Confidential VMsIntel TDX + NVIDIA attestationStart here
A whole VM inside a trust domain, attested by you.
First top-up of $10 or more: we add $3.80, your first hour of RTX PRO 6000 on us.
from $3.80 per GPU-hour
See confidential VMsConfidential AI infrastructure
Confidential GPUs you verify yourself.
H100, H200 or RTX PRO 6000 in Intel TDX, with Intel and NVIDIA attestation.
- 38 confidential VMs available now
- From $3.80 per GPU-hour
- Billed per second
01The proof
Don't trust us. Check.
RESULT: VERIFIED 15/15 checks Checked by Intel SGX Root CA NVIDIA attestation service voltage-verify, open source Reproduced by an outside engineer VOLTAGE EI, France
Hardware actually verified
Run from inside the VM, on a random nonce, and passed. "Both proofs" means the Intel TDX quote was checked in the same published run; the quote is available to the tenant on every Confidential VM. Nothing is listed on assumption.
| Hardware | Scope | Verified | Evidence |
|---|---|---|---|
| H100 80GB | 1 GPU, both proofs | Open | |
| 8× H200 141GB | 8 GPUs, both proofsNVIDIA Protected PCIe mode. NVSwitch attested only with libnvidia-nscq added in the guest. | Open | |
| 8× H100 80GB | 8 GPUs, both proofsNVIDIA Protected PCIe mode. NVSwitch attested only with libnvidia-nscq added in the guest. | Open | |
| RTX PRO 6000 Blackwell 96GB | 1 GPU, both proofs | Open | |
| H200 141GB | 1 GPU, both proofs | Open |
Not attested, and never claimed: B200 and B300 (never available). NVSwitch: the 4 NVSwitches of the 8× H200 node and those of the 8× H100 node passed NVIDIA attestation on 4 November 2026 once libnvidia-nscq matching the driver version was installed in the guest; on the image as delivered, it fails. Machine-readable list
From a customer
“There is always a GPU available and the connection has always been stable for me”
Check a real proof in five minutes, no account →Every public proof →A check fails? Email the founder
02What you can run
Three products, clearly labelled.
Confidential inference APITEE models
11 TEE models, each running inside Intel TDX at our inference provider.
from $0.08 per 1M input tokens
See the inference APIStandard GPUsNo enclave
For data that is not sensitive: no Intel TDX and no attestation, at lower prices.
360 on demand from $0.30/GPU-h · 110 spot from $0.24/GPU-h (spot can be reclaimed by the host)
Browse standard GPUsAlso available, without an enclave: Dedicated bare metal · Sandboxes
For developers
Automate it.
The same machines from your terminal, your code or your AI agent: the vgpu CLI, a REST API and an offline verifier.
pip install "voltagegpu-cli[verify]>=2.0.0"vgpu up rtx6000b-small --name job1 --ttl 1h --max-price 4 -yvgpu attest job1vgpu rm job1 -yOne command for a script or an AI agent: vgpu up charges the first hour and sets the release deadline (--ttl), vgpu attest checks the VM on your machine, vgpu rm releases it and the unused part of the hour comes back. The key comes from VOLT_API_KEY.
curl -X POST https://api.voltagegpu.com/api/volt/pods \ -H "X-API-Key: $VOLT_API_KEY" -H "Content-Type: application/json" \ -d '{"provider":"standard","name":"my-pod","machine_id":"<machine_id>"}' curl https://api.voltagegpu.com/api/volt/pods -H "X-API-Key: $VOLT_API_KEY""standard" starts a pod without an enclave. For an Intel TDX Confidential VM, send "confidential" with a resource_name.
pip install "voltage-verify>=0.3.0"voltage-verify verify bundle.json --challenge <yours>voltage-verify verify bundle.json --offline --accept-offline-tcb --challenge <yours>Checks a Confidential VM's Intel TDX quote and NVIDIA GPU attestation on your own machine, without trusting us.
03Questions
Frequently asked questions
What is confidential computing and how does VoltageGPU implement it?
Confidential computing protects data during processing using hardware-based Trusted Execution Environments. VoltageGPU runs NVIDIA GPUs inside Intel TDX trust domains: memory is encrypted by the CPU and the GPU is passed through to the trust domain. The attestation you generate covers the trust domain, not the disk: we do not claim disk encryption, so encrypt sensitive data at rest yourself. Google Cloud also uses Intel TDX for its confidential H100 (A3 High); Microsoft Azure's confidential GPU runs on AMD SEV-SNP.
Can I verify the enclave myself, without trusting VoltageGPU?
