EU processor vs attested enclave

VoltageGPU vs Nebius

Nebius is a European GPU provider headquartered in Amsterdam, selling on-demand and reserved NVIDIA H100, H200 and B200 capacity with a broad certification portfolio. Its trust center does not mention confidential computing or hardware attestation offered to tenants.

Nebius has the certifications; VoltageGPU has the proof. Nebius operates as an EU data processor under GDPR with SOC 2 Type II, HIPAA and a long ISO list. VoltageGPU runs your GPU inside an Intel TDX trust domain and hands you an attestation you verify yourself. One answers the reviewer who wants reports; the other answers the reviewer who wants evidence.

Pick Nebius if

Your reviewer wants a SOC 2 Type II report, an ISO 27001 certificate or a signed BAA
Large reserved clusters, managed Kubernetes, object storage, one vendor
EU data residency by region selection is the requirement, not memory isolation
Lowest hourly price on H100 and H200 without a TEE

Pick VoltageGPU if

The question is "can the operator read the model or the data while it runs", and the answer must be provable
Client files, health records or GDPR Article 9 data are decrypted in GPU memory
You want an Intel TDX quote and a NVIDIA GPU attestation report generated on your own nonce
A French controller entity on the contract, and an hour of GPU for a test rather than a quota request

Headline pricing

Hourly list price per GPU SKU. A dash means the SKU is not publicly available from that provider. VoltageGPU prices are the canonical confidential-compute floor and stay in sync with /pricing.

GPU	VRAM	VoltageGPU	Nebius
NVIDIA H100	80 GB	$6.95/hr Intel TDX confidential	$3.85/hr HGX H100 on demand, no TEE, read 17 Sept 2026
NVIDIA H200	141 GB	$8.08/hr Intel TDX confidential	$4.50/hr HGX H200 on demand, no TEE, read 17 Sept 2026

Confidential techIntel TDX + trust-domain GPU isolationNot listed on the trust center (no Intel TDX, no GPU TEE mentioned)

AttestationIntel DCAPNone listed

BillingPer-second, no commitOn-demand and preemptible hourly list prices, reserved contracts

OperatorVOLTAGE EI (France)Nebius, Amsterdam, Netherlands (EU data processor)

Setup~5 min, SSH-readyMinutes for on-demand VMs, subject to quota

JurisdictionFrench company, GDPR Art. 28; compute at US sub-processors (SCCs)See operator

Nebius GDPR and HIPAA: what the certifications cover

Short answer for the people who typed "nebius gdpr" or "nebius hipaa": Nebius states on its trust center that it operates as an EU data processor under GDPR, holds SOC 2 Type II with HIPAA in scope, and carries ISO 27001, 27018, 27701 and 42001 among others, with NIS 2 and DORA alignment. It also states that customer data remains within the geographic region the customer chooses. Read on 17 September 2026 at nebius.com/trust-center. For most reviewers that is a complete file, and it is more than most GPU providers can show.

What those documents attest is that Nebius has controls, audits them, and keeps data in the region you pick. What they do not and cannot attest is a property of the hardware: whether an operator with legitimate console access could inspect a running VM. A SOC 2 report says the operator promises not to and is audited on the promise. That is enough for public-model training, evaluation, and pipelines on pseudonymised data. It stops being enough when the regulator or the client asks for the technical measure to be enforced rather than promised, which is where this comparison actually begins.

Nebius sells regions. VoltageGPU sells a boundary.

Nebius is a full cloud: on-demand and reserved GPUs, Kubernetes, storage, a large certification portfolio, and region selection so that data stays in the EU. The GPU runs on a standard hypervisor with the operator in control of the host. That is the normal and correct shape for a hyperscale GPU provider, and it is why the certifications are the product.

VoltageGPU is narrower. The contracting entity is VOLTAGE EI, a French sole proprietorship (SIREN 943 808 824), so the controller relationship is French. The GPU runs inside an Intel TDX trust domain with memory encryption, and on the Confidential VM tier you hold the attestation device yourself: you generate an Intel TDX quote over 64 bytes of your own choosing and verify it offline against Intel, and on the verified SKUs you generate a NVIDIA GPU attestation report over your own nonce and verify it with NVIDIA. We publish the raw evidence with checksums and a small open-source tool, voltage-verify, to reproduce it. That is the whole product: a boundary you can check, not a certificate you have to trust.

