GPU marketplace vs attested enclave

VoltageGPU vs Vast.ai

Vast.ai is a GPU rental marketplace where independent hosts and datacenter partners list machines; its Secure Cloud tier restricts to vetted datacenters with signed DPAs. It has completed SOC 2 Type 2, supports HIPAA workloads on Secure Cloud with a BAA, and does not mention confidential computing or hardware attestation.

Vast.ai is the cheapest way to rent a GPU on the planet, and its Secure Cloud tier is a serious answer to "is the host a real datacenter". VoltageGPU is a GPU inside an Intel TDX trust domain with an attestation you generate yourself. A marketplace vets who owns the machine; a trust domain makes it not matter.

Pick Vast.ai if

Lowest possible price for a GPU-hour on non-sensitive work, and you accept host variability
Secure Cloud with a signed BAA and a DPA is what your reviewer asks for
Interruptible workloads, experiments, rendering, public-model training
You want dozens of GPU models, from consumer cards to H200

Pick VoltageGPU if

Identifiable data is decrypted in GPU memory and the host, whoever it is, must be provably unable to read it
You want an Intel TDX quote and a NVIDIA GPU attestation report generated on your own nonce
A single French controller entity on the contract rather than a marketplace of hosts
Your compliance question is about the hardware boundary, not about who the host is

Headline pricing

Hourly list price per GPU SKU. A dash means the SKU is not publicly available from that provider. VoltageGPU prices are the canonical confidential-compute floor and stay in sync with /pricing.

GPU	VRAM	VoltageGPU	Vast.ai
NVIDIA H100	80 GB	$6.95/hr Intel TDX confidential	— market-priced per host, varies by the hour, no TEE
NVIDIA H200	141 GB	$8.08/hr Intel TDX confidential	— market-priced per host, varies by the hour, no TEE

Confidential techIntel TDX + trust-domain GPU isolationNot offered (no Intel TDX, no GPU TEE mentioned)

AttestationIntel DCAPNone

BillingPer-second, no commitMarket-priced hourly rental, on-demand and interruptible bids

OperatorVOLTAGE EI (France)Vast.ai (US marketplace; legal entity not stated on its compliance page)

Setup~5 min, SSH-readyMinutes, depends on the host

JurisdictionFrench company, GDPR Art. 28; compute at US sub-processors (SCCs)US company

Vast.ai HIPAA, SOC 2 and Secure Cloud: what they cover

Short answer for the people who typed "vast ai hipaa" or "vast ai soc 2": Vast.ai states on its compliance page that it has completed SOC 2 Type 2 certification, that it supports HIPAA-covered workloads on its Secure Cloud tier with Business Associate Agreements available for qualifying customers, and that a Data Processing Agreement governs data handling for both customers and Secure Cloud datacenter partners. Secure Cloud partners must sign that DPA, pass facility due diligence and run professionally managed facilities. Read on 17 September 2026 at vast.ai/compliance. GDPR is not mentioned on that page; ask for the DPA text directly if you need the Article 28 terms.

What that covers is the question a marketplace has to answer first: who owns the machine and are they audited. Secure Cloud answers it well. What it cannot cover is a property of the hardware: on a standard hypervisor, whoever operates the host can inspect a running VM, and a DPA says they will not. Vast.ai's own security FAQ draws the line honestly between Tier 4 datacenters and individual hosts with less formal security. For public-model training, rendering and experiments, that is the right trade and the price is unbeatable. For the step where identifiable data is decrypted in GPU memory under a confidentiality obligation, the reviewer may ask for the technical measure to be enforced rather than promised, and that is where this comparison begins.

A marketplace vets the host. A trust domain makes the host irrelevant.

Vast.ai's product is the market: thousands of machines, prices that move by the hour, a filter for datacenter-only capacity, and a compliance layer on top for the buyers who need it. The trust model is "we checked who this host is and they signed a DPA". That is a real control, and it is the right one for a marketplace.

VoltageGPU's product is the boundary. Every confidential VM runs inside an Intel TDX trust domain with memory encryption and the GPU passed through into the domain; you hold /dev/tdx_guest, you generate the Intel TDX quote over 64 bytes you choose and verify it offline against Intel, and on the verified SKUs you generate a NVIDIA GPU attestation report over your own nonce and verify it with NVIDIA. The contracting entity is VOLTAGE EI, a French sole proprietorship (SIREN 943 808 824), one operator rather than a market of hosts. The evidence is published with checksums and reproducible with an open-source tool, voltage-verify. The point is that you no longer need to know who owns the machine: the hardware refuses them.

