1. A method performed by a computer system, wherein the computer system executes a hypervisor, the method comprising: receiving by the hypervisor, from a guest operating system hosted by a first virtual machine, a message that identifies a memory location for a secure datum; receiving, by the hypervisor, a direct-copy command to clone the first virtual machine; and in response to the direct-copy command, creating, by the hypervisor, a second virtual machine via direct copy of the first virtual machine, wherein the second virtual machine is not provided access to the memory location during the creating of the second virtual machine.