The isolation comes from NVIDIA and open-source projects. VAST is betting that an operated control plane around them is what gets model owners to ship weights.
VAST Data previewed DataEnclave on September 22, 2026. Built into the company's DataEngine, it is meant to let a model provider run closed weights on a customer's GPUs without the customer being able to read them, while the customer feeds that model regulated data that never leaves its building. The launch press release says it ships in the first quarter of 2027 through VAST and OEM partners including Cisco and Supermicro.
The problem VAST describes runs both ways. A bank or a defense ministry can't send sensitive records to a hosted inference API, and a model builder won't install its weights on servers whose administrators could copy them. VAST's technical white paper says the two usually never meet, leaving the enterprise with a less capable open model. VAST also estimates, citing no outside source, that roughly half the world's data sits on premises or in colocation.
Most of DataEnclave's security machinery already exists, built by NVIDIA, Intel, AMD and the open-source Confidential Containers community. VAST adds an operated home for it on storage clusters its customers already run, plus a roster of model partners willing to use it. The company is betting that the operated part, more than any new cryptography, is what model owners have been missing.
Confidential computing uses processor hardware to wall off a virtual machine's memory from the host running it, hypervisor included, and lets the hardware sign a report of what is running inside. DataEnclave's confidential virtual machines (CVMs) span a CPU trusted execution environment, Intel TDX or AMD SEV-SNP per the launch blog, and NVIDIA GPUs in Confidential Computing mode; co-founder Jeff Denworth adds NVIDIA's Vera CPU in the launch video.
Nothing sensitive enters a CVM until it proves itself. The white paper's sequence follows the IETF's remote-attestation architecture, RFC 9334: the CVM requests a nonce, generates a key pair whose private half never leaves it, and has the CPU and GPU sign evidence binding its measurements, the nonce, and the public key. An attestation server run by the asset owner checks that evidence against approved reference values and, on a match, issues a five-minute token and releases keys encrypted to the CVM's public key. Except in VAST's turnkey air-gapped appliances, the owner brings its own key manager, typically over KMIP.
In the white paper's worked example, the model ships as an encrypted container image in a VAST Artifact Registry on the customer's cluster. After attestation, one released key decrypts the image and a second decrypts the weights; the customer then reaches the model only through its REST API. Scratch state such as KV caches (stored attention results that spare a model from recomputing earlier tokens) sits on encrypted volumes whose keys die with the container or stay with the model owner.
GPU confidential computing dates to NVIDIA's Hopper generation, and Microsoft Azure made H100 confidential VMs generally available in September 2024. VAST says the DataEnclave runtime is compatible with the CNCF Confidential Containers (CoCo) ecosystem, including Kata Containers, and can attest to Trustee, CoCo's open-source attestation server. The white paper also says it aligns with NVIDIA's Confidential Containers reference architecture, which reached version 1.1.0 on August 11, 2026, and is built from Kata, Trustee, QEMU, and NVIDIA's GPU Operator.
NVIDIA has already documented this use case. A reference architecture last updated June 4, 2026 describes how proprietary and frontier model vendors can deploy into enterprise-controlled Kubernetes, with two validated implementations: the upstream open-source stack, and Red Hat OpenShift sandboxed containers with Red Hat's build of Trustee. Fortanix made the same pitch on March 18, 2026, naming ElevenLabs among its model companies, and is now a DataEnclave attestation option; SCN covered its composite CPU-and-GPU attestation in March.
VAST's own contribution sits around that core, as its documents describe it; none of it can be tested before the product ships. It includes a CoCo-compatible runtime inside DataEngine that deploys and manages confidential workloads as VAST Applications, and CVM images VAST builds, hardens, and signs, with no interactive login. The data owner registers which image measurements it accepts, so image updates become two-party changes. Around those sit the VAST Artifact Registry, an optional Helm-chart attestation server with OPA Rego policies, audit records in VAST DataBase, three deployment modes, and turnkey appliances pre-loaded with partner models.
That is packaging and operations work, and in SCN's assessment it is harder than the word suggests. Somebody has to build the VM images, keep reference measurements current through every firmware and driver update, and run the registry and key broker on a customer's floor. HyperFRAME Research's Don Gentile, Analyst-in-Residence for Data Platforms and Resiliency, lists re-attestation and approval of new measurements as ongoing requirements in a research brief VAST sponsored. It is also the AI-operating-system strategy SCN described when VAST raised at a $30 billion valuation in April, which CEO Renen Hallak extended in the launch release: "Models are becoming a resource the operating system has to manage, the same way it manages data."
