VAST Data announced its new VAST DataEnclave, a confidential compute capability for AI workloads within the VAST DataEngine, which runs AI models in hardware-isolated environments built on NVIDIA Confidential Computing. The new capability decrypts model weights and enterprise data only within protected CPU and GPU memory, and only after cryptographic attestation confirms that the environment meets policies set by each asset’s owner.

VAST is currently previewing the capability and will ship it in Q1 2027, both directly and through OEM partners Cisco and Supermicro.

DataEnclave targets a two-sided trust deadlock that blocks many high-value AI deployments, in which regulated enterprises will not send sensitive data to hosted models, while model providers won’t ship proprietary weights into infrastructure managed by others.

The new capabilities extend VAST’s AI Operating System scope to model governance, treating model weights as a managed enterprise resource alongside other enterprise data.

The core building blocks come from NVIDIA, the CNCF, and Fortanix and are available to all competitors. VAST’s advantage rests on integration, ecosystem breadth, and its early lead among data platform vendors.

Technical Details

DataEnclave is an integration of three layers:

• NVIDIA supplies the hardware trust boundary and the confidential container reference stack
• Fortanix supplies an optional enterprise attestation and key management layer
• VAST supplies the runtime, packaging, governance, and audit functions that turn those pieces into an operable product.

It splits responsibilities between two sides of a deployment :

• On the infrastructure operator’s side: The DataEnclave Runtime launches each confidential workload in its own confidential virtual machine (CVM) that spans both CPUs and GPUs, with the CPU trusted execution environment provided by Intel TDX or AMD SEV-SNP.
• On the data owner’s side (the model provider when weights are the protected asset), an attestation server and a key management system determine whether that CVM receives decryption keys.

The process looks something like this:

1. Every CVM boots without keys or credentials. To obtain them, it requests evidence from its hardware root of trust that describes the hardware, firmware, booted software, and any restrictions on what the host can do inside it.
2. The CPU and GPU sign that evidence with keys that never leave the silicon, so the host cannot forge it.
3. The attestation server verifies the evidence against the owner’s policies, which can extend beyond approved hardware and software to include controls such as prohibiting the host from executing commands within the CVM.
4. Keys are released only after a successful check and are encrypted so that only that CVM’s protected memory can decrypt them.

Attestation is repeated at every launch, for every new replica, and whenever a running workload requests another key. A model provider can therefore revoke an entitlement from its attestation server, for example, when a license ends, without any involvement from the infrastructure operator.

NVIDIA’s Contribution

NVIDIA provides the foundational framework that enables DataEnclave. CPU trusted execution environments alone cannot protect an AI workload because inference runs on unencrypted weights, prompts, and intermediate results stored in GPU memory.

NVIDIA Confidential Computing solves that by extending the trust boundary into the accelerator and publishing much of the software required to use it.

Its contributions to DataEnclave include:

• GPU trusted execution: NVIDIA Confidential Computing, in its third generation across Hopper, Blackwell, and Rubin, protects GPU memory and CPU-to-GPU transfers from the host, and encrypts NVLink traffic between GPUs on newer platforms. On Vera Rubin NVL72, NVIDIA extends a single security domain across 72 Rubin GPUs, 36 Vera CPUs, and the NVLink fabric, enabling rack-scale confidential workloads.
• GPU attestation: Each GPU signs evidence of its hardware, firmware, and confidential mode using keys fused into the silicon. DataEnclave combines this GPU evidence with CPU TEE evidence, allowing the data owner to verify the full execution path before releasing keys.
• Confidential Containers reference architecture: NVIDIA publishes a reference stack combining its GPU Operator, Kata Containers, and the CNCF Trustee project to enable composite CPU and GPU attestation and secure key release for encrypted workloads. DataEnclave’s attestation server is built on the same Trustee stack.

Fortanix

Fortanix is a confidential computing pioneer and has sold its Confidential AI product on NVIDIA Confidential Computing since 2025. This includes a turnkey on-premises platform for AI factories, and a March 2026 release that enables model developers to distribute weights to customer infrastructure. 

Within DataEnclave, Fortanix serves as an alternative to the VAST-provided attestation server, designed for fully sovereign and regulated deployments.

Fortanix’s contributions to VAST’s DataEnclave include:

• Attestation and policy-gated key release: Fortanix verifies composite CPU and GPU evidence against the owner’s policy and releases keys only to environments that pass.
• Hardware-backed key custody: Fortanix’s confidential AI platform anchors key custody in a FIPS 140-2 Level 3 hardware security module with role-based access controls, which matters to regulated buyers who must demonstrate certified key handling.
• Operational maturity: Fortanix brings an existing installed base in key management and integrations with GPU cloud provisioning platforms such as Rafay, providing neoclouds and sovereign operators with a proven control plane.

