Nebius or a Confidential GPU: What Intel TDX and Attestation Change for Your Data

Key takeaways

• Two kinds of evidence. Nebius's trust center lists SOC 2 Type II with HIPAA, SOC 3, a series of ISO certifications, EU data processor status and data residency by region. We hold none of those certifications today. Our evidence is of another kind: an Intel TDX quote and, on the configurations listed below, an NVIDIA GPU attestation, which each tenant generates inside the VM and verifies on their own machine.
• What attestation changes is data in use. Nebius documents encryption at rest and TLS in transit. A confidential VM adds a hardware boundary around the VM's memory while it runs, which the host's software is outside of, and a way to check that boundary before you load data.
• What it does not change. The host still controls availability. Network and storage are still yours to encrypt. Nebius is cheaper per GPU-hour and offers more GPU types and a choice of region; our GPU compute is performed by sub-processors located in the United States, in data centres not limited to the EU.

Nebius and a confidential VM answer different questions, so "which one is more secure" has no single answer. Nebius documents its controls, has them audited, and lets you choose the region where your data stays. A confidential VM puts the workload inside an Intel TDX trust domain with the GPU in NVIDIA's confidential computing mode, and gives you a proof of that state you can check yourself.

This article lists what each side states, with the page it comes from, then what attestation changes for your data and what it leaves as it is. Every fact about Nebius comes from Nebius's own pages, read on 3 November 2026 at 00:09 UTC. We did not test Nebius's platform. For the short version, see our VoltageGPU vs Nebius comparison.

Two kinds of evidence

A certification or an audit report says that an independent auditor examined a provider's controls: who can access what, how changes are made, how incidents are handled. In Nebius's words, its SOC 2 Type II report "evaluates the design and operational effectiveness of the controls." It covers the organisation and its processes over a period of time.

An attestation is a statement signed by hardware about the state of one machine at one moment. In a confidential VM, Intel's Quoting Enclave on the machine signs a quote with a key that chains to Intel's root, and the GPU's evidence is checked and signed by NVIDIA's attestation service. You verify the signatures with Intel's and NVIDIA's keys, without trusting the provider. In Intel's description, remote attestation lets the owner of a workload "establish that the workload is running on an Intel-TDX-enabled platform located within a TD prior to providing that workload data."

Neither replaces the other. An audit says nothing about the memory of the VM you are using right now; an attestation says nothing about how a provider hires staff, handles incidents or deletes data.

What Nebius states

From nebius.com/trust-center, nebius.com/prices and the Nebius documentation, all read on 3 November 2026:

• Certifications and frameworks. SOC 2 Type II "With HIPAA", SOC 3 ("a summarized version of the SOC 2 Type II audit, designed for public consumption"), ISO 22301, ISO 27001, ISO 27018, ISO 27032, ISO 27701, ISO 27799, ISO 42001 and CSA STAR Level 1. Nebius also states that it aligns with NIS 2 and with DORA.
• GDPR role and data residency. "As an EU data processor, we operate under GDPR." And: "We honor our customers' data residency requirements by ensuring that customer data remains within the geographic region of their choice."
• Encryption. Storage is "encrypted by default", except two disk types (Network SSD Non-replicated and Network SSD IO M3), and data in transit is encrypted "by using secure protocols, such as TLS". The documentation page Encryption in Nebius AI Cloud describes "built-in encryption to protect customer data at rest across its storage services", and adds that local SSD disks are not encrypted.
• Access and isolation. Access policies "based on the principle of least privilege", multi-factor authentication, and access to critical systems "closely monitored and logged". Customer environments are separated with VPC networks, InfiniBand traffic segregation and, for managed Kubernetes, isolation "at the virtual machine level".
• GPUs and prices. On-demand prices per GPU-hour: HGX H100 $4.50, HGX H200 $5.40, HGX B200 $8.50, HGX B300 $9.50, RTX PRO 6000 $1.80. Preemptible prices for these GPUs start from $0.79 (H100, H200, RTX PRO 6000) or $0.99 (B200, B300) per GPU-hour, at spot prices that change. GB200 and GB300 NVL72 systems are on request. The VM types page lists the GPU platforms by region (eu-north1, eu-west1, uk-south1, us-central1, me-west1 and others).
• Confidential computing. None of the pages above mentions confidential computing, a trusted execution environment, Intel TDX, AMD SEV, or GPU attestation for tenants. Nor does the index of Nebius's documentation (docs.nebius.com/llms.txt, 632 lines) or any of the 2,203 page addresses in its documentation sitemap. If Nebius offers such an option elsewhere, the comparison below changes.

What a confidential VM adds

A VoltageGPU Confidential VM is an Intel TDX trust domain with an NVIDIA GPU passed through to it, in confidential computing mode.

