Run private AI on GPUs you don't own.

NVIDIA confidential computing on H100, H200 and Blackwell. Your model runs inside a hardware-sealed enclave, and the company that owns the server sees encrypted traffic and an attestation record. It does not see your prompts, the answers or the weights.

Ask for a quote Talk to an engineer

Have your own GPUs? The same service runs inside your network.

Type a prompt. See who can read it.

The same request, seen from both ends. You get a plain answer. The company that owns the GPU sees encrypted memory traffic and an attestation record, and nothing it can read.

Your view

Sample

> Summarise the open claims for policy 4471-B

Sample response. This page runs no model, so this is a canned reply. In production your model answers inside the sealed enclave, and the reply is readable only at your end of the encrypted session.

Plain text, at your endpoint only.

Attestation

Demo

CPU TEE report verifiedPass
GPU in confidential-computing modePass
GPU attestation report signed by NVIDIAPass
Driver and firmware measurements matchPass
CPU to GPU transfers encryptedPass
Keys released to the enclave onlyPass

6 of 6 checks passed

Hardware owner's view

Sample

0000 99 f5 0c 53 f4 fa d5 2d 32 05 e3 7d

000c 1d 32 83 77 31 0a 41 5e 59 a1 d1 1a

0018 a5 5b b7 64 31 bb 8e 8d fd ff f2 e6

0024 d0 f1 95 47 29 5f 46 59 a2 eb 69 c5

0030 cb e7 e3 54 64 72 77 dc 44 e9 f5 f6

003c oZbI6W7n5cwSkY7V

0048 71 d7 4a c7 b5 07 f6 43 fc a1 ff 61

0054 03 4e 4f 8b 2a 36 20 c5 c3 3d 21 fd

0060 78 fa 7a dc 1a 97 f4 88 48 85 2c 26

006c e5 b7 97 7c 1d 25 e7 ee 33 20 b8 02

0078 ce d3 30 1f 08 29 90 34 5c 41 cb fa

0084 IwD4eTAtXMMHNYY6

0090 6f b3 64 9d d0 f2 32 3c 1f 6e 01 30

009c cf fb 35 41 f5 07 d1 a8 df 41 33 80

00a8 67 90 f4 92 ec 48 48 b3 ac 66 8d af

00b4 6d d4 3b b5 59 7f 82 1b db be eb 94

00c0 d3 d1 2f e4 d3 9d e3 f9 ff 42 0d 12

00cc ZUE0W6iuJbdWqdSa

00d8 09 76 90 cf 54 c7 b2 21 90 78 a0 c7

00e4 48 69 55 5d 69 66 77 24 fc eb d4 68

00f0 5d 17 3e 3e e8 c2 a0 bf c0 ae d0 e2

00fc b0 c5 6b a4 c7 8f 34 43 e5 ae e9 51

0108 e6 d2 71 6d 55 70 5e 67 7b ae db 84

0114 UNkBOXwOyIaGShuc

0000 99 f5 0c 53 f4 fa d5 2d 32 05 e3 7d

000c 1d 32 83 77 31 0a 41 5e 59 a1 d1 1a

0018 a5 5b b7 64 31 bb 8e 8d fd ff f2 e6

0024 d0 f1 95 47 29 5f 46 59 a2 eb 69 c5

0030 cb e7 e3 54 64 72 77 dc 44 e9 f5 f6

003c oZbI6W7n5cwSkY7V

0048 71 d7 4a c7 b5 07 f6 43 fc a1 ff 61

0054 03 4e 4f 8b 2a 36 20 c5 c3 3d 21 fd

0060 78 fa 7a dc 1a 97 f4 88 48 85 2c 26

006c e5 b7 97 7c 1d 25 e7 ee 33 20 b8 02

0078 ce d3 30 1f 08 29 90 34 5c 41 cb fa

0084 IwD4eTAtXMMHNYY6

0090 6f b3 64 9d d0 f2 32 3c 1f 6e 01 30

009c cf fb 35 41 f5 07 d1 a8 df 41 33 80

00a8 67 90 f4 92 ec 48 48 b3 ac 66 8d af

00b4 6d d4 3b b5 59 7f 82 1b db be eb 94

00c0 d3 d1 2f e4 d3 9d e3 f9 ff 42 0d 12

00cc ZUE0W6iuJbdWqdSa

00d8 09 76 90 cf 54 c7 b2 21 90 78 a0 c7

00e4 48 69 55 5d 69 66 77 24 fc eb d4 68

00f0 5d 17 3e 3e e8 c2 a0 bf c0 ae d0 e2

00fc b0 c5 6b a4 c7 8f 34 43 e5 ae e9 51

0108 e6 d2 71 6d 55 70 5e 67 7b ae db 84

0114 UNkBOXwOyIaGShuc

Unreadable encrypted bytes. The hardware owner cannot see your prompt or the answer.

Readable by the host: nothing above.

