How VAST and NVIDIA are using confidential computing to let proprietary models and regulated enterprise data meet on infrastructure that neither side has to trust
The standoff DataEnclave is built to break: sensitive data that can’t move, and model weights that can’t be exposed.
For the last two years, enterprise AI has quietly run on whatever data happened to be portable: public documents, sanitized samples, anything that could safely leave the building. The datasets that would actually move the needle (account-level fraud histories at a bank, unredacted patient records at a hospital, classified intelligence at a government agency) have sat untouched, because moving them to a model, or a model to them, has never been something either side could trust.
On September 22, VAST Data announced DataEnclave, a confidential AI capability built into the VAST AI Operating System in partnership with NVIDIA. It targets a specific standoff: enterprises won’t send sensitive data to a model they don’t control, and model providers won’t send weights to infrastructure they don’t control. As long as that holds, the applications that need both never get built.
Two parties, two things nobody wants to expose
The problem has a symmetry to it. If an enterprise runs a model on its own hardware, it becomes the infrastructure operator, and the model provider needs protection from that enterprise’s administrators, who could otherwise read the weights straight out of GPU memory and stand the model up somewhere else. If an AI cloud or a sovereign infrastructure provider hosts the model instead, that third party becomes the infrastructure operator, and now both the enterprise and the model provider need protection from it.
VAST co-founder Jeff Denworth put the stakes for model builders plainly: “Model weights are fast becoming the most valuable intellectual property in the world. Base weights define the value of frontier models, while fine-tuned weights will increasingly represent the proprietary intelligence of AI-driven enterprises.”
On the enterprise side, the calculus is regulatory as much as competitive. Banks, healthcare providers, government agencies and pharmaceutical companies routinely hold data that was never designed to touch the public cloud. VAST’s Phil Manez frames it as an opportunity cost that’s become impossible to ignore: “We’re at the point now where the opportunity cost of not having these advanced AI models access that data is coming to a head.”
From confidential CPUs to a confidential AI system
Confidential computing itself isn’t new. Hardware-based confidential computing has been evolving for years, with technologies such as AMD SEV-SNP and Intel TDX extending memory encryption and trusted execution to modern virtualized CPU workloads, shielding them from the host operating system, the hypervisor and administrators with root access. What’s been missing is the GPU half of the equation. Training and inference need model weights, prompts and intermediate results sitting unencrypted in GPU memory while the work happens, and CPU memory encryption alone can’t build a confidential boundary around an accelerated workload.
NVIDIA Confidential Computing, which now spans the Hopper, Blackwell and Rubin generations, closes that gap by protecting GPU memory and the traffic between CPU and GPU, and on newer platforms, encrypted NVLink protects the links between GPUs too. DataEnclave uses these capabilities to build confidential virtual machines that span both CPUs and GPUs, so the host operating system, the hypervisor, the administrators of the machine and any other tenant sharing the hardware can’t reach a workload’s unencrypted contents.
Isolation alone isn’t enough, though. Turning that hardware boundary into something a model provider or an enterprise can actually rely on means proving what’s running before anything is decrypted, and giving the data owner control over which environments ever receive its keys.
Verify before you decrypt
The attestation and key-release sequence DataEnclave runs before any workload is allowed to see decrypted data.
This is the mechanism VAST calls verify-before-decrypt attestation, and it’s the part that does the actual trust-building. A confidential workload’s CVM boots with no keys or credentials at all. To get them, it asks its hardware root of trust for cryptographic evidence describing exactly what it’s running: the hardware and firmware underneath it, the software it booted, and the restrictions placed on what the host server is allowed to do inside it. The CPU and GPU sign that evidence with keys that never leave the hardware, so nobody on the host side, including its own administrators, can forge it.
That evidence goes to an attestation server that belongs to the data owner, not the infrastructure operator, and gets checked against that owner’s security policies. A model provider might, for example, prohibit the host from running any commands inside the CVM at all: a restriction that’s enforced inside the CVM itself and recorded in the signed evidence, so the infrastructure operator can’t quietly loosen it without the CVM failing verification. Only when the evidence clears the policy are the keys released, and they’re encrypted so they can only be decrypted inside that specific CVM’s protected memory.
This isn’t a one-time check performed at deployment and then forgotten. Attestation happens every time a workload launches, including every new replica, and again whenever a running workload needs another key, with no cooperation from the infrastructure operator required. If a model provider’s license with an enterprise lapses, the provider revokes that deployment’s entitlement on its own attestation server, so any subsequent attestation or protected-resource request fails, blocking new workloads and any replica that comes back for another key. A workload that already holds a key it fetched before revocation doesn’t lose it automatically; enforcing an immediate cutoff requires the workload itself to re-attest periodically rather than relying on a single check at launch.