• The VM's memory. Intel describes TDX as "designed to isolate TD VMs from the Virtual-Machine Manager (VMM), hypervisor and other non-TD software on the host platform." The private memory of each trust domain is encrypted with "a CPU-generated, unique, and ephemeral AES-XTS 128-bit key", and those keys are "tailored not to be accessible by software or by using external interfaces to an SOC" (Intel TDX white paper).
• The GPU. In NVIDIA's threat model for confidential VMs, traffic between the CPU and the GPU is encrypted, and "within GPU memory, hardware access controls protect plaintext data; GPU memory encryption is not the protection mechanism." Each GPU is assigned whole to one VM.
• The proof. Inside the VM, you generate an Intel TDX quote and an NVIDIA attestation token, both bound to a challenge you drew, and you verify them on your own machine with voltage-verify, an open-source tool. The step-by-step, with real outputs, is in Verify a Confidential GPU Yourself With voltage-verify.
• Where it is verified. NVIDIA GPU attestation from inside our VMs is verified on one H200 (4 September 2026), one RTX PRO 6000 Blackwell (9 October 2026), one H100 (28 October 2026) and the 8x H100 node in Protected PCIe mode (10 September 2026, the eight GPUs, not the NVSwitch fabric). It has not been run on the 8x H200 node, and B200 and B300 have never been available to test. The list, with the evidence, is public at /api/attestation/evidence.

What attestation changes for your data

Intel's white paper starts from a plain observation: "In typical installations the platform owner has full access to what is being processed on the platform." On a VM without a CPU trust domain, keeping your data in memory away from the host is the provider's job, done with access controls and processes. That is the kind of control an audit such as SOC 2 examines, and the Nebius pages above describe such controls: least privilege, multi-factor authentication, logged access to critical systems.

NVIDIA's threat model draws the line differently for a confidential VM: "The host OS, hypervisor, virtual machine monitor, and other tenants are outside this runtime trust boundary." When a host administrator or another tenant "attempts to read or alter workload memory", the protection is that "the CPU TEE isolates private VM state; GPU access controls and protected sessions restrict access to GPU state."

So the change is in who you have to trust while your data is decrypted in memory:

While your workload runs	VM without a CPU trust domain	Confidential VM (Intel TDX, GPU in CC mode)
The provider's host software and its administrators	Inside what you trust, bound by the provider's controls	Outside the boundary for the VM's private memory and the GPU's state (NVIDIA threat model)
Intel, NVIDIA and their firmware	Trusted	Trusted, and they sign the evidence
The software inside your VM and your own administrators	Trusted	Still trusted (NVIDIA threat model)
How you check it	The provider's audit reports and contract	The quote and the GPU token you generate and verify, before you load data

The last row matters in practice. Attestation lets you set a rule such as "no keys, no model weights and no client files go into the VM until both proofs verify on my machine for the challenge I just drew." A certification cannot express that rule, because it does not describe a particular machine at a particular moment.

What attestation does not change

From the same NVIDIA threat model and Intel white paper, and from our own limits:

• Availability. "The infrastructure owner can stop the CVM, interrupt networking, detach devices, or remove power. Confidential Computing does not guarantee service availability against that operator."
• Network and storage. "Protect data that leaves the CVM and its assigned GPUs separately, including network connections and stored artifacts." TLS and encrypted files remain your job.
• Your own software. "Attestation does not establish that approved code is free of vulnerabilities." Whatever runs inside the VM can still leak what it handles.
• Physical attacks. NVIDIA puts "invasive package probing and fault injection" outside its GPU threat model, and Intel writes that "Intel TDX does not defend against replay of memory through physical attacks." Our article on DDRop explains what a published physical attack on TDX changes for tenants.
• Eight-GPU Hopper nodes. In NVIDIA's Protected PCIe mode, traffic between GPUs over NVLink is not encrypted, and the assessment "must also account for protection of the fabric, including NVSwitch and physical access." We have not verified the NVSwitch fabric on our 8x H100 node (details).
• The organisational side. Attestation says nothing about incident handling, staff access policies, data deletion or business continuity. Those are what certifications examine, and we hold none: our security page lists SOC 2 Type I as a target for Q4 2026, ISO 27001 for Q1 2027 and SOC 2 Type II for Q4 2027, none of them held, and no HIPAA Business Associate Agreement.
• Where the data is processed. Our DPA states that the customer account database is hosted in Frankfurt and that GPU compute is performed by sub-processors in the United States, whose data-centre locations are not limited to the EU. EU-only placement is possible only on written request, after we confirm what can be guaranteed. Nebius, by its trust center, keeps customer data in the region the customer chooses.

