Confidential GPU Pricing 2026 — Intel TDX, AWS Nitro, Azure CC, GCP CC

In April 2026 the cheapest hardware-attested confidential GPU is the NVIDIA H100 80GB on VoltageGPU at $2.77/hr, running on Intel TDX with NVIDIA Protected PCIe. The instance is billed per second with no minimum, no commit, and no idle surcharge. GCP Confidential VMs (C3) list H100 at $4.95 per hour, Azure NCC H100 v5 at $5.60 per hour, and AWS Nitro Enclaves at $5.45 per hour for the underlying p5 instance.

Two caveats matter when you do the comparison. First, AWS Nitro Enclaves do not place the GPU itself inside a TEE — only the CPU-side workload is isolated, so the $5.45 buys you a different product than the other three. Second, Azure and GCP bill the confidential VM shell continuously while the workload is provisioned, even if the GPU is idle, while VoltageGPU bills per-second only when the workload is actively running and attested. On bursty inference patterns the per-second model typically wins by 30 to 60 percent over a 1-month window.

For a like-for-like H200 comparison the gap widens further: $3.60/hr on VoltageGPU versus $13.96 on Azure ND H200 v5. AWS and GCP do not yet offer GA H200 confidential SKUs as of this update.

No, and the difference matters specifically for AI workloads. Nitro Enclaves are a CPU-side construct: they create an isolated VM with no persistent storage, no network, and no operator access, attested by the AWS Nitro hypervisor itself. They were designed for key material, signing services, and deterministic verifiers where the workload fits comfortably inside CPU memory and never needs an accelerator.

When you attach an NVIDIA H100 to a p5 instance and run inference, the model weights, the prompt tensors, and the output tokens cross the PCIe boundary into GPU memory. That boundary is outside the Nitro Enclave. The host hypervisor and the AWS control plane can, in principle, observe the traffic. AWS positions this as "defense in depth"; a regulator reading the architecture diagram positions it as "the GPU is not in the TEE".

Intel TDX combined with NVIDIA Confidential Computing extends hardware encryption to the PCIe link itself: traffic between CPU memory and GPU memory is AES encrypted, the GPU produces its own attestation report, and the CPU and GPU quotes are bound together by the Intel DCAP root. That is the architectural posture an Article 28 DPA can lean on. Nitro Enclaves are excellent technology for the problems they were designed to solve, but they are not a substitute for full-stack confidential GPU compute.

Demand a remote attestation quote signed by Intel DCAP — or the equivalent vendor root — before you send any data. The quote must reference at minimum three measurements: the TDX module hash (so you know the silicon is running approved firmware), the guest measurement (so you know the workload binary has not been swapped), and the GPU attestation report (so you know the accelerator is in confidential mode and the PCIe link is encrypted).

In practice the verification flow is: provider issues a session, you fetch the quote, you re-verify the quote against the Intel root certificate offline, you compare the measurements against an expected reference value you control, then and only then you send the data. VoltageGPU exposes the Intel-signed quote on the session handshake; Azure and GCP expose the equivalent through their confidential computing SDKs; AWS Nitro Enclaves expose only an AWS-signed document, which is not what an Intel DCAP audit scope expects.

For a worked verification example the attestation docs walk through the full quote inspection in around 30 lines of Python.

It depends on the workload shape, and the calculation is different from non-confidential GPU. For 24/7 production inference with predictable traffic, a 1-year or 3-year reserved instance on AWS, Azure, or GCP cuts list price by roughly 30 to 60 percent. If you are running a chatbot that serves load every hour, the reserved-instance math wins — even on confidential SKUs where the list premium is already high.

For burst-style fine-tuning, compliance pilots, or pre-launch inference experimentation, reserved instances become a liability. You commit to GPU hours you may not consume, you cannot easily move regions if attestation requirements change, and the confidential SKU you reserved today may be superseded by a Hopper CC successor in 12 months. On these workloads per-second on-demand pricing on VoltageGPU is consistently cheaper because there is no idle commit.

The decision rule we coach customers through: if your annualised utilisation of the specific confidential GPU SKU is above 70 percent, evaluate reservations first. Below 70 percent, on-demand wins. Run the numbers per workload, not per portfolio.

Strictly speaking, none of them. GDPR Article 28 is a contractual obligation between controller and processor, not a feature flag a vendor can enable. AWS, Azure, GCP, and VoltageGPU all sign Article 28 Data Processing Agreements; the question is whether the technical and organisational measures clause inside that DPA actually matches the risk of the workload you intend to run.

For run-of-the-mill SaaS data, all four providers are fine because the underlying threat model is operator misuse and external attackers, both of which are addressed by standard encryption, IAM, and audit logging. For high-sensitivity personal data — legal client files, medical records, financial advice — European regulators have started asking for evidence that the processor itself cannot read the data, not merely that the processor promises not to. That is the language where confidential GPU compute changes the negotiation.

A hardware-attested TEE backed by Intel DCAP is the strongest available technical measure: the platform is mathematically constrained from reading the workload, and the quote provides cryptographic evidence to that effect. Azure Confidential, GCP Confidential, and VoltageGPU can all supply that evidence. AWS Nitro Enclaves can, for the CPU portion, but not for the GPU portion. Match the provider to the clause you actually have to defend in an audit.