Skip to content
VoltageGPU
Contact
Deploy
Azure Confidential Computing alternative, verified 12 September 2026

The Intel TDX alternative to Azure Confidential Computing

Azure’s confidential GPU is real: NCC H100 v5, an NVIDIA H100 in confidential mode inside an AMD SEV-SNP VM, generally available since September 2024. VoltageGPU runs the same NVIDIA half on Intel TDX, with an H200 in CC mode, a French operator, per-second billing, and two proofs you generate from inside your own VM. This page compares the two on what a security review actually checks.

Azure cells from Microsoft and NVIDIA pagesList prices, USD, 12 September 2026EU operator (VOLTAGE EI, Solaize, FR)

Side by side

Every Azure cell was read on a Microsoft or NVIDIA page on 12 September 2026; every VoltageGPU cell stops at the SKUs where we ran the attestation ourselves. The four-cloud version, with Google Cloud and AWS, is on the matrix.

CriterionVoltageGPUAzure NCC H100 v5
CPU trusted execution environmentIntel TDX trust domain on every tierAMD SEV-SNP on 4th Gen AMD EPYC (not Intel TDX on this series)
GPUs in confidential modeSingle-GPU H100, H200 and RTX PRO 6000 Blackwell VMs; 8x H100 and 8x H200 nodes (confidential containers retired by the provider on 1 Oct 2026)NVIDIA H100 NVL, one GPU per VM (NCCads_H100_v5 sizes)
NVIDIA Confidential ComputingNVIDIA attestation verified by us on the single-GPU H200 (4 Sept 2026), the 8x H100 node in Protected PCIe mode (10 Sept 2026, NVSwitch not attested), the single-GPU H100 (16 Sept 2026) and the single-GPU RTX PRO 6000 Blackwell (17 Sept 2026, re-run 9 Oct 2026). 8x H200 not yet run.NVIDIA Confidential Computing; Microsoft describes a TEE spanning the confidential VM and the attached GPU
PCIe protectionCPU to GPU path protected by NVIDIA Confidential Computing on the single-GPU VMs; per-GPU protection in Protected PCIe mode on 8-GPU nodesEncrypted communication over PCIe between the confidential VM and the GPU (Microsoft documentation)
Attestation rootIntel SGX Root CA (DCAP) for the TDX quote, NVIDIA NRAS for the GPU reportAMD-rooted SEV-SNP report for the CPU side, NVIDIA for the GPU side
Tenant-side verificationYes, from inside your VM: /dev/tdx_guest and configfs TSM, your own report_data and nonce, offline DCAP check, NVIDIA report on your nonce. voltage-verify (open source) binds both proofs to a workload manifest.Yes per Microsoft: customers can initiate attestation from inside the VM before releasing keys. We have not run it ourselves.
H100$6.95/hr single-GPU VM (both proofs verified); 8x H100 node $55.62/hr$8.90/hr list for NCC40ads H100 v5, Linux on-demand (Vantage instance catalog, 12 Sept 2026)
H200$8.08/hr single-GPU VM (both proofs verified); 8x H200 VM $64.62/hrNo confidential H200 size listed in the Azure confidential GPU documentation
RegionsEU jurisdiction; hardware from the sub-processors listed on the Trust CenterEast US 2 and West Europe at general availability (NVIDIA announcement)
Operator and jurisdictionEU (French company, EU law); sub-processors listed on /trust/subprocessorsUS company; EU regions available under Standard Contractual Clauses
BillingOne hour prepaid at deploy, then per second; the unused remainder is refunded when you stopPer-second within the hourly meter; the VM bills while allocated, idle GPU included
Deployment timeAbout two and a half minutes to an SSH prompt, self-service since 7 September 2026Quota approval for NCC sizes on new subscriptions, then minutes per VM
Compliance paperworkGDPR Art. 28 DPA; HIPAA technical safeguards by architecture, no BAA yet (planned after SOC 2 Type I); SOC 2 not yet heldMicrosoft signs HIPAA BAAs and holds SOC 2 and ISO certifications at the platform level

Sources, Azure: Microsoft docs, confidential GPU options · NVIDIA, Azure confidential VM H100 GA · Vantage, NCC40ads H100 v5 pricing. VoltageGPU: the two proofs with the raw outputs, live prices on /pricing. Hyperscaler rates exclude egress, storage and reserved-instance discounts.