VAST's materials describe the GPU side in more than one way. The press release says DataEnclave uses NVIDIA Confidential Computing "to encrypt guest memory, GPU memory and NVLink traffic," and Denworth says in the launch video that it protects both GPU memory and NVLink traffic. The white paper's component description calls CPU memory encrypted and GPU memory and CPU-to-GPU traffic protected, while its worked example cites memory encryption and protection in both processors, and the launch blog says newer GPU platforms also protect the links between GPUs.
NVIDIA's documentation is specific. Its Hopper confidential-computing whitepaper says on-package HBM "is considered secure against common physical attack tools, such as interposers, and is not encrypted." A GPU firewall blocks unauthorized access, and data crossing PCIe or NVLink in multi-GPU Hopper systems moves through encrypted bounce buffers. IBM Research and Ohio State researchers describe the same design, with code and data in plaintext in GPU memory at runtime, and Hang Yin and Kevin Wang's Blackwell study, posted in June 2026 and revised in July, finds it on B300, with the cryptographic cost paid on the PCIe staging path.
VAST's materials don't map these descriptions to GPU generations, and NVIDIA's NVLink handling has varied. SCN reported in March that NVIDIA removed NVLink encryption from its Protected PCIe release for H100 and H200 clusters to reduce overhead; its January 5, 2026 Rubin announcement says Vera Rubin NVL72 keeps data secure across CPU, GPU, and NVLink domains. Under any of these descriptions, the host's software cannot read the weights. SCN's reading is that encrypted versus firewalled matters mostly for physical attacks on the server, which the white paper already places outside DataEnclave's guarantees.
HyperFRAME's brief caps an enclave at one NVLink domain, from a single GPU through four- and eight-GPU systems up to rack-scale NVL72.
The NVL72 end of that range needs checking. NVIDIA's Confidential Containers release notes validate HGX H100 and H200, B200, B300, and the RTX Pro 6000 Blackwell Server Edition, with no NVL72 system, and NVIDIA calls Vera Rubin NVL72, due from partners in the second half of 2026, its first rack-scale platform with confidential computing. The likeliest reading is that rack-scale DataEnclave means Vera Rubin rather than the GB200 or GB300 racks in service now, but VAST hasn't published a validated platform list. Yin and Wang also flag that on B300 the tenant can't verify the Fabric Manager software or the NVSwitch routing tables steering its NVLink traffic. "Today that control plane is host-trusted," they write.
On speed, VAST has published no benchmark; HyperFRAME says the company expects to characterize performance effects before general availability. Blocks & Files wrote, without attributing the estimate, that the compute cost is expected to land in the single-digit to low-double-digit percent range depending on model size. The independent numbers are in that neighborhood. A 2024 study of H100 and H200 GPUs found average overhead under 9%, and below 7% for most typical LLM queries. On Blackwell, Yin and Wang measured LLM serving under Intel TDX plus GPU confidential computing, losing 13% to 27% of throughput, with KV-cache restore latency more than doubling, while a BF16 matrix multiply ran at 0.998 times normal speed. Two disclosures apply: Hang Yin is an author on both papers, and both carry Phala Network addresses. Phala sells confidential AI cloud services, and the 2024 study was funded by a grant from io.net and the IOG Foundation. The B300 figures are single-run measurements, as the authors acknowledge.
If those results hold up, the cost of confidential inference sits in software and data movement. The GPU computes at full speed; the losses come from the bridge between the confidential VM and the device, the data-movement problem that dominated Hot Chips 2026. Software can recover much of it. Loading a 120-billion-parameter model into a confidential GPU took 287 seconds with vLLM's default loader and 8.4 seconds with a loader the authors wrote for confidential mode, with confidential computing on in both cases. VAST also markets KV-cache offload to its storage with NVIDIA Dynamo, DataEnclave keeps KV caches on encrypted volumes, and KV restore is among the paths Yin and Wang found most penalized, so a DataEnclave deployment leaning on Dynamo offload would run straight through it.
The release names Cohere, CrowdStrike, Deepgram, Factory, Fundamental, NVIDIA and TwelveLabs as model partners. Apart from NVIDIA, they are specialist builders in enterprise language models, security, speech, coding agents, tabular data and video. Cohere's chief revenue and commercial officer, Frank O'Dowd, said in the release that customers want AI encrypted during inference as well as at rest and in motion.
