Sandboxed function vs attested enclave

VoltageGPU vs Modal

Modal is a US serverless GPU platform (Modal Labs, Inc.) that runs functions and containers on NVIDIA GPUs with per-second billing and gVisor sandboxing. It publishes a DPA with EU Standard Contractual Clauses and signs BAAs for HIPAA workloads. Its security documentation does not mention confidential computing or hardware attestation.

Modal gives you the best developer experience in GPU compute: a Python decorator, a container, per-second billing, SOC 2 Type 2, a BAA and a DPA. VoltageGPU gives you a full VM inside an Intel TDX trust domain with an attestation you generate yourself. A sandbox isolates your code from other tenants; a trust domain isolates it from the operator too. Those are different guarantees, and this page says which one you are buying.

Pick Modal if

You want to deploy a Python function on a GPU in minutes and scale it to zero
A SOC 2 Type 2 report, a BAA or a DPA with SCCs is what your reviewer asks for
Bursty inference, batch jobs, cron-style workloads where per-second serverless billing wins
You do not need root, a persistent VM, or your own attestation

Pick VoltageGPU if

Identifiable data is decrypted in GPU memory and the operator must be provably unable to read it
You need a full VM with root, your own SSH key, and the attestation device in your hands
A French controller on the contract, with an Intel TDX quote and a NVIDIA report on your own nonce
Your compliance question is about the hardware boundary, not about the vendor's audit

Headline pricing

Hourly list price per GPU SKU. A dash means the SKU is not publicly available from that provider. VoltageGPU prices are the canonical confidential-compute floor and stay in sync with /pricing.

GPU	VRAM	VoltageGPU	Modal
NVIDIA H100	80 GB	$6.95/hr Intel TDX confidential	$3.95/hr H100 SXM, $0.001097 per second, containers, no TEE, read 17 Sept 2026
NVIDIA H200	141 GB	$8.08/hr Intel TDX confidential	$4.54/hr H200 SXM, $0.001261 per second, containers, no TEE, read 17 Sept 2026

Confidential techIntel TDX + trust-domain GPU isolationNot offered per its security guide (gVisor sandboxing, no Intel TDX, no GPU TEE)

AttestationIntel DCAPNone listed

BillingPer-second, no commitPer-second, serverless containers, not VMs

OperatorVOLTAGE EI (France)Modal Labs, Inc. (US); DPA governed by Swedish law for GDPR matters

Setup~5 min, SSH-readySeconds to first function call, cold starts apply

JurisdictionFrench company, GDPR Art. 28; compute at US sub-processors (SCCs)US company

Modal HIPAA, BAA and DPA: what they cover, in plain terms

Short answer for the people who typed "modal hipaa" or "modal dpa": yes on both. Modal's security guide states that a Business Associate Agreement should be established before any PHI is submitted, and that it has completed a SOC 2 Type 2 audit. Its Data Processing Addendum, effective 31 October 2025, incorporates the EU Standard Contractual Clauses by reference, is governed by Swedish law for GDPR matters, and commits Modal not to transfer personal data outside the EEA or the UK without the customer's prior written consent. Read on 17 September 2026 at modal.com/docs/guide/security and modal.com/legal/dpa. For a US startup selling serverless compute, that is a serious compliance file.

What it covers is the contractual layer and the audited controls. What it does not cover is the hardware layer: Modal runs your code in gVisor, a sandbox that isolates your container from other tenants and from the host kernel. It is a good sandbox. It is not a trusted execution environment: the operator still controls the host, and nothing in a sandbox lets you prove to a third party that the operator could not read your GPU memory. The BAA promises they will not; the silicon does not enforce it. For most workloads that is fine and the promise is enough. For the ones where the regulator asks for the technical measure, it is the boundary of what Modal sells.

A function you call versus a machine you hold

Modal's product is the abstraction: you never see a VM, you decorate a Python function, and Modal schedules it on a GPU with per-second billing and scale-to-zero. That abstraction is exactly what makes it fast to adopt and cheap to run bursty workloads, and it is also why you cannot bring your own attestation to it. The machine is Modal's, the boot chain is Modal's, and there is no device in your container that signs a quote on your behalf.

VoltageGPU sells the opposite shape. A Confidential VM is a full Ubuntu machine inside an Intel TDX trust domain, with root over SSH on a key you register, /dev/tdx_guest exposed to you, and the GPU passed through into the domain. You generate the Intel TDX quote over 64 bytes you choose and verify it offline against Intel; on the verified SKUs you generate the NVIDIA GPU attestation report over your own nonce and verify it with NVIDIA. The contracting entity is VOLTAGE EI, a French sole proprietorship. The whole thing is driven by API key if you script it, and it boots in about two and a half minutes, which is slow compared to a Modal cold start and is the price of a real machine.