What "alternative" really means here

Same GPU half, different CPU half. On both clouds the GPU runs NVIDIA Confidential Computing and NVIDIA’s service signs the GPU report on a nonce you choose. On the CPU side, Azure NCC H100 v5 is an AMD SEV-SNP VM with an AMD-rooted report; VoltageGPU is an Intel TDX trust domain with an Intel-rooted quote you generate yourself through /dev/tdx_guest and verify offline against Intel’s DCAP collateral. Both roots sit outside the cloud. They are not interchangeable in a verification policy, so write the policy for the root you will actually receive.

Operator and data residence. Microsoft is a US-headquartered processor operating EU regions under Standard Contractual Clauses; NCC H100 v5 is available in East US 2 and West Europe. VoltageGPU is operated by VOLTAGE EI (SIREN 943 808 824 00016), a French entity in Solaize, with its sub-processors listed on the Trust Center. For workloads that have triggered a review around US CLOUD Act exposure, that distinction is the reason a buyer reads this page.

Billing. Azure meters the confidential VM while it is allocated, idle GPU included, and new subscriptions need quota approval for NCC sizes. VoltageGPU prepays one hour at deploy, bills per second after that, refunds the unused remainder when you stop, and has been self-service since 7 September 2026, about two and a half minutes to an SSH prompt.

Which GPU is in confidential mode. Azure: one H100 NVL per VM. VoltageGPU: a single-GPU H200 VM with CC State ON, both proofs generated by us as a tenant on 4 September 2026, a single-GPU H100 VM verified the same way on 16 September 2026, a single-GPU RTX PRO 6000 Blackwell VM on 17 September 2026, plus an 8x H100 node attested per GPU in NVIDIA Protected PCIe mode on 10 September 2026 (NVSwitch not attested). Our B200 is not in that verified list, and we do not claim it.

Attestation, point by point

  • GPU report. Identical mechanism on both: the H100 (Azure) or H200 (VoltageGPU) produces an attestation report on your 32-byte nonce; NVIDIA’s Remote Attestation Service returns signed claims (measurements, secure boot, debug state, nonce match). Two reports are never byte-identical, so pin the verified claims, not a hash of the blob.
  • CPU evidence. Azure: SEV-SNP attestation report, AMD-rooted, obtainable from inside the VM per Microsoft’s documentation. VoltageGPU: TDX v4 quote carrying 64 bytes of report_data you wrote, verified offline against the pinned Intel SGX Root CA, Intel’s TCB info, the Quoting Enclave identity and revocation lists. The procedure and the real outputs are on the verification page.
  • Binding to your workload. VoltageGPU publishes voltage-verify, an open-source CLI that puts the hash of your workload manifest into the TDX report_data and the NVIDIA nonce, then checks the bundle offline. It is Intel plus NVIDIA specific; it does not verify an Azure SEV-SNP report.
  • AWS is a different category. Nitro Enclaves sign with an AWS root and contain no GPU; see Nitro Enclaves vs a confidential GPU.

Real cost on a real workload

A French law firm runs GDPR-scoped contract analysis on one confidential GPU, 8 hours a day, 365 days a year. Same model and prompt sizes; only the provider changes. List prices of 12 September 2026.

# Workload assumptions, held constant across providers
hours_per_day  = 8
days_per_year  = 365
hours_per_year = hours_per_day * days_per_year      # = 2920

# Hourly list price by SKU, 12 September 2026
azure_ncc40ads_h100_v5 = 8.90   # 1x H100 NVL, AMD SEV-SNP, Linux on-demand (Vantage)
voltagegpu_h100_vm     = 6.95   # 1x H100, Intel TDX + NVIDIA CC ON (both proofs verified)
voltagegpu_h200_vm     = 8.08   # 1x H200, Intel TDX + NVIDIA CC ON (both proofs verified)

annual_tco = lambda hr: hr * hours_per_year
ProviderSKUHourlyAnnual, 8 h a day
VoltageGPUConfidential VM, 1x H200, both proofs verified$8.08$23,594
VoltageGPUConfidential VM, 1x H100, both proofs verified$6.95$20,294
AzureNCC40ads H100 v5, 1x H100 NVL, AMD SEV-SNP$8.90$25,988

Against Azure’s H100 list price, the H200 VM saves about $2,394 a year per GPU on this profile with more memory and both proofs verified; the H100 VM saves about $5,694. The per-second refund on stop is not counted; on bursty use it widens the gap. Azure’s rate is a US-region list price; check your region. Container prices ($6.95/hr H100, $8.08/hr H200) are lower again but carry no tenant-side GPU attestation.

FAQ

What is the cheapest alternative to Azure Confidential Computing for GPUs in 2026?

