VoltageGPU vs Modal

Short answer for the people who typed "modal hipaa" or "modal dpa": yes on both. Modal's security guide states that a Business Associate Agreement should be established before any PHI is submitted, and that it has completed a SOC 2 Type 2 audit. Its Data Processing Addendum, effective 31 October 2025, incorporates the EU Standard Contractual Clauses by reference, is governed by Swedish law for GDPR matters, and commits Modal not to transfer personal data outside the EEA or the UK without the customer's prior written consent. Read on 17 September 2026 at modal.com/docs/guide/security and modal.com/legal/dpa. For a US startup selling serverless compute, that is a serious compliance file.

What it covers is the contractual layer and the audited controls. What it does not cover is the hardware layer: Modal runs your code in gVisor, a sandbox that isolates your container from other tenants and from the host kernel. It is a good sandbox. It is not a trusted execution environment: the operator still controls the host, and nothing in a sandbox lets you prove to a third party that the operator could not read your GPU memory. The BAA promises they will not; the silicon does not enforce it. For most workloads that is fine and the promise is enough. For the ones where the regulator asks for the technical measure, it is the boundary of what Modal sells.

Modal's product is the abstraction: you never see a VM, you decorate a Python function, and Modal schedules it on a GPU with per-second billing and scale-to-zero. That abstraction is exactly what makes it fast to adopt and cheap to run bursty workloads, and it is also why you cannot bring your own attestation to it. The machine is Modal's, the boot chain is Modal's, and there is no device in your container that signs a quote on your behalf.

VoltageGPU sells the opposite shape. A Confidential VM is a full Ubuntu machine inside an Intel TDX trust domain, with root over SSH on a key you register, /dev/tdx_guest exposed to you, and the GPU passed through into the domain. You generate the Intel TDX quote over 64 bytes you choose and verify it offline against Intel; on the verified SKUs you generate the NVIDIA GPU attestation report over your own nonce and verify it with NVIDIA. The contracting entity is VOLTAGE EI, a French sole proprietorship. The whole thing is driven by API key if you script it, and it boots in about two and a half minutes, which is slow compared to a Modal cold start and is the price of a real machine.

On list price for the GPU alone, Modal is cheaper: $3.95 per hour for an H100 and $4.54 for an H200 (per-second, containers, no TEE, read 17 September 2026) against $5.00/hr and $6.58/hr for confidential VMs on VoltageGPU. The gap is the confidential stack. If your workload is not confidential, do not pay it.

For developer experience Modal is in a different league: seconds to first call, automatic scaling, batch and scheduled jobs, web endpoints, and a pricing model that charges only for the seconds a function runs. It sells B200 today and it has the audit paperwork we do not: VoltageGPU has no SOC 2 report and does not sign a HIPAA BAA. If your reviewer's first question is "SOC 2?" or "BAA?", Modal answers yes and we answer no, and you should tell them that plainly.

Modal also wins for anything that is naturally a function rather than a machine: an inference endpoint that sleeps between calls, a nightly batch, a webhook that needs a GPU for four seconds. Running that on a VM that bills an hour upfront, even with a per-second refund, is the wrong tool.

A sandbox and a trust domain protect against different adversaries. gVisor protects you from other tenants and limits what your code can do to the host. Intel TDX protects the guest from the host: memory is encrypted with a key the hypervisor does not hold, and the attestation lets you prove that state to someone else. If your threat model is "another customer's code", Modal's sandbox is the right answer and it is cheaper. If your threat model includes "the operator, an insider, or a subpoena served on the operator", a sandbox does not change what the host can see, and that is the case VoltageGPU is built for.

The pragmatic design for a regulated team is often both: Modal for everything bursty on non-sensitive data, and a VoltageGPU confidential VM for the step where identifiable data is decrypted in GPU memory. This page exists so the line is visible before you build on either side of it.