Illustration only. No model runs on this page and nothing leaves your browser. The bytes on the right are a SHA-256 stream of your prompt, so they change with every keystroke, the way real ciphertext would.

What the hardware owner can and cannot see.

Confidential computing changes whom you have to trust. You trust the CPU and GPU hardware, and the attestation that proves it was switched on. You no longer have to trust the company that owns the server, its administrators or its hypervisor.

The host cannot see

Your prompts and the answers. They are decrypted only inside the enclave and at your endpoint.
Your model weights and fine-tunes. They load into the GPU’s protected memory region, which the host cannot read.
The memory of the confidential VM. The CPU’s trusted execution environment encrypts it, so the hypervisor sees ciphertext.
The session keys. They are released to the enclave only after attestation passes.

The host can still see

That a workload is running. Power draw, GPU utilisation and uptime stay visible to the operator.
The shape of the traffic. The size and timing of encrypted requests, and how many arrive.
The attestation record. The signed proof that the enclave was sealed when it started.
Whether the server stays on. Confidential computing protects confidentiality, not availability. The owner can still switch it off.

Out of scope: physical attacks on the GPU package, side channels beyond the vendors’ published mitigations, and flaws in your own application code. This is a threat model, not a promise that nothing can ever be broken. Ask an engineer to walk your security team through it for your deployment.

The parts that make it work

GPUs: NVIDIA H100, H200 and Blackwell, running in confidential-computing mode.
GPU memory: Your data and weights sit in a protected VRAM region that hardware firewalls close to the host CPU and to other GPUs. Everything crossing PCIe between the CPU and the GPU is encrypted with AES-GCM.
CPU TEE: The confidential VM runs in a CPU trusted execution environment, AMD SEV-SNP or Intel TDX, which encrypts its memory.
Attestation: The CPU and the GPU each sign a report of their firmware and mode. Both are checked against the vendors’ certificates before any key or data is released.

Confidential compute

By quote

Each confidential deployment is priced on four things:

The GPU generation and how many you need.
Where the hardware runs: a cloud’s confidential VMs, a colocation host or a partner’s rack.
The model, its size and the traffic it serves.
The attestation policy your security team signs off.

Ask for a quote

Have your own GPUs?

The same service runs inside your network, on hardware you control. No enclave is needed when nobody else holds the server.

How an on-prem deployment works

Pilot: $4,900
Production deployment: from $25,000
Managed ops: from $1,500

All prices

Tell us whose GPUs.

Tell us the model, the data and where the hardware is: a cloud, a colocation host or a partner’s rack. An engineer from Limassol or Auckland replies with a confidential-compute plan and a quote.

Ask for a quote Talk to an engineer

limassol.officeLocal time

Limassol HQ

Cyprus, 24/7

+357 25 123877

auckland.officeLocal time

Auckland

New Zealand, 24/7

+64 9 887 9088