Product1 publisher3 min readPublished
Vast Data hands banks and model vendors separate keys to the same GPU enclave
DataEnclave uses Nvidia confidential computing so a model developer's base weights and a customer's fine-tuned weights can run in one enclave under separate key control. Vast says it charges nothing extra for it.
The Product Desk · Product desk
What happened
- Vast Data introduced DataEnclave, a confidential computing environment meant to let companies run advanced AI models against sensitive data without exposing the data or the model's intellectual property.
- Trusted execution environments span CPUs and GPUs, encrypting guest memory, GPU memory and NVLink traffic, and isolating running models and data from administrators, infrastructure operators and other tenants.
- It can run in customer data centers, in AI clouds or fully air-gapped, with attestation services based on the open-source CNCF Trustee project or supplied through Fortanix's Confidential AI offering.
- DataEnclave is in preview now and scheduled to ship in the first quarter, as a capability inside the Vast AI Operating System.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- decision The approval question changes hands: from whether a vendor can be trusted with the data to whether a compliance team will accept a machine-checked policy as equivalent to keeping the workload in-house.
- cost With no separate licence fee, the spend lands on confidential-computing capable hardware from partners such as Cisco and Super Micro, and on the people who maintain the attestation policy and the key management integration.
- capability A model vendor can pursue an account that will never release its training data, because the customer's fine-tuned weights stay under the customer's own key inside the shared enclave.
- exposure Whoever signs off inherits the log as evidence, and every key release is recorded in a warehouse a regulator can later ask to see.
The person who has to make this work on Monday is a platform engineer at a bank, and her first task is writing down what counts as a valid attestation, then getting a compliance officer to agree to it before anything runs. The check verifies hardware, software and governing policies before models or data are decrypted [6].
The pitch is hardware isolation, but the mechanism is a key release. The enterprise and the model developer each keep control of their own encryption keys through integrations with their own key management systems [7]. The live question for the platform team moves from whether GPU memory is encrypted to the conditions under which their key manager will hand a key to a machine they can only see over a network.
Jeff Denworth, Vast Data's co-founder, described the gap the product goes after. "Up until now, there hasn't been a great solution for ensuring that the memory space that people do this computing in is equally protected," he said [8].
The standoff has two sides. Regulated organizations cannot move sensitive information to externally hosted AI services, and model developers do not want their weights sitting in infrastructure they do not control [3]. Vast said a developer's base weights and a customer's fine-tuned weights can operate together while remaining under separate ownership and key control [13]. "Both of those can interoperate within this multitenant enclave where we can support the trust requirements of both organizations simultaneously," Denworth said [14].
"Model weights are fast becoming the most valuable intellectual property in the world," Denworth said [4]. The commercial claim attached to that is about who funds the hardware: if customers run proprietary models on infrastructure they own or on a regional AI cloud, model developers need to finance less computing capacity themselves [17].
Eight companies are named at launch, all partners: six on the model and software side and two building integrated systems [20]. Denworth identified large banks, intelligence and defense agencies and pharmaceutical companies as early target customers [15], and said of them, "It's basically the most regulated and air-gapped customers of the world." [16]
Vast will not bill the capability separately. "We don't charge anything extra for this," Denworth said. "It's just part of the AI operating system stack." [18] Vast did not disclose a price for the AI Operating System itself.
Two things sort whether any of this applies to you: control of the data, and control of the weights. If you control both, the enclave solves a problem you do not have. Control neither and you are already sending prompts to somebody's hosted API. The two mixed cells are the market here: you hold regulated data and want a vendor's model, or you own a model and want to sell into accounts that will not release their data.
The sentence an auditor has to accept names the policy the enclave attested to and the record that shows which workload ran under it. The customer writes that policy. Vast logs attestation events, key releases and enclave lifecycle activity in the Vast DataBase data warehouse [10].
What to watch
- Whether general availability arrives with a named production customer among the banks, agencies and pharmaceutical companies Denworth described as early targets.
- Any published throughput or latency figures for models running inside the encrypted CPU and GPU enclave.
- Whether the CNCF Trustee project or Fortanix becomes the default attestation path, and what each costs the customer to operate.