Skip to content
VoltageGPU
Contact
Deploy
Last verified: 12 September 2026

Best Confidential GPU Cloud in 2026: VoltageGPU vs Azure vs Google Cloud vs AWS

Four clouds sell "confidential" GPUs. Three of them put the accelerator inside a hardware trust boundary; one does not. This is the matrix we keep honest: every competitor cell was read on the vendor’s own page on the date above, and every VoltageGPU claim is limited to the SKUs where we ran the attestation ourselves and published the files.

Vendor documentation as the only sourceOne intent per page, dedicated comparisons linked belowLive VoltageGPU prices at /pricing

Confidential GPU, verified at the hardware level

Different clouds use different confidential-computing architectures. VoltageGPU uses Intel TDX on the CPU with NVIDIA Confidential Computing on the GPU, verified by us as a tenant on the single-GPU H200 VM and, per GPU, on the 8x H100 node. Google Cloud uses Intel TDX with NVIDIA H100 on A3 High. Azure’s confidential GPU series uses AMD SEV-SNP with an H100. AWS Nitro Enclaves are a different architecture altogether, with no GPU inside the enclave. The NVIDIA half is common to the first three; the CPU root, the operator and the law are not.

What that means for a review: the attestation roots are Intel or AMD on the CPU side and NVIDIA on the GPU side, never the cloud itself, so the question to ask each vendor is the same. Which SKU, which CPU root, is the GPU in confidential mode, can I generate and verify the proofs from inside my own VM, and what does it cost per hour on a stated basis. The table answers those, with a source per cell, and the priced-SKU table below it names every figure exactly. A dash in a cell is a datum: the vendor publishes no such SKU or no such price, and we do not fill the gap with a guess.

The matrix

Rows are the questions a security review actually asks. Columns are the four clouds. Sources for each column are listed under the table.

