How your data is handled on each product, what you can verify yourself, and which certifications we do not hold yet.
Your VM runs as an Intel TDX trust domain: its memory is encrypted by the CPU and the host cannot read it. The GPU runs in NVIDIA confidential mode. You generate the attestation yourself, inside the VM, and verify it offline.
Limit: The attestation proves the hardware and the enclave, not which application runs inside. You have root in the VM.
Models run inside Intel TDX enclaves at our inference provider. Requests go through our API, which relays them over TLS and sees them in clear.
Limit: The relay handles your request in memory in clear while forwarding it. We do not claim we cannot see it.
Ordinary GPU machines from our provider network, billed per second, with a hardware check you can run yourself.
Limit: No enclave, no memory encryption, no attestation. Use them only for data that is not sensitive.
Your account, billing records, invoices and support messages, through the subprocessors listed on this site. Payment cards stay with Stripe.
VOLTAGE EI, a French sole proprietorship (SIREN 943 808 824), subject to French and EU law, including the GDPR. A data processing agreement is published.
We do not hold SOC 2, ISO 27001, HDS or SecNumCloud today. The roadmap below says what is in place and what is not, line by line.
Independent attestations are how regulated buyers verify a vendor's posture. Below is the authoritative status of VoltageGPU's certifications and the realistic timeline for the ones we have not yet earned. We tag every line so procurement and risk teams can rely on this page as a single source of truth.
| Framework | Status | Target | What it covers |
|---|---|---|---|
| GDPR Art. 28 DPA | In place | Published in full at /legal/dpa | Customer-signable Data Processing Agreement, SCCs, subprocessor list. Countersigned copy on request. |
| Intel TDX attestation | In place | — | Generated by you on the confidential VM: you produce the TD Quote inside your VM and verify it offline against Intel's root certificate (DCAP), for example with voltage-verify. The inference API returns no attestation per request. |
| RFC 9116 (security.txt) | In place | — | Coordinated vulnerability disclosure contact published at /.well-known/security.txt. |
| SOC 2 Type I | NOT YET HELD, auditor selection in progress | Q4 2026 | Independent attestation of security, availability and confidentiality controls (point-in-time). |
| SOC 2 Type II | NOT YET HELD | Q4 2027 (12-month observation window after Type I) | Operating-effectiveness attestation over a continuous monitoring period. |
| ISO/IEC 27001 | NOT YET HELD, gap assessment scheduled | Q1 2027 | Information security management system certification. |
| ISO/IEC 42001 | NOT YET HELD, in scope after 27001 | 2027 | AI management system standard, relevant to EU AI Act readiness. |
| HDS (Hébergeur de Données de Santé) | NOT YET HELD | 2027 (if customer demand confirms scope) | French health-data hosting certification required for some healthcare workloads. |
| HIPAA BAA | Architecture aligned with §164.312 technical safeguards. No BAA offered yet. | Available on request for enterprise contracts post-SOC 2 Type I | HIPAA is not a certification, covered-entity status remains with the customer. |
| DORA / NIS2 | Architected to support Art. 30 / Art. 21 obligations. Final assessment is the customer's responsibility. | Continuous | EU regulations applicable to financial entities and essential service operators. |
We do not claim certifications we have not earned. VoltageGPU is not currently SOC 2, ISO 27001, ISO 42001 or HDS certified. Anywhere our marketing previously used a stronger word ("compliant", "certified"), it has been corrected to reflect architecture-readiness language. The dated targets above are commitments, not promises, they will move if scope or customer demand changes, and this page is the authoritative source.
We welcome coordinated disclosure from security researchers. The program below is the official policy referenced by our /.well-known/security.txt file (RFC 9116).
Email security@voltagegpu.com with a clear reproduction. We acknowledge receipt within 3 business days and provide a triage update within 10 business days.
voltagegpu.com, app.voltagegpu.com, api.voltagegpu.com, docs.voltagegpu.com, our API surface, and the agent runtime.
DoS, social engineering, physical attacks, missing security headers without impact, self-XSS, and reports requiring already-compromised devices or networks.
Research conducted under this policy in good faith is authorized. We will not pursue legal action against researchers who follow the rules, avoid privacy violations, and give us reasonable time to remediate before public disclosure (90 days standard).
A paid bounty program is not currently offered. High-quality reports are eligible for public acknowledgment below and, at our discretion, service credits.
We accept reports in English and French.
We recognize researchers who have responsibly disclosed valid issues. As a young company we have no acknowledgments yet, if you find something, you could be the first.
No public acknowledgments yet. Reports welcome at security@voltagegpu.com.
Our inference API runs on TEE nodes at our inference provider, listed in /legal/subprocessors · models execute inside Intel TDX enclaves; our relay sees requests in clear.
The model runs inside Intel TDX trust domains at our inference provider, with memory encrypted by the CPU. There is no trust domain per request: requests go to the instances serving the model.
In NVIDIA confidential computing mode the link between CPU and GPU is encrypted. GET /v1/attestation includes the NVIDIA GPU evidence of the serving instances.
GET /v1/attestation returns, on your nonce, the TDX quote of the serving instances. It proves they are TDX guests, not that a given response came from them; no reference measurements are published, so it does not show which code runs.
The Intel TD Quote of the inference hosts comes from GET /v1/attestation and verifies offline against Intel's public PKI.