VAST Brings it Together

VAST DataEnclave turns these components into a product customers can deploy and operate.

These capabilities include:

• Confidential runtime in DataEngine: Launches each workload in its own CVM, isolating active data and models from infrastructure operators, administrators, and co-tenants. A workload packaged as an encrypted container image will not start if attestation fails.
• Independent key control: Supports bring-your-own KMS integrations, allowing enterprises and model builders to each hold keys within their own trust domains. This protects an enterprise’s fine-tuned weights as well as a builder’s base weights.
• Standards-based attestation choice: Complies with the IETF remote attestation architecture (RFC 9334) and is compatible with CNCF Confidential Containers. Owners can use an existing attestation service, the VAST-provided attestation server, or Fortanix Confidential AI.
• Connected or air-gapped deployment: Runs in customer data centers, AI clouds, and fully air-gapped environments.
• Auditable operations: Logs each workload’s application, version, CVM image, node, launch time, and deployment configuration to the VAST database. The VAST attestation server also records the evidence for each decision, the policy applied, and all policy changes. Each party maintains its own record, so neither party relies on the other’s account.
• Secure agent sandboxes: The same DataEngine secure runtime provides isolated execution environments for AI agents through VAST AgentEngine.

Model builders distribute each release as a VAST Application, with the container image and weights encrypted using keys controlled by the provider. The enterprise stores the release on its VAST cluster and deploys it through the same interface used for other VAST Applications, providing the address of the provider’s attestation server. 

The CVM initiates an outbound connection to retrieve keys, so the provider never needs a route into the enterprise network.

Retrieval and prompt assembly, for example, via VAST InsightEngine, run on the enterprise’s own systems outside the CVM. As a result, the assembled prompt is the only enterprise data the model sees, and existing egress controls govern where outputs can go.

The protections cover confidentiality and integrity during processing but do not guarantee availability because an operator can always decline to run or stop a workload.

Workload developers remain responsible for what enters and leaves their APIs.

Analysis

VAST has steadily expanded from all-flash storage into a broader software stack that includes VAST DataBase, DataEngine, InsightEngine, and AgentEngine, collectively marketed as the “VAST AI Operating System.” DataEnclave extends that stack into the GPU runtime and model governance. 

In the announcement materials, CEO Renen Hallak describes models as a resource the operating system manages like data, while VAST co-founder Jeff Denworth says model weights are fast becoming the world’s most valuable intellectual property.

This supports VAST’s overall framing more convincingly than earlier AI OS announcements, as DataEnclave controls where models run, under which policies, and with what evidence.

Several factors shape how well this holds up:

• Distribution role: DataEnclave makes VAST a channel between model builders and regulated enterprises. Builders gain access to environments they could not otherwise reach, which gives them a reason to package for VAST first.
• Sovereign AI tailwind: Partners BUZZ HPC, Nscale, and Sharon AI can host proprietary models on shared national infrastructure with hardware-enforced tenant isolation, avoiding the cost of dedicating entire machines to a single tenant.
• Expanding surface area: The AI OS narrative puts VAST in closer contact with much larger platform vendors in container orchestration, AI runtime software, and security, where it has less market share than in storage.
• Timing: The capability is in preview until Q1 2027. Partner support today includes endorsements and integration commitments, and no production customer deployments are publicly available.

NVIDIA’s Role in Commoditizing the AI Data Plane

NVIDIA is increasingly taking control of the AI data plane. The company is providing the core technologies, frameworks, and specifications that underpin AI data solutions for the NVIDIA ecosystem. This expanding level of control will shape how durable VAST’s competitive lead will be.

At GTC 2026, NVIDIA launched BlueField-4 STX, a reference architecture for AI storage built on its DPU, Vera CPU, ConnectX-9 SuperNIC, Spectrum-X networking, DOCA software, and CMX context memory platform. Fifteen storage and system vendors adopted it at launch, including VAST, WEKA, NetApp, Dell Technologies, HPE, DDN, IBM, and Everpure.

At FMS 2026, NVIDIA open-sourced its cuFile APIs, the core of GPUDirect Storage, under neutral governance.

Confidential computing follows the same pattern as NVIDIA’s Confidential Containers reference architecture, which packages composite attestation and secure key release within the same Trustee stack that underpins DataEnclave.

