-provider platform;
• sharing consumer data with the application instance from a data-consumer platform;
• invoking one or more of the APIs of the application instance to execute respective associated underlying code blocks on the TEE, the respective associated underlying code blocks not being visible on the TEE;
• and
• saving output of the one or more respective associated underlying code blocks to the data-consumer platform.

One or more non-transitory computer readable storage media containing instructions that, when executed by at least one hardware processor of a computer system, cause the computer system to perform operations comprising:

• creating an application on a data-provider platform, the application comprising one or more application programming interfaces (APIs) corresponding to one or more underlying code blocks;
• sharing provider data with the application on the data-provider platform;
• installing, in a trusted execution environment (TEE), an application instance of the application, the application instance comprising one or more APIs corresponding to the one or more APIs in the application on the data-provider platform;
• sharing consumer data with the application instance from a data-consumer platform;
• invoking one or more of the APIs of the application instance to execute respective associated underlying code blocks on the TEE, the respective associated underlying code blocks not being visible on the TEE;
• and
• saving output of the one or more respective associated underlying code blocks to the data-consumer platform.