On price the honesty cuts the other way. A confidential H100 is $6.95/hr on VoltageGPU against $3.85 per hour on Nebius (no TEE, list price read 17 September 2026), and a confidential H200 is $8.08/hr against $4.50. Nebius is cheaper per hour on both, and the gap is the confidential stack. For a workload that is not confidential there is no reason to pay it.

Where Nebius wins, and it is most of the market

Nebius wins on scale, on breadth and on paper. It sells B200 and B300 nodes, reserved clusters, managed Kubernetes and storage, and it holds a certification list we do not have: VoltageGPU has no SOC 2 report and does not sign a HIPAA Business Associate Agreement today. If your procurement checklist starts with "attach your SOC 2 Type II", Nebius clears it and we do not, and you should say so to your reviewer rather than argue.

It also wins for EU data residency as a requirement in itself. Region selection on Nebius keeps data in the EU under an EU processor, which satisfies the residency line of most GDPR questionnaires. VoltageGPU does not compete on where the silicon sits; it competes on who can read it while it runs.

Where the two do not overlap

The overlap is a Venn diagram with a thin middle. Nebius answers "is this provider audited and does my data stay in my region"; VoltageGPU answers "can anyone, including the provider, read my model or my data while the GPU is computing on it". A buyer under bar-association secrecy, a hospital processing identifiable health data in the clear, a fintech running models on cardholder data, needs the second answer and will not get it from a region setting. A research lab fine-tuning a public model on public data needs the first answer and should not pay for the second.

The pragmatic path for a regulated team is often both: reserved capacity on a certified cloud for the bulk, and a confidential VM for the step where sensitive data is decrypted in memory. This page exists so that the line between the two is visible before the purchase, not after the audit.

FAQ

Is Nebius GDPR compliant?

Nebius states on its trust center (read 17 September 2026) that it operates as an EU data processor under GDPR and that customer data remains in the region the customer chooses, with SOC 2 Type II, ISO 27001, 27018 and 27701 among its certifications. That covers the contractual and organisational side of GDPR for the large majority of AI workloads. It does not cover the technical measure that some regulators and clients now require for Article 9 categories or professional secrecy: hardware enforcement that the operator cannot read workload memory. A standard hypervisor does not produce that evidence; Intel TDX with the GPU passed into the trust domain, which is what VoltageGPU sells, does.

Does Nebius offer confidential computing or Intel TDX?

Its trust center, read on 17 September 2026, does not mention confidential computing, a trusted execution environment, Intel TDX, AMD SEV, NVIDIA confidential computing or hardware attestation as tenant-facing features. If that changes we will update this page; the source is re-read every month. VoltageGPU runs every confidential VM inside an Intel TDX trust domain and has verified NVIDIA GPU attestation from inside the VM on single-GPU H200, 8x H100, single-GPU H100 and single-GPU RTX PRO 6000 Blackwell machines, with the evidence published for all of them.

Which is cheaper, VoltageGPU or Nebius?

Nebius is cheaper per hour on every SKU both sides list: $3.85 for H100 and $4.50 for H200 on demand (no TEE, read 17 September 2026) against $6.95/hr and $8.08/hr for confidential VMs on VoltageGPU. The difference is the confidential stack, and for a non-sensitive workload it is not worth paying. VoltageGPU bills one hour upfront and refunds the unused part per second, so a one-off confidential run costs what it uses.

Does VoltageGPU have SOC 2 or a HIPAA BAA like Nebius?

No. VoltageGPU has no SOC 2 report and does not sign a HIPAA Business Associate Agreement today. What it offers instead is hardware evidence: an Intel TDX quote you verify offline against Intel, and a NVIDIA GPU attestation report you verify with NVIDIA, both on nonces you choose. Some reviewers accept that as a stronger technical measure; others require the report. Ask yours which one they need before choosing either provider.

Can I use both?

Yes, and for regulated teams it is often the sensible design: certified bulk capacity on Nebius for training and evaluation on non-sensitive data, and a VoltageGPU confidential VM for the inference or fine-tuning step where identifiable data is decrypted in GPU memory. The two products answer different questions and do not replace each other.

Certified region or attested enclave, pick the right tool

Nebius is the right answer when the reviewer wants reports and residency. VoltageGPU is the right answer when the reviewer wants proof that the GPU runs inside an attested TDX guest whose memory the host cannot read. Start a confidential VM in a few minutes or read how the attestation works.

Start a confidential VM How the attestation works