NVIDIA’s Justin Boitano, VP of Enterprise AI, described what this unlocks for the industry as a whole: “Enterprise data is essential to accurate, usable AI, and keeping business data confidential is critical to protecting IP in the age of agents. VAST Data’s integration of NVIDIA Confidential Computing delivers protection for both enterprises and model builders, providing security, identity, permissions, governance and compliance as a foundation of the agent architecture.”
Six capabilities that make it work
Underneath the architecture, DataEnclave ships as six concrete capabilities that map directly onto the trust problem above: hardware isolation that encrypts memory and NVLink traffic; attestation that verifies before it decrypts; independent key control so each party keeps its own KMS; support for connected or fully air-gapped deployment; a governed, auditable record of everything that ran; and secure sandboxes that extend the same isolation to autonomous AI agents through VAST AgentEngine.
Who sees what, exactly
Being precise about what each party can and can’t see once a confidential workload is running matters, because that precision is the entire point of the architecture. Take a bank running a proprietary frontier model against its own fraud data as the working example: the bank is both the enterprise and the infrastructure operator, and the model provider is a separate trust domain entirely.
| The enterprise | The model provider | The infrastructure operator | |
| Model weights | No, decrypted only inside the CVM’s protected memory | Yes, it owns them | No, decrypted only inside the CVM’s protected memory |
| Enterprise data | Yes, it owns the data | No direct access. The model processes the prompt inside the CVM, but the provider gets no plaintext view of it | Not through the CVM; protected by AI OS multitenancy |
| Prompts & responses | Yes | No, processed in the CVM with no path back to the provider | No |
The model itself never goes looking for the bank’s records. A retrieval application outside the enclave, something like VAST InsightEngine, searches the bank’s internal documents, assembles the relevant excerpts into a prompt, and sends only that prompt to the model’s inference API. Search and prompt assembly both happen on the bank’s own systems, so the prompt is the only bank data the model ever sees, and the bank’s existing egress controls determine where the enclave can send anything at all.
One caveat is worth stating clearly. These protections cover confidentiality and integrity while data is being processed, not availability. An infrastructure operator can always decline to run a workload, or stop one that’s already running. DataEnclave governs what happens inside a CVM once it’s running; the developers of the workloads inside it remain responsible for what enters and leaves through their own APIs.
An audit trail neither side has to take on faith
Production deployments of confidential AI need a record of what ran and under what rules, and the architecture can maintain independent audit trails across the infrastructure and attestation domains, so each party retains evidence of the actions for which it’s responsible rather than having to trust the other’s account of events. On the infrastructure operator’s side, the DataEnclave Runtime logs the lifecycle of every confidential workload to the VAST DataBase: which application and version launched, from which CVM image, on which node, at what time, under which configuration. Because those logs identify what ran without capturing the data it processed, security and compliance teams can query them without ever exposing the models or data inside the CVMs.
On the data owner’s side, any attestation server tracks which CVMs it verified and which keys it released. With VAST’s own DataEnclave attestation server, deployed as a VAST Application, that evidence, the policy it was checked against, and the full history of policy changes are also stored in a VAST DataBase and queryable with the same tooling; teams using Trustee or Fortanix instead would look to those systems for the equivalent record. “You have to have a way to validate that the model is running in a secure environment before it’s allowed to run – that’s the attestation part,” Manez said. “Only when you’ve proven you’re in that secure environment do you get the keys to unlock that proprietary information. Then you have the audit trail that proves when this model was decrypted and how it was used.”
Deployment flexibility, and an emerging ecosystem
DataEnclave runs the same runtime and attestation model in a customer data center, an AI cloud, or a fully air-gapped facility.
DataEnclave’s attestation services run on the open CNCF Trustee stack, or through a partnership with Fortanix for organizations that want a managed Confidential AI offering. For fully air-gapped sites, both the attestation server and key management system can run entirely on-premises, alongside the workloads they verify. That matters for the most locked-down customers VAST is chasing first: large banks, intelligence and defense agencies, and pharmaceutical companies. “In all three cases, they have said that this solves major pains for them in that they’re not allowed to send certain data products up to different services that they want to use,” Denworth said. “It’s basically the most regulated and air-gapped customers of the world.” VAST is also aligning its runtime with Kata Containers, the open-source confidential-computing runtime backed by Microsoft and Red Hat, rather than betting early on a single standard.
