Public processes have the expected read-write access to public filesystems. Private processes, on the other hand, are short-lived processes that have temporary secure storage containers. This storage container is allocated only for the lifetime of a private execution and is accessible only to the private process group it is associated with. Each private process group is bound to a private execution key, or PEK, which is the basis for uniquely identifying a privacy context. This PEK is randomly generated at private process creation, protected by the operating system, never stored in non-volatile memory, and never disclosed to the user or any other process. The PEK is used to encrypt all data produced during a private execution before it is written to persistent storage within the secure container. In this way, PRIVEXEC ensures that sensitive data resulting from private process computation cannot be accessed through the filesystem by any process that does not share the associated privacy context. Furthermore, when a private execution