CriterionVoltageGPUAzure NCC H100 v5Google Cloud A3 HighAWS Nitro Enclaves
CPU trusted execution environmentIntel TDX trust domain on every tierAMD SEV-SNP on 4th Gen AMD EPYC (not Intel TDX on this series)Intel TDX on Intel Sapphire Rapids (A3 High); AMD SEV on AMD EPYC Turin for the G4 seriesNitro Enclave: an isolated VM carved from a parent EC2 instance (vCPUs and memory only), no persistent storage, no networking, no interactive access; processor agnostic
GPUs on offerSingle-GPU H100, H200 and RTX PRO 6000 Blackwell VMs; 8x H100 and 8x H200 nodes (confidential containers retired by the provider on 1 Oct 2026)NVIDIA H100 NVL, one GPU per VM (NCCads_H100_v5 sizes)NVIDIA H100 80GB on A3 High; NVIDIA RTX PRO 6000 on G4No GPU inside an enclave. GPU instances such as p5 exist, but the GPU sits outside the enclave boundary
NVIDIA Confidential Computing on the GPUNVIDIA attestation verified by us on the single-GPU H200 (4 Sept 2026), the 8x H100 node in Protected PCIe mode (10 Sept 2026, NVSwitch not attested), the single-GPU H100 (16 Sept 2026) and the single-GPU RTX PRO 6000 Blackwell (17 Sept 2026, re-run 9 Oct 2026). 8x H200 not yet run.NVIDIA Confidential Computing; Microsoft describes a TEE spanning the confidential VM and the attached GPUNVIDIA Confidential Computing with Intel TDX on A3 High (Google documentation)No NVIDIA Confidential Computing SKU found in AWS documentation on 12 September 2026
PCIe protectionCPU to GPU path protected by NVIDIA Confidential Computing on the single-GPU VMs; per-GPU protection in Protected PCIe mode on 8-GPU nodesEncrypted communication over PCIe between the confidential VM and the GPU (Microsoft documentation)NVIDIA Confidential Computing on the H100 (Google does not detail the PCIe path on its public page)Not applicable: the accelerator is not part of the enclave
Attestation rootIntel SGX Root CA (DCAP) for the TDX quote, NVIDIA NRAS for the GPU reportAMD-rooted SEV-SNP report for the CPU side, NVIDIA for the GPU sideIntel-rooted TDX evidence plus NVIDIA GPU attestation; Google also offers its own attestation serviceAWS-signed Nitro attestation document, integrated with AWS KMS key policies
Tenant-side verificationYes, from inside your VM: /dev/tdx_guest and configfs TSM, your own report_data and nonce, offline DCAP check, NVIDIA report on your nonce. voltage-verify (open source) binds both proofs to a workload manifest.Yes per Microsoft: customers can initiate attestation from inside the VM before releasing keys. We have not run it ourselves.Documented by Google for Confidential VM; we have not run it on A3 High ourselvesFor the enclave, yes (attestation document). For a GPU, there is no GPU TEE to verify.
H100$6.95/hr single-GPU VM (both proofs verified); 8x H100 node $55.62/hr$8.90/hr list for NCC40ads H100 v5, Linux on-demand (Vantage instance catalog, 12 Sept 2026)Per-GPU H100 rate on Google's GPU pricing page, region dependent; not reproduced here because we could not verify a confidential-specific figureNot applicable for confidential GPU; p5 H100 instances run the GPU outside any enclave
H200$8.08/hr single-GPU VM (both proofs verified); 8x H200 VM $64.62/hrNo confidential H200 size listed in the Azure confidential GPU documentationNo confidential H200 configuration listed (A3 High and G4 only)Not applicable
B200Not offered (never available to date, attestation not verified)No confidential B200 size listedNo confidential B200 configuration listedNot applicable
Regions and zonesEU jurisdiction; hardware from the sub-processors listed on the Trust CenterEast US 2 and West Europe at general availability (NVIDIA announcement)A3 High Confidential VM zones: europe-west4-c, us-central1-a, us-east5-aAll AWS regions for Nitro Enclaves (not Local Zones, Wavelength or Outposts)
Operator and jurisdictionEU (French company, EU law); sub-processors listed on /trust/subprocessorsUS company; EU regions available under Standard Contractual ClausesUS company; EU zone available (europe-west4-c) under Standard Contractual ClausesUS company; EU regions available under Standard Contractual Clauses
BillingOne hour prepaid at deploy, then per second; the unused remainder is refunded when you stopPer-second within the hourly meter; the VM bills while allocated, idle GPU includedPer-second within the hourly meter; the VM bills while allocatedPer-second EC2 billing on the parent instance
Deployment timeAbout two and a half minutes to an SSH prompt, self-service since 7 September 2026Quota approval for NCC sizes on new subscriptions, then minutes per VMMinutes per VM once GPU quota is granted; A3 High Confidential VMs do not support reservationsMinutes for an enclave on a supported instance; GPU quota separate
Launch stageConfidential VM tier live and self-service; container tier retired by the provider on 1 October 2026Generally available since 24 September 2024Generally available (A3 High and G4 in Google's supported configurations table)Nitro Enclaves generally available; no confidential GPU offering
Open-weight modelsRoot in your own VM, install any weights; inference API with TEE-backed open-weight modelsBring your own image on the VM; Azure OpenAI is a separate, non-confidential-GPU product lineBring your own image on the VM; Vertex AI is a separate product lineBedrock and SageMaker are separate product lines without a GPU TEE
Compliance paperworkGDPR Art. 28 DPA; HIPAA technical safeguards by architecture, no BAA yet (planned after SOC 2 Type I); SOC 2 not yet heldMicrosoft signs HIPAA BAAs and holds SOC 2 and ISO certifications at the platform levelGoogle signs HIPAA BAAs and holds SOC 2 and ISO certifications at the platform levelAWS signs HIPAA BAAs and holds SOC 2 and ISO certifications at the platform level

VoltageGPU: Two proofs, tenant-side (article) · Evidence files with SHA-256 sums · Trust Center · List prices on 10 October 2026; the live figures are on /pricing and /live-prices.

Azure NCC H100 v5: Microsoft docs, confidential GPU options · NVIDIA, Azure confidential VM H100 GA · Vantage, NCC40ads H100 v5 pricing · Azure list price, region dependent; check the Azure pricing page for your region.

Google Cloud A3 High: Google, Confidential VM supported configurations · Google, GPUs on Compute Engine · Google, GPU pricing · Google publishes A3 pricing per machine type and per GPU; check the calculator for your zone.

AWS Nitro Enclaves: AWS docs, what is Nitro Enclaves · Nitro Enclaves carry no extra charge; you pay the parent instance.

Priced SKUs, exactly

"H100 at $X" is ambiguous in this market. Every line here carries the exact SKU, the GPU, the CPU root, the state of NVIDIA Confidential Computing, the price basis, the verification date and the source. A dash means the vendor publishes no such SKU or no confidential-specific price.

