NVIDIA confidential computing on H100, H200 and Blackwell. Your model runs inside a hardware-sealed enclave, and the company that owns the server sees encrypted traffic and an attestation record. It does not see your prompts, the answers or the weights.
Have your own GPUs? The same service runs inside your network.
The same request, seen from both ends. You get a plain answer. The company that owns the GPU sees encrypted memory traffic and an attestation record, and nothing it can read.
> Summarise the open claims for policy 4471-B
Sample response. This page runs no model, so this is a canned reply. In production your model answers inside the sealed enclave, and the reply is readable only at your end of the encrypted session.
Plain text, at your endpoint only.
6 of 6 checks passed
Unreadable encrypted bytes. The hardware owner cannot see your prompt or the answer.
Readable by the host: nothing above.
Illustration only. No model runs on this page and nothing leaves your browser. The bytes on the right are a SHA-256 stream of your prompt, so they change with every keystroke, the way real ciphertext would.
Confidential computing changes whom you have to trust. You trust the CPU and GPU hardware, and the attestation that proves it was switched on. You no longer have to trust the company that owns the server, its administrators or its hypervisor.
Out of scope: physical attacks on the GPU package, side channels beyond the vendors’ published mitigations, and flaws in your own application code. This is a threat model, not a promise that nothing can ever be broken. Ask an engineer to walk your security team through it for your deployment.
By quote
Each confidential deployment is priced on four things:
The same service runs inside your network, on hardware you control. No enclave is needed when nobody else holds the server.
How an on-prem deployment worksTell us the model, the data and where the hardware is: a cloud, a colocation host or a partner’s rack. An engineer from Limassol or Auckland replies with a confidential-compute plan and a quote.
>consent.request · this site stores almost nothing
No cookies, no tracking, no ads, no third parties. With your OK we keep the ref or UTM tag from the link that brought you here, for this visit only, so an enquiry shows which page or campaign it came from. What we store
Remembers this choice for 12 months so we do not ask on every page. Always on.
Keeps the ref or UTM tag from the link that brought you here, for this visit only, so an enquiry shows which page or campaign it came from. Off unless you turn it on.