Each of these moves gives every storage vendor the same NVIDIA-supplied data path and, in confidential AI, the same trust boundary.

As a result, VAST’s differentiation in confidential AI comes down to time-to-market and partnerships. VAST is the first storage and data platform vendor to integrate NVIDIA Confidential Computing into its software stack, and it has assembled a network of model builders and sovereign clouds that no competitor has matched.

VAST’s advantages are real and time-bound, but the time-to-market lead applies only within the data platform layer. At the system level, Dell and HPE have already paired NVIDIA Confidential Computing with Fortanix in their AI factories, and HPE has announced planned general availability ahead of VAST.

Additionally, any STX-adopting storage vendor could follow the same path across a product cycle.

The most durable parts of VAST’s position are the areas NVIDIA does not supply, namely model packaging as native applications, governance and audit through VAST DataBase, and a model builder ecosystem that prioritizes packaging for VAST first.

Practitioner Impact

DataEnclave is relevant to security architects, AI platform teams, and infrastructure owners across financial services, healthcare, government, and other regulated sectors, as well as to sovereign and regional AI cloud operators. Its primary benefit is access.

Proprietary models that were previously available only as hosted APIs, such as Cohere’s models, CrowdStrike’s SafeMind security models, and TwelveLabs’ video models, can now be deployed on customer-owned hardware alongside data that cannot leave the building.

Getting there, however, comes with implementation requirements:

• Hardware prerequisites: Customers need CPUs capable of confidential computing, NVIDIA GPUs with confidential computing enabled, correctly configured firmware, and a supported VAST DataEngine deployment. Older GPU fleets and non-NVIDIA accelerators are outside the announced scope.
• New operational discipline: Attestation policies, KMS integration, and key lifecycle management span security and AI platform teams that often operate separately today. Organizations need clear ownership for policy authoring and change control.
• Constrained troubleshooting: Policies that block host access to the CVM protect weights but also limit the operator’s ability to debug a misbehaving workload. Support processes need to be renegotiated with each model provider.
• Runtime dependency on the provider: Because every new replica reattests, scaling a connected deployment depends on the availability of the model provider’s attestation server. Air-gapped designs remove this dependency but require local attestation infrastructure.
• Commercial readiness: DataEnclave solves the technical trust problem. Licensing terms, pricing, and support models for running proprietary frontier weights on customer hardware remain immature across the industry and will slow adoption as much as the technology.

Competitive Landscape

Confidential AI is becoming a crowded category. NVIDIA provides the GPU foundation for everyone, and software vendors, hyperscalers, and open-source projects all build attestation and key release on top of it. VAST’s entry is distinctive only because it comes from the data platform side of the stack.

The most consequential overlap comes from the server OEMs:

• HPE and Dell Technologies are both integrating NVIDIA Confidential Computing at the AI factory level. Both rely on Fortanix for attestation and key management, the same partner VAST offers inside DataEnclave.
• HPE is certifying its ProLiant DL380a Gen12 servers and HPE Private Cloud AI for Fortanix Confidential AI in Q3 2026 and adding native NVIDIA Confidential Computing to HPE AI Factory and HPE Sovereign AI Factory in Q4 2026, both ahead of DataEnclave’s Q1 2027 ship date.
• Dell offers confidential AI on Dell AI Factory with NVIDIA through Fortanix, with post-quantum-ready key management and audit logging.

These offerings are narrower than VAST’s DataEnclave. While they secure the compute platform, they leave model packaging, distribution, and data platform integration to the customer or partners.

However, they still solve the core problem DataEnclave targets: running sensitive AI workloads on-premises with data and models protected in use, and they reach buyers through established full-stack procurement channels.

The table below summarizes the most relevant alternatives.