Yes. On the Confidential VM tier, the Intel TDX attestation device (/dev/tdx_guest) is exposed to you as the tenant. You SSH in with full root and generate both proofs on a challenge you choose: an Intel TDX quote whose report_data carries the hash of your manifest, verified offline up to Intel's root CA, and an NVIDIA GPU attestation whose nonce carries the same hash, signed by NVIDIA. VoltageGPU is not in the trust path. NVIDIA GPU attestation verified from inside the VM on: single-GPU H200 141GB (2026-09-04); single-GPU RTX PRO 6000 Blackwell 96GB (2026-10-09); single-GPU H100 80GB (2026-10-28); 8x H200 141GB node, all 8 GPUs in NVIDIA Protected PCIe mode, NVSwitch attested only with libnvidia-nscq added in the guest (2026-11-04); 8x H100 80GB node, all 8 GPUs in NVIDIA Protected PCIe mode, NVSwitch attested only with libnvidia-nscq added in the guest (2026-11-04). Both proofs (Intel TDX quote and GPU attestation) checked in the same published run on: single-GPU H200 141GB (2026-09-04); single-GPU RTX PRO 6000 Blackwell 96GB (2026-10-09); single-GPU H100 80GB (2026-10-28); 8x H200 141GB node, all 8 GPUs in NVIDIA Protected PCIe mode, NVSwitch attested only with libnvidia-nscq added in the guest (2026-11-04); 8x H100 80GB node, all 8 GPUs in NVIDIA Protected PCIe mode, NVSwitch attested only with libnvidia-nscq added in the guest (2026-11-04). The Intel TDX quote is available to the tenant on every Confidential VM. Not attested and never claimed: B200 and B300 (never available). On the 8x H200 and 8x H100 nodes, the 4 NVSwitches of each node passed NVIDIA attestation on 4 November 2026 once libnvidia-nscq matching the driver version was installed in the guest; on the image as delivered, switch attestation fails.
What GPUs are available on VoltageGPU?
Two tiers. The confidential tier, which is what we are built for: Confidential VMs with NVIDIA H100 (80GB), H200 (141GB) or RTX PRO 6000 Blackwell (96GB) inside Intel TDX, and 8-GPU H100 and H200 nodes in NVIDIA's multi-GPU Protected PCIe mode (GPU attestation verified for all 8 GPUs; the 4 NVSwitches of each node passed NVIDIA attestation on 4 November 2026 only with libnvidia-nscq added in the guest, and the NVLink fabric is not claimed), from $3.80 per GPU-hour. B200 and B300 have never been available to date and are not attested. And a standard tier without an enclave, for work that is not sensitive: no Intel TDX and no attestation, at lower prices, from $0.30 per GPU-hour, with the live catalogue at voltagegpu.com/standard-gpus. Confidential is the default and the reason the platform exists; the standard tier is there so you do not pay for an enclave you do not need.
How much does VoltageGPU cost?
Confidential VMs (Intel TDX + NVIDIA attestation), from $3.80 per GPU-hour. Live Confidential VM prices: single-GPU RTX PRO 6000 Blackwell at $3.80 per GPU-hour (22 available now); single-GPU H100 at $6.95 per GPU-hour (15 available now); 8x H100 node at $6.95 per GPU-hour (1 available now); single-GPU H200 at $9.00 per GPU-hour (on request); 8x H200 node at $9.00 per GPU-hour (on request). Confidential Inference API pays per token, from $0.08 per million input tokens. Standard GPUs without enclave from $0.30 per GPU-hour. Private AI Chat is $20/month. Confidential Agents start at $349/month for 3 seats. Per-second billing, no commitment.
Is VoltageGPU GDPR compliant?
We act as a processor under GDPR Article 28 and sign a Data Processing Agreement. VoltageGPU is operated by VOLTAGE EI, a French company (SIREN 943 808 824 00016), so processing is under CNIL oversight. Intel TDX adds Article 32 technical measures: inside the attested trust domain, the processor has no technical means of reading memory during execution; TDX does not encrypt the disk, so encrypt data at rest yourself. Note that GDPR compliance is a property of your whole processing operation, not of a supplier alone, so the controller assessment remains yours. DPA available on request.
Can I use VoltageGPU for healthcare / HIPAA workloads?
VoltageGPU Confidential Compute processes data inside Intel TDX hardware enclaves with AES memory encryption, which supports the HIPAA technical safeguards; whether a workload is HIPAA compliant is assessed on your whole processing operation. No Business Associate Agreement (BAA) is offered yet; it is planned after SOC 2 Type I, live status on the Trust Center.
Is the VoltageGPU API compatible with OpenAI?
Yes, for chat completions (streaming included): change your base URL to api.voltagegpu.com/v1 and use your VoltageGPU API key; OpenAI SDKs, LangChain, LlamaIndex and other OpenAI-compatible clients work. Requests pass through our relay, which sees them in clear (TLS ends at our host). To keep plaintext off our servers, run your own inference server in a Confidential VM and terminate TLS inside its trust domain.