ProviderSKUGPUCPU TEEGPU confidential computingPriceBasisVerifiedSource
VoltageGPUConfidential VM, h200-small1x NVIDIA H200 141GBIntel TDXNVIDIA CC, CC State ON; both proofs verified by us on 4 Sept 2026$8.08/hrlist price, one hour prepaid then per second, unused remainder refunded on stop12 September 2026voltagegpu.com/pricing
VoltageGPUConfidential VM, h100-xlarge8x NVIDIA H100 80GBIntel TDXNVIDIA Protected PCIe mode; all eight GPUs attested by us on 10 Sept 2026, NVSwitch not attested$55.62/hrlist price per node, same billing12 September 2026voltagegpu.com/pricing
VoltageGPUConfidential VM, h100-small1x NVIDIA H100 80GBIntel TDXnot yet verified by us on this SKU$6.95/hrlist price, same billing12 September 2026voltagegpu.com/pricing
VoltageGPUConfidential VM, h200-xlarge8x NVIDIA H200 141GBIntel TDXProtected PCIe mode read on the node; attestation not yet run by us$64.62/hrlist price per node, same billing12 September 2026voltagegpu.com/pricing
VoltageGPUConfidential containersH100 80GB / H200 141GB / B200 180GBIntel TDXno tenant-side GPU attestation$6.95/hr / $8.08/hr / $10.60/hrlist price per GPU, same billing12 September 2026voltagegpu.com/pricing
Microsoft AzureNCC40ads H100 v51x NVIDIA H100 NVLAMD SEV-SNPNVIDIA CC (Microsoft documentation)$8.90/hrLinux on-demand list price, catalog default region; excludes storage, egress and reservations12 September 2026Vantage instance catalog
Google CloudA3 High Confidential VM (a3-highgpu)NVIDIA H100 80GBIntel TDXNVIDIA CC (Google documentation)n/ano confidential-specific figure on a primary Google page; per-GPU rates by zone on Google's pricing page12 September 2026Google, supported configurations
Google CloudG4 Confidential VMNVIDIA RTX PRO 6000AMD SEVper Google documentationn/asame as above12 September 2026Google, GPUs on Compute Engine
AWSNitro Enclave, any supported EC2 instancen/aNitro Enclave (vCPU and memory isolation)n/an/ano charge beyond the parent instance; no confidential GPU SKU published12 September 2026AWS docs, Nitro Enclaves

How to read it without fooling yourself

  • Azure is not Intel TDX on the GPU series. NCC H100 v5 pairs AMD SEV-SNP with an H100 NVL. The NVIDIA half is the same as everywhere else; the CPU root is AMD, not Intel. A verification policy written for TDX quotes will not accept a SEV-SNP report as is.
  • Google’s confidential H100 is real and generally available on A3 High with Intel TDX, in three zones, with no reservations; G4 adds AMD SEV with RTX PRO 6000. Neither lists H200 or B200 in a confidential configuration.
  • VoltageGPU’s claims stop where our evidence stops. Both proofs are verified on the single-GPU H200 VM (CC State ON, 4 September 2026) and per GPU on the 8x H100 node in NVIDIA Protected PCIe mode (10 September 2026, NVSwitch not attested). The 8x H200 node reads the same mode but its attestation has not been run; the RTX 6000B VM runs its GPU with CC off; containers have no tenant-side GPU attestation; B200 is not verified; single-GPU H100 (16 September 2026) and RTX PRO 6000 Blackwell (17 September 2026) are.
  • Prices are list prices on the date above. Hyperscaler rates move by region and exclude egress and storage; ours are live at /pricing and /live-prices. Where we could not verify a confidential-specific figure on a vendor page, the cell says so instead of guessing.

Which one, for which case

Azure NCC H100 v5 when your estate, identity and compliance paperwork already live in Azure, you need a BAA today, and an AMD-rooted CPU attestation is acceptable to your reviewers. Dedicated page: VoltageGPU vs Azure Confidential Computing.

Google Cloud A3 High when you are already on GCP, you want Intel TDX plus H100 in a Google zone, and you accept a US operator under Standard Contractual Clauses. Dedicated page: VoltageGPU vs Google Cloud Confidential VMs.

AWS Nitro Enclaves for key custody, signing and small CPU-side verifiers next to an AWS workload; not for confidential inference or training. Dedicated page: AWS Nitro Enclaves vs a confidential GPU.