On list price for the GPU alone, Modal is cheaper: $3.95 per hour for an H100 and $4.54 for an H200 (per-second, containers, no TEE, read 17 September 2026) against $6.95/hr and $8.08/hr for confidential VMs on VoltageGPU. The gap is the confidential stack. If your workload is not confidential, do not pay it.

Where Modal wins, and it is not close

For developer experience Modal is in a different league: seconds to first call, automatic scaling, batch and scheduled jobs, web endpoints, and a pricing model that charges only for the seconds a function runs. It sells B200 today and it has the audit paperwork we do not: VoltageGPU has no SOC 2 report and does not sign a HIPAA BAA. If your reviewer's first question is "SOC 2?" or "BAA?", Modal answers yes and we answer no, and you should tell them that plainly.

Modal also wins for anything that is naturally a function rather than a machine: an inference endpoint that sleeps between calls, a nightly batch, a webhook that needs a GPU for four seconds. Running that on a VM that bills an hour upfront, even with a per-second refund, is the wrong tool.

Where the sandbox ends and the enclave begins

A sandbox and a trust domain protect against different adversaries. gVisor protects you from other tenants and limits what your code can do to the host. Intel TDX protects the guest from the host: memory is encrypted with a key the hypervisor does not hold, and the attestation lets you prove that state to someone else. If your threat model is "another customer's code", Modal's sandbox is the right answer and it is cheaper. If your threat model includes "the operator, an insider, or a subpoena served on the operator", a sandbox does not change what the host can see, and that is the case VoltageGPU is built for.

The pragmatic design for a regulated team is often both: Modal for everything bursty on non-sensitive data, and a VoltageGPU confidential VM for the step where identifiable data is decrypted in GPU memory. This page exists so the line is visible before you build on either side of it.

FAQ

Is Modal HIPAA compliant?

Modal states in its security guide (read 17 September 2026) that a Business Associate Agreement should be established before any PHI is submitted, and it has completed a SOC 2 Type 2 audit. That is the contractual baseline US healthcare buyers expect, and for PHI handled with appropriate controls it is the standard market posture. What the BAA does not provide is hardware evidence that the operator cannot read PHI in GPU memory: Modal runs workloads in a gVisor sandbox on hosts it controls, which is not a trusted execution environment. For PHI processed in the clear at inference time, the architectural alternative is Intel TDX with GPU passthrough and a tenant-generated attestation, which is what VoltageGPU provides, without a BAA.

Does Modal have a DPA and is it GDPR compliant?

Yes. Modal publishes a Data Processing Addendum, effective 31 October 2025, that incorporates the EU Standard Contractual Clauses by reference, is governed by Swedish law for GDPR matters, and prohibits transfers outside the EEA or the UK without the customer's written consent. Its sub-processors are listed on its trust center. That covers the GDPR Article 28 contractual requirement for most AI workloads. It does not cover the technical measure some regulators now require for Article 9 data, hardware enforcement that the operator cannot read workload memory, which a sandbox does not provide and an Intel TDX trust domain does.

Does Modal offer confidential computing or a TEE?

Its security guide, read on 17 September 2026, describes gVisor sandboxing and does not mention confidential computing, a trusted execution environment, Intel TDX, AMD SEV, NVIDIA confidential computing or hardware attestation. A sandbox isolates tenants from each other; it does not isolate the guest from the operator. VoltageGPU runs every confidential VM inside an Intel TDX trust domain and has verified NVIDIA GPU attestation from inside the VM on single-GPU H200, 8x H100, single-GPU H100 and single-GPU RTX PRO 6000 Blackwell machines, with the evidence published for all of them.

Which is cheaper, VoltageGPU or Modal?

Modal is cheaper per GPU-hour: $3.95 for H100, $4.54 for H200 and $6.25 for B200, billed per second in containers (no TEE, read 17 September 2026), against $6.95/hr and $8.08/hr for confidential VMs on VoltageGPU. For bursty workloads the gap widens further because Modal scales to zero. VoltageGPU bills one hour upfront and refunds the unused part per second, so a short confidential run costs what it uses, but a VM is the wrong tool for a function that runs four seconds an hour.

Does VoltageGPU have SOC 2 or sign a BAA like Modal?

No. VoltageGPU has no SOC 2 report and does not sign a HIPAA Business Associate Agreement today. It offers hardware evidence instead: an Intel TDX quote you verify offline against Intel and a NVIDIA GPU attestation report you verify with NVIDIA, both on nonces you choose, plus an open-source verifier, voltage-verify, to reproduce it. Some reviewers accept that as the stronger technical measure; others need the report. Ask yours which one they need before choosing either provider.

Serverless function or attested machine, pick the right tool

Modal is the right answer for fast, bursty GPU work with a BAA and a DPA on file. VoltageGPU is the right answer when someone has to prove the operator cannot read the GPU while it runs. Start a confidential VM in a few minutes or read how the attestation works.

Start a confidential VM How the attestation works