Side by side

Facts as published on 3 November 2026. Prices are on-demand, per GPU-hour, before tax.

	Nebius (its pages)	VoltageGPU Confidential VM
Third-party certifications	SOC 2 Type II with HIPAA, SOC 3, ISO 22301, 27001, 27018, 27032, 27701, 27799, 42001, CSA STAR Level 1; alignment with NIS 2 and DORA	None held; SOC 2 Type I targeted for Q4 2026
GDPR role stated	EU data processor	Processor under a DPA (GDPR Art. 28); VOLTAGE EI, a French sole proprietorship
Where workloads run	The region the customer chooses	Sub-processors in the United States; EU-only placement on written request
Data at rest and in transit	Storage encrypted by default (two disk types and local SSDs excepted), TLS in transit	Not covered by TDX: encrypt network traffic and stored files yourself
VM memory while the workload runs	Not described on the pages read	Intel TDX trust domain, private memory encrypted with a per-domain key
GPU	Not described on the pages read	Confidential computing mode; NVIDIA attestation verified on the configurations listed above
Evidence you check yourself	Certifications listed on the trust center; SOC 3 designed for public reading	Intel TDX quote and NVIDIA token generated inside your VM, verified with voltage-verify
H100	$4.50	$6.95
H200	$5.40	$8.08
RTX PRO 6000	$1.80	$3.80
B200, B300	$8.50, $9.50	Not offered today; GPU attestation not verified
Billing	On-demand, preemptible and committed	Per second, one hour prepaid and the unused part refunded

Our prices come from our public price snapshot, read on 2 November 2026 at 23:57 UTC; the RTX PRO 6000 tier showed no stock at that time. Nebius's come from nebius.com/prices, read on 3 November 2026 at 00:09 UTC. Nebius is cheaper per GPU-hour on every model both sides list.

Which one fits

• Nebius fits when your reviewer asks for a SOC 2 Type II report or an ISO 27001 certificate, when EU data residency by region is the requirement, when you need B200, B300 or large reserved clusters with managed Kubernetes, or when the data is not sensitive enough to pay for a confidential stack.
• A confidential VM fits when the requirement is a technical measure for data in use that you can check yourself: client files under professional secrecy, identifiable health data, model weights you do not want visible to the host. It also asks you to accept what we do not have today: certifications, EU placement by default, B200 and B300 GPUs.
• You can also use both. Certified capacity for training and evaluation on non-sensitive data, and a confidential VM for the step where sensitive data is decrypted in memory. The comparison page makes the same point.

Check it yourself

• Nebius: trust center, prices, encryption documentation, VM types and regions.
• VoltageGPU: attested configurations, security page, DPA, price snapshot, and a real bundle you can verify offline in a few minutes: the walkthrough.
• Intel and NVIDIA: Intel TDX white paper, NVIDIA threat model for confidential VMs.

What this comparison does not prove

• Nothing about Nebius's infrastructure beyond its pages. We compared published statements. We did not test Nebius's platform, and we have not read its audit reports.
• That Nebius has no confidential computing option. We found no mention of one on the pages listed above, in its documentation index or in its documentation sitemap. An offer outside those pages, or one sold on request, would not show up in that check.
• That a confidential VM is safe for every workload. Attestation shows that the CPU and the GPU were genuine and in the expected state when the evidence was made. It does not show which software ran in the VM, that the GPU ran your model, or anything about network, storage, availability or physical attacks.
• Today's prices tomorrow. Prices on both sides change. Nebius's preemptible prices move with demand. Read the two sources again before you decide.
• Legal advice. Whether your data may be processed by a given provider, in a given country, under a given contract, is for your counsel to decide.

FAQ

Does Nebius offer confidential computing? Not on the pages we read on 3 November 2026: its trust center, its prices page, its documentation on encryption and VM types, its documentation index and its documentation sitemap contain no mention of confidential computing, Intel TDX, AMD SEV or GPU attestation. Ask Nebius directly if you need a definitive answer.

Does attestation replace a SOC 2 report? No. A SOC 2 report examines a provider's controls over a period of time. Attestation proves the state of one machine at one moment. A reviewer may ask for one, the other or both.

Is Nebius cheaper than VoltageGPU? Yes, per GPU-hour, on every model both list, as read on 2 and 3 November 2026 (UTC): H100 $4.50 against $6.95, H200 $5.40 against $8.08, RTX PRO 6000 $1.80 against $3.80. The difference pays for the confidential stack; for data that does not need it, there is no reason to pay it.

Can I keep my data in the EU with VoltageGPU? Not by default. Our DPA states that GPU compute runs at sub-processors in the United States, whose data-centre locations are not limited to the EU. EU-only placement must be requested in writing, and we confirm what can be guaranteed before you rely on it.