An apparatus comprising: a decoder to decode a plurality of instructions including instructions related to a trusted domain; execution circuitry to execute a first one or more of the instructions to establish a first trusted domain using a first trusted domain key, the trusted domain key to be used to encrypt memory pages within the first trusted domain; and the execution circuitry to execute a second one or more of the instructions to associate a first process address space identifier, PASID, with the first trusted domain, the first PASID to uniquely identify a first execution context associated with the first trusted domain, the apparatus further comprising: address translation circuitry configured to use the PASID to identify a first set of one or more translation tables to translate a guest virtual address to a guest physical address; and the address translation circuitry is further configured to use a first trusted domain identifier uniquely identifying the first trusted domain to identify a second set of one or more translation tables to translate the guest physical address to a host physical address within the first trusted domain, characterised in that the second set of translation tables comprises a secure extended page table, SEPT, used to perform translation of the guest physical address to the host physical address for private pages only, the private pages being encrypted and integrity protected with a private key of the first trusted domain, the guest physical address comprising a bit indicating to perform the translation for private pages using the SEPT. a decoder to decode a plurality of instructions including instructions related to a trusted domain; execution circuitry to execute a first one or more of the instructions to establish a first trusted domain using a first trusted domain key, the trusted domain key to be used to encrypt memory pages within the first trusted domain; and the execution circuitry to execute a second one or more of the instructions to associate a first process address space identifier, PASID, with the first trusted domain, the first PASID to uniquely identify a first execution context associated with the first trusted domain, the apparatus further comprising: address translation circuitry configured to use the PASID to identify a first set of one or more translation tables to translate a guest virtual address to a guest physical address; and the address translation circuitry is further configured to use a first trusted domain identifier uniquely identifying the first trusted domain to identify a second set of one or more translation tables to translate the guest physical address to a host physical address within the first trusted domain, characterised in that the second set of translation tables comprises a secure extended page table, SEPT, used to perform translation of the guest physical address to the host physical address for private pages only, the private pages being encrypted and integrity protected with a private key of the first trusted domain, the guest physical address comprising a bit indicating to perform the translation for private pages using the SEPT. address translation circuitry configured to use the PASID to identify a first set of one or more translation tables to translate a guest virtual address to a guest physical address; and the address translation circuitry is further configured to use a first trusted domain identifier uniquely identifying the first trusted domain to identify a second set of one or more translation tables to translate the guest physical address to a host physical address within the first trusted domain, characterised in that the second set of translation tables comprises a secure extended page table, SEPT, used to perform translation of the guest physical address to the host physical address for private pages only, the private pages being encrypted and integrity protected with a private key of the first trusted domain, the guest physical address comprising a bit indicating to perform the translation for private pages using the SEPT.