On price there is no contest and we will not pretend otherwise. Vast.ai H100 and H200 rentals are market-priced per host and are routinely far below $6.95/hr and $8.08/hr, which is what a confidential H100 and H200 cost on VoltageGPU. The gap is the confidential stack. For a workload that is not confidential, Vast.ai is the right answer and the cheaper one.

Where Vast.ai wins, which is most workloads

Vast.ai wins on price, on breadth of hardware from consumer cards to H200, on interruptible bids, and on the paperwork we do not have: it has a SOC 2 Type 2 report and signs a BAA on Secure Cloud, while VoltageGPU has no SOC 2 and does not sign a HIPAA BAA today. If your procurement checklist starts with "attach your SOC 2 Type 2", Vast.ai clears it and we do not, and you should say so to your reviewer.

It also wins for any workload where the data was public or already pseudonymised before it touched the GPU. That is most training, most evaluation and most research, and paying for a trust domain there is waste.

Where the DPA ends and the attestation begins

A DPA constrains the host by contract. An attestation constrains the host by silicon. A law firm under professional secrecy, a clinic running inference on identifiable records, a fintech scoring cardholder data in the clear, needs the second and cannot get it from a vetted host list. A researcher fine-tuning Llama on a public corpus needs the first and should not pay for the second.

The practical design for a regulated team is often both: Vast.ai for bulk and interruptible work on non-sensitive data, and a VoltageGPU confidential VM for the step where the sensitive data is decrypted in memory. This page exists so that line is visible before the purchase.

FAQ

Is Vast.ai HIPAA compliant?

Vast.ai states on its compliance page (read 17 September 2026) that it supports HIPAA-covered workloads on its Secure Cloud tier and that Business Associate Agreements are available for qualifying customers, alongside a completed SOC 2 Type 2. That is the contractual baseline US healthcare buyers expect, on the tier restricted to vetted datacenter partners. What the BAA does not provide is hardware evidence that the host cannot read PHI in GPU memory: Secure Cloud machines run on standard hypervisors operated by the datacenter partner. For PHI processed in the clear at inference time, the architectural alternative is Intel TDX with GPU passthrough and a tenant-generated attestation, which VoltageGPU provides, without a BAA.

Is Vast.ai GDPR compliant?

Its compliance page, read on 17 September 2026, does not mention GDPR. It does state that a Data Processing Agreement governs data handling for customers and for Secure Cloud datacenter partners, which is the instrument GDPR Article 28 requires; ask Vast.ai for the DPA text and the Standard Contractual Clauses if the hosts are outside the EEA. For Article 9 data, some regulators now require the technical measure that the operator cannot read workload memory, which a marketplace host on a standard hypervisor does not provide and an Intel TDX trust domain does.

What is Vast.ai Secure Cloud?

Per vast.ai/compliance on 17 September 2026, Secure Cloud is the tier restricted to vetted datacenter partners that must run professionally managed facilities with at least five flagship GPU servers, sign a Data Processing Agreement and pass facility security due diligence, with ISO 27001, SOC 2 Type 2, HIPAA, HITRUST or PCI DSS encouraged. It answers "is the host a real datacenter". It does not change what the host can technically see on a standard hypervisor.

Does Vast.ai offer confidential computing or Intel TDX?

Neither its compliance page nor its security FAQ, read on 17 September 2026, mentions confidential computing, a trusted execution environment, Intel TDX, AMD SEV, NVIDIA confidential computing or hardware attestation. If that changes we will update this page; the sources are re-read monthly. VoltageGPU runs every confidential VM inside an Intel TDX trust domain and has verified NVIDIA GPU attestation from inside the VM on single-GPU H200, 8x H100, single-GPU H100 and single-GPU RTX PRO 6000 Blackwell machines, with the evidence published for all of them.

Which is cheaper, VoltageGPU or Vast.ai?

Vast.ai, by a wide margin, on every GPU both sides sell. Its prices are set by the market per host and change by the hour, so we do not print a figure that would be wrong tomorrow; they sit well below $6.95/hr for a confidential H100 and $8.08/hr for a confidential H200 on VoltageGPU. The difference is the confidential stack, and for non-sensitive work it is not worth paying. VoltageGPU bills one hour upfront and refunds the unused part per second.

Cheapest GPU or attested GPU, pick the right tool

Vast.ai is the right answer for the lowest price on non-sensitive work, with a BAA and a DPA on Secure Cloud. VoltageGPU is the right answer when someone has to prove that no host can read the GPU while it runs. Start a confidential VM in a few minutes or read how the attestation works.

Start a confidential VM How the attestation works