Alternative	Approach	Relative Strength	How It Compares to DataEnclave
Fortanix Confidential AI	Standalone confidential AI platform on NVIDIA Confidential Computing with attestation and HSM-gated key release for on-premises AI factories and neoclouds	Mature key management and attestation heritage; independent of any storage or data platform	Delivers a comparable model-to-data flow today. Fortanix is also a DataEnclave launch partner, so it acts as both a component supplier and an alternative for customers not running VAST
Hyperscaler confidential GPU instances (Microsoft Azure, Google Cloud)	Confidential VMs pairing CPU TEEs with NVIDIA GPU confidential computing, operated as public cloud services	Proven at scale, including Apple Private Cloud Compute on Google Cloud with Intel TDX and Blackwell GPUs	Requires data and models to move into the hyperscaler. DataEnclave targets on-premises, sovereign, and air-gapped sites that public cloud cannot serve
Confidential container stacks (NVIDIA reference architecture, Red Hat, Anjuna, Edgeless Systems)	Infrastructure-neutral runtimes and open-source building blocks, including NVIDIA’s own Kata and Trustee-based reference stack, for running containers and inference inside TEEs	Broad hardware and platform neutrality; open standards; no data platform lock-in	DataEnclave builds on the same CNCF and IETF foundations and adds packaged model distribution, data platform integration, and a queryable audit trail, at the cost of tying the capability to VAST
HPE AI Factory and Private Cloud AI	Native NVIDIA Confidential Computing across HPE AI Factory and Sovereign AI Factory (Q4 2026); DL380a Gen12 and Private Cloud AI certification for Fortanix Confidential AI (Q3 2026); air-gapped Private Cloud AI available now	Full-stack procurement from one vendor; compliance support for CMMC, NIST 800, STIG, and FIPS; ships ahead of DataEnclave	Solves the same run-sensitive-AI-on-premises problem at the system level. Lacks DataEnclave’s model packaging and owner-side revocation, and HPE has not detailed how model builders distribute weights into its factories
Dell AI Factory with NVIDIA	Confidential AI with Fortanix on NVIDIA Confidential Computing, adding PQC-ready key management and continuous audit logging	Large enterprise server and AI factory installed base; broad regulated-industry reach; security portfolio spanning CrowdStrike, Fortanix, and F5; growing Neocloud presence	Protects data and models in use through a partner-delivered layer. Dell’s approach centers on infrastructure security more than on a model distribution ecosystem
AI data platform peers (NetApp, WEKA, DDN, Everpure)	AI data platforms with encryption at rest and in transit, secure multitenancy, and RAG pipelines, all adopters of NVIDIA STX	Large installed bases and deep enterprise storage relationships	Peers secure data up to the GPU boundary and have announced no confidential GPU runtime. All have access to the same NVIDIA building blocks, so the gap is one of timing

VAST’s differentiation is strongest in integration and the ecosystem. No other vendor has announced a confidential GPU runtime that packages encrypted models as native applications, allows model owners to revoke deployments from their own attestation servers, keeps retrieval on the customer side of the boundary, and writes a queryable audit trail to the same data platform. 

The launch roster of model builders is also broader than those assembled by Dell, HPE, or confidential computing specialists.

The OEM offerings reveal VAST’s weakest flank. Dell and HPE sell the servers, networking, and support contracts that run confidential AI. They reach the same regulated and sovereign buyers, and HPE ships first. 

Because Fortanix supplies the attestation layer to all three, the trust mechanism does not distinguish among them.

Differentiation is weakest at the technology layer because the enclave itself is NVIDIA’s, NVIDIA publishes its own reference stack for it, and the attestation layer is either open source or licensed from Fortanix.

Fortanix, in particular, offers much of the same model-to-data workflow on a platform-neutral basis, and hyperscalers already run confidential GPU inference at scale in production.

VAST’s advantage applies only to customers who already run or are willing to adopt the VAST platform.

Final Thoughts

VAST Data has done the hard work of implementing confidential AI well. The underlying hardware has existed for several GPU generations, but few enterprises have turned it into something they can operate. DataEnclave supplies the missing pieces, including policy-driven key release, per-replica attestation, revocation from the owner’s side, and independent audit records for each party. It wraps them in the same deployment model that VAST customers already use.

The architecture is clearly documented, grounded in IETF and CNCF standards, and candid about its limitations regarding availability and API behavior.

At the same time, questions remain. VAST has not disclosed performance overhead, pricing, or licensing, and the product will not ship until Q1 2027. Adoption also depends on model builders agreeing to commercial terms for on-premises distribution of their most valuable assets, a business challenge that no attestation protocol can solve.

NVIDIA continues to standardize the AI data layer. With its hardware and reference stack under DataEnclave, VAST’s lead depends on converting its partner roster into production deployments before Dell, HPE, and STX-aligned storage competitors close the gap.

At the end of the day, for regulated enterprises and sovereign AI clouds, DataEnclave removes the most common barrier to running the best available models on their most sensitive data. For VAST, this is the clearest evidence yet that the “AI Operating System” moniker maps to a real AI control plane. 

If model builders follow through with production packaging in 2027, VAST may become the place where proprietary models and protected data converge, a far more strategic position than any storage vendor has yet held in the AI stack.

This is a compelling addition to VAST’s capability set.