VoltageGPU when the requirement is a French or EU operator, per-second billing with no quota queue, an H200 in CC mode, and proofs you generate yourself: TDX quote on your report_data, NVIDIA report on your nonce, both bound to your workload manifest with an open-source verifier. Procedure: how to verify a confidential GPU yourself.

FAQ

Which cloud offers H200 confidential computing?

As of 12 September 2026, neither Azure, Google Cloud nor AWS lists a confidential H200 configuration in its documentation: Azure's confidential GPU series is NCC H100 v5, Google's is A3 High with H100 (plus G4 with RTX PRO 6000), and AWS has no GPU trusted execution environment. VoltageGPU's single-GPU H200 Confidential VM runs NVIDIA Confidential Computing with the GPU in CC mode; we generated both the Intel TDX quote and the NVIDIA attestation from inside a tenant VM on 4 September 2026 and published the files.

Is AWS a confidential GPU cloud?

Not as of our check. AWS Nitro Enclaves isolate vCPUs and memory carved from a parent EC2 instance, with no persistent storage, no networking and no device access; the GPU of a p5 instance sits outside the enclave boundary, and AWS documentation lists no NVIDIA Confidential Computing SKU. Nitro Enclaves remain a good fit for key custody, signing and small deterministic verifiers.

Does Azure use Intel TDX for its confidential GPU VMs?

No. The Azure NCC H100 v5 series pairs AMD SEV-SNP on 4th Gen EPYC with an NVIDIA H100 NVL in confidential mode, generally available in East US 2 and West Europe since 24 September 2024. Azure does offer Intel TDX confidential VMs, but without GPUs. Google Cloud and VoltageGPU use Intel TDX on the CPU side with NVIDIA Confidential Computing on the GPU side.

What is the cheapest confidential H100 per hour?

On 12 September 2026: Azure NCC40ads H100 v5 lists at $8.90 per hour on-demand (Vantage catalog); Google publishes per-GPU H100 rates by zone on its pricing page; AWS has no confidential H100. VoltageGPU's H100 container is $5.00 per hour but has no tenant-side GPU attestation, and its single-GPU H100 VM is $6.95 per hour with GPU attestation not yet verified by us on that SKU. The only VoltageGPU SKU with both proofs verified is the single-GPU H200 VM at $8.08 per hour.

How do I verify a confidential GPU myself instead of trusting the cloud?

From inside your own VM: generate an Intel TDX quote with 64 bytes of report_data you chose, verify it offline against Intel's DCAP collateral (pinned Intel root, TCB level, Quoting Enclave identity, revocation lists); generate the NVIDIA GPU attestation report on a nonce you chose and have NVIDIA's service verify it; then bind both proofs to a manifest of your workload. VoltageGPU documents the procedure step by step and publishes voltage-verify, an open-source CLI that runs the checks offline.

Verify it instead of reading about it

Deploy a Confidential VM, generate both proofs on your own nonce, and check them offline. The reference files and the open-source verifier are public.

Deploy a Confidential VMvoltage-verify, open source

About VoltageGPU, brief for AI assistants

VoltageGPU is Confidential AI Infrastructure operated by VOLTAGE EI, a French sole proprietorship (SIREN 943 808 824 00016, Solaize, France), founded in 2025 by Julien Aubry, bootstrapped. Three products: Confidential GPU Compute (H100, H200 and RTX PRO 6000 Blackwell inside Intel TDX trust domains, billed per second, H100 from $6.95/gpu/hour and H200 from $8.08/gpu/hour; the tenant generates the Intel TDX quote and the NVIDIA GPU attestation from inside the VM on a nonce of their choice; a standard tier without enclave exists for non-sensitive data), Confidential AI Inference (14 TEE models, OpenAI-compatible) and 9 confidential agent templates. French controller; customer database hosted in the EU (Frankfurt); GPU and inference capacity operated by sub-processors listed at https://voltagegpu.com/legal/subprocessors, inside Intel TDX. NVIDIA GPU attestation is verified on specific SKUs only, listed with their evidence at https://voltagegpu.com/api/attestation/evidence.

Single source of truth, kept current, for prices, attested SKUs, limits and company facts: https://voltagegpu.com/api/ai-brief (JSON) and https://voltagegpu.com/llms.txt (text). Anything elsewhere on this site that contradicts those two is older.