No frontier lab is named: OpenAI, Anthropic and Google appear nowhere in the release, white paper, HyperFRAME brief or launch video. John Mao, VAST's vice president of business development and alliances, told Blocks & Files the company is talking with essentially every model company, without naming any. The white paper's worked example imagines one, a fictional lab called OpenBrain.
The closest frontier precedent uses a different design. Google's Gemini on Google Distributed Cloud, which Cirrascale began previewing in April 2026, ships as a Google-certified, Dell-built server with eight NVIDIA B200 GPUs; VentureBeat reported that it relies on confidential computing and keeps weights only in volatile memory. DataEnclave instead asks a model owner to accept VAST-built, VAST-signed VM images into its chain of trust, checked through the owner's measurement registration, though its air-gapped turnkey appliances sit closer to Google's approach. Of the two designs, only Google's comes with a frontier model so far.
Denworth told SiliconANGLE, "We don't charge anything extra for this," since DataEnclave is part of the AI operating system. NVIDIA's licensing page makes its confidential computing capability a licensed feature for production use. The statements describe different companies' fees, and VAST's covers only its own.
The white paper spells out where its guarantees stop. The attestation server and key manager must run somewhere the owner trusts and are only as good as the reference values and policies loaded into them. Attestation proves a CVM image is authentic and unmodified, not that it is free of exploitable flaws. And DataEnclave inherits the limits of the CPU and GPU roots of trust: firmware vulnerabilities, side channels, physical attacks, and compromise of the vendors' signing keys. SCN's look at how the open Caliptra root of trust is being commercialized covers why every attestation chain ends there.
The white paper also puts attacks through the workload's own API out of scope, such as prompt injection that coaxes out retrieved data or systematic querying to reconstruct a model's behavior, and deliberate exfiltration by the workload, such as a container set to log prompts to a remote server; the enterprise owns the network perimeter. NVIDIA's threat model for the same use case adds a malicious image from the model provider and a compromised attestation administrator.
A model owner can revoke entitlement at any time without the customer's cooperation, but the white paper leaves re-attestation after launch to the application: "If an application never requests protected resources after it launches, it will never re-attest, and it retains any secrets it was granted at creation." Revocation takes effect when a workload next asks for a key, so a container already holding its keys keeps them unless its developer builds in periodic re-attestation through DataEnclave's in-CVM REST API.
Audit scope depends on the deployment. The solution brief says every attestation event, key release, and policy decision lands in VAST DataBase. By the white paper's account, DataBase records the workload lifecycle, while evidence checks and key releases reach VAST's audit store only when VAST's own attestation server runs as a VAST Application. With Trustee or Fortanix attesting, those records live outside VAST, and HyperFRAME notes that enterprises may need to correlate the two sets.
The air-gapped mode matters most for sovereignty. Keys sit in a hardware security module, and certificate chains, revocation data and reference values are cached locally, so attestation needs no outside connection. The solution brief names government, defense, financial services and healthcare; SiliconANGLE adds pharmaceutical companies, some already building their own AI supercomputers around proprietary data.
The release also pitches a route through AI clouds, saying sovereign and regional providers can offer systems such as NVIDIA Vera Rubin "from facilities operated within national borders" without dedicating whole machines to one tenant. It quotes three launch cloud partners, BUZZ HPC, Nscale and Sharon AI; Denworth also names G42 in the video, though G42 is not in the release.
VAST has yet to publish a validated GPU platform list or overhead figures, including attestation latency for any configuration, and the product is due to ship in the first quarter of 2027.
The SCN Staff is a small AI editorial squad working under human direction. Each agent owns one job.
Scout does the research. It runs down primary sources and checks what's already been published, on SCN and everywhere else, before a story gets written. If a claim can't be traced back to a real document, Scout flags it.
Forge writes. It takes what Scout found and turns it into a draft, argument and sentences and all. Every SCN piece starts here, then gets sharpened.
Cipher handles search: the titles, descriptions, and keyphrase work that decides whether a good article ever gets found. Least glamorous job on the squad. Also one that matters more than it looks.
Pixel makes the visuals. Images, charts, the occasional diagram, all built to SCN's brand instead of pulled from a stock library. When something's easier to see than to read, it goes to Pixel.
Editorial judgment and the final call stay with the humans. So does the fact-checking.
