Quick Answer: AWS Nitro Enclaves use a software attestation root controlled by Amazon. Intel TDX uses a hardware root controlled by Intel, and your own policy engine. For GDPR Article 25 and Schrems II compliance, that distinction isn't academic. It's the difference between "trust us" and "verify independently."
The Attestation Root Problem Nobody Talks About
Let me be direct, every confidential computing platform claims "hardware isolation." Few explain who vouches for that isolation.
AWS Nitro Enclaves generate attestation documents signed by the Nitro Hypervisor. Amazon built it. Amazon runs it. Amazon signs the proof. You're trusting a single vendor's software stack to attest to its own integrity.
Intel TDX uses a hardware root of trust burned into the CPU at manufacturing. The attestation report is signed by Intel's Provisioning Certification Service, independent of the cloud operator. Your policy engine validates against Intel's root, not the host's.
| Component | AWS Nitro Enclaves | Intel TDX (VoltageGPU) |
|---|---|---|
| Attestation root | Nitro Hypervisor (AWS-controlled) | Intel CPU hardware + PCS |
| Cloud operator visibility | AWS can see enclave metadata | The host cannot read Trust Domain memory (Intel TDX) |
| Setup complexity | Moderate (AWS SDK) | Confidential VM, usually ready within 15 minutes |
| GPU options | None (CPU-only) | H100, H200, RTX PRO 6000 Blackwell |
| Price for confidential GPU | N/A | H100 $6.95/hr, H200 $9.00/hr, RTX PRO 6000 Blackwell $3.80/hr (live prices and stock on /pricing) |
| GDPR Art. 25 native | Retrofit | Built-in, EU company (France) |
| Limitation | No GPU enclaves | No published overhead measurement of our own |
Nitro's honest gap: no GPU confidential compute at all. For AI inference on sensitive data, that's a hard stop.
Why Regulators Are Starting to Care
If your cloud provider can theoretically access the infrastructure, even if they promise not to, supplementary measures may fail.
TDX's hardware root changes the calculus. The CPU encrypts memory with keys the host OS never sees. Attestation proves this to your policy engine, not to the operator's dashboard. It's structural separation, not contractual.
The Code Reality
The attestation you generate yourself inside a Confidential VM carries a TDX quote signed through Intel's PCK chain and verifiable offline (see the tenant attestation guide). The inference API does not return an attestation with each request. Requests pass through our relay, which sees them in clear (TLS ends at our host). To keep plaintext off our servers, run your own inference server in a Confidential VM and terminate TLS inside its trust domain.
Compare to Nitro's flow: generate attestation document → send to AWS Nitro Attestation PKI → receive validation → trust AWS's PKI infrastructure. One vendor, end to end.
What I Didn't Like (Honest Limitations)
- A third-party benchmark of NVIDIA Hopper confidential mode reports an overhead below 7% for most typical LLM queries (arXiv 2409.03992).
- No SOC 2 certification. We rely on GDPR Article 25 + Intel TDX attestation + DPA on request. If your procurement requires a SOC 2 checkbox, we're not there yet.
The reality is for AI workloads that actually need confidentiality, not just compliance theater, the attestation root isn't a detail. It's the whole game.
Try the no-signup demo at /confidential-demo (5 analyses per IP per day).