Initial model and software partners include Cohere, CrowdStrike, Deepgram, Factory, Fundamental Research Labs and TwelveLabs, alongside NVIDIA itself. Cohere’s Frank O’Dowd summed up the customer pull: “Customers around the world are asking for AI that is encrypted end-to-end, not just at rest but in motion and during inference.” CrowdStrike’s Bartley Richardson made a similar point about its SafeMind models: defenders in regulated industries want to run them against their most sensitive data, inside their own boundaries, while keeping control of both. Hardware partners include Cisco and Supermicro, with more OEMs expected as the ecosystem matures.
A separate group of AI cloud providers (Buzz, Nscale and Sharon AI) are lining up as launch partners on the infrastructure side, offering DataEnclave-attested capacity to customers who want the confidentiality guarantees without building and operating the GPU environment themselves. Sharon AI CEO James Manning framed the appeal in sovereignty terms: “Building on our sovereign data foundation with VAST, DataEnclave lets us host those models onshore, inside attested environments where the model owner’s weights and the customer’s data are both protected from everyone, including us.”
The DataEnclave ecosystem at launch: model and software partners, hardware OEMs, AI cloud partners, and attestation/key-management providers.
Confidential computing does introduce some compute overhead, though how much depends heavily on the workload, the GPU generation and how much data moves between CPU and GPU. Coverage of the launch has floated a single-digit to low-double-digit percentage range, but VAST itself hasn’t published DataEnclave benchmarks, so the real number is worth confirming once production configurations are available rather than taking on faith.
A few other things aren’t public yet either: detailed commercial and support terms, a full list of supported key-management systems, and an independent security review or penetration-test report for the attestation stack. None of that is unusual for a product still in preview, but it means those pieces currently rest on VAST’s own account rather than outside verification.
Why this matters beyond any one deployment
The most interesting claim VAST is making isn’t really about any single bank or hospital deployment. It’s that model portability determines a model provider’s addressable market before anyone even evaluates the model itself. A model that only runs inside its own provider’s cloud can only sell to buyers who are free to put their data there, which can exclude workloads subject to government classification requirements, data-sovereignty rules, or the stricter end of healthcare and financial-services controls, before the sales conversation even starts. “If you can only run in the public cloud, your sales roster is heavy on consumer and non-regulated industries,” Manez said.
VAST’s own framing for where this leads is bigger than confidential computing as a feature. CEO Renen Hallak described it as a shift in what an AI operating system has to manage:
“Models are becoming a resource the operating system has to manage, the same way it manages data. That means knowing which model fits which task, what it can see, who can use it and under what rules, and doing all of that inside the same security and operational boundaries an enterprise applies to everything else. Bringing leading AI models securely to the world’s most sensitive data is where this starts. Where it leads is a world where every organization is managing an ecosystem of fine-tuned models that represent its true intellectual property.” (Renen Hallak, CEO, VAST Data)
That’s consistent with how VAST is positioning DataEnclave commercially: it isn’t a separate SKU. “We don’t charge anything extra for this,” Denworth told SiliconANGLE. “It’s just part of the AI operating system stack.”
What’s still ahead
DataEnclave is in preview now and is scheduled to ship in Q1 2027 through VAST and participating OEM partners, including Cisco and Supermicro. The bigger test won’t simply be the engineering: it’s whether enough model providers, enterprises and infrastructure operators are willing to build on a shared trust architecture instead of the bilateral contracts that have governed this relationship until now. Contracts only offer recourse after weights have already leaked or data has already been misused. What DataEnclave is attempting is to make unauthorized exposure far harder in the first place, by replacing organizational trust with hardware-enforced isolation, cryptographic attestation and owner-controlled key release. Nothing decrypts until a service the data owner controls has verified, with hardware-signed evidence the operator cannot forge, exactly what it’s about to run. That’s a materially higher bar than a contract, though it isn’t a guarantee against every threat: attestation proves what environment a workload is running in, not that the workload or the hardware beneath it is free of vulnerabilities.
Whether that’s enough to get the frontier labs themselves, rather than the mid-size and specialized model builders currently on board, to trust infrastructure they don’t operate is the open question. But for the regulated industries VAST is targeting first, the calculus Manez describes is straightforward: without an operating model that satisfies enterprise requirements, AI risks staying a hype bubble for exactly the datasets that matter most. “It’s the entire infrastructure and ecosystem around the model,” he said. “There’s way more to it than a VM technology or a data encryption technology or a network technology.”
Sources: SiliconANGLE, AI Magazine, Blocks & Files, HPCwire/BigDATAwire, VentureBeat, Techzine, ComputerWeekly, ITBrief Asia, and VAST Data’s own DataEnclave announcement and product page.
Watch
Five short videos from VAST Data’s own channel on DataEnclave and confidential AI