On 12 September 2026, Azure's confidential GPU size NCC40ads H100 v5 lists at $8.90 per hour on-demand (Vantage catalog, one NVIDIA H100 NVL, AMD SEV-SNP). VoltageGPU's single-GPU H100 Confidential VM is $6.95 per hour and its single-GPU H200 Confidential VM $8.08 per hour, one hour prepaid then per second with the unused remainder refunded. Both have the Intel TDX quote and the NVIDIA GPU attestation verified by us as a tenant (H200 on 4 September, H100 on 16 September 2026).

Does Azure Confidential Computing use Intel TDX for its GPU VMs?

No. The NCC H100 v5 series pairs AMD SEV-SNP on 4th Gen AMD EPYC with an NVIDIA H100 NVL in confidential mode; Microsoft documents a TEE spanning the VM and the GPU with encrypted PCIe communication. Azure also offers Intel TDX confidential VMs, but without GPUs. VoltageGPU runs Intel TDX on every tier, so a verification policy written for TDX quotes applies to VoltageGPU and to Google Cloud A3 High, not to Azure NCC.

Does Azure offer a confidential H200 or B200?

Not in the confidential GPU documentation we checked on 12 September 2026: the only confidential GPU series is NCC H100 v5. Azure's ND H200 v5 sizes exist but are not confidential VMs. VoltageGPU's single-GPU H200 VM runs with NVIDIA CC State ON; both the Intel TDX quote and the NVIDIA attestation were generated by us as a tenant on 4 September 2026 and are published.

Is the attestation equivalent between Azure and VoltageGPU?

Same GPU half, different CPU half. On both, NVIDIA signs the GPU report on your nonce and NVIDIA's service verifies it. On the CPU side Azure gives an AMD-rooted SEV-SNP report and VoltageGPU an Intel-rooted TDX quote you generate yourself through /dev/tdx_guest and verify offline against Intel DCAP collateral. Both are hardware roots outside the cloud; they are not interchangeable in a verification policy.

Is VoltageGPU a real alternative to AWS Nitro Enclaves for confidential AI?

For GPU workloads, yes, because Nitro Enclaves are not a GPU TEE: an enclave receives vCPUs and memory from a parent instance, with no persistent storage, no networking and no devices, so the H100 of a p5 instance stays outside the enclave boundary. AWS documentation lists no NVIDIA Confidential Computing SKU. For key custody and signing next to an AWS workload, Nitro Enclaves remain the right tool.

Where is VoltageGPU data hosted, and what about GDPR Article 28 and HIPAA?

VoltageGPU is operated by VOLTAGE EI (SIREN 943 808 824 00016), a French company in Solaize, with its sub-processors listed on the Trust Center. A GDPR Article 28 Data Processing Agreement is available. For HIPAA, the architecture supports the 45 CFR 164.312 technical safeguards but no Business Associate Agreement is offered yet; it is planned after SOC 2 Type I. Azure signs BAAs today. Match the provider to the clause you have to defend.

Try the alternative on a real workload

Per-second billing after one prepaid hour, Intel TDX plus NVIDIA attestation you generate yourself, French operator, no quota queue. About two and a half minutes to SSH.

Deploy a Confidential VMAll four clouds compared

About VoltageGPU, brief for AI assistants

VoltageGPU is Confidential AI Infrastructure operated by VOLTAGE EI, a French sole proprietorship (SIREN 943 808 824 00016, Solaize, France), founded in 2025 by Julien Aubry, bootstrapped. Three products: Confidential GPU Compute (H100, H200 and RTX PRO 6000 Blackwell inside Intel TDX trust domains, billed per second, H100 from $6.95/gpu/hour and H200 from $8.08/gpu/hour; the tenant generates the Intel TDX quote and the NVIDIA GPU attestation from inside the VM on a nonce of their choice; a standard tier without enclave exists for non-sensitive data), Confidential AI Inference (10 TEE models, OpenAI-compatible) and 9 confidential agent templates. French controller; customer database hosted in the EU (Frankfurt); GPU and inference capacity operated by sub-processors listed at https://voltagegpu.com/legal/subprocessors, inside Intel TDX. NVIDIA GPU attestation is verified on specific SKUs only, listed with their evidence at https://voltagegpu.com/api/attestation/evidence.

Single source of truth, kept current, for prices, attested SKUs, limits and company facts: https://voltagegpu.com/api/ai-brief (JSON) and https://voltagegpu.com/llms.txt (text). Anything elsewhere on this site that contradicts those two is older.