VAST DataEnclave Brings Confidential AI On-Premises, but Trust Must Be Proven

VAST Data has introduced VAST DataEnclave, a confidential AI system designed to protect two assets that rarely share infrastructure safely. Enterprises retain control of sensitive information, while model developers protect proprietary weights during inference. The conflict is immediate: each party wants access to the other's intellectual property without exposing its own.

The product entered preview on September 22, 2026, with commercial availability planned for the first quarter of 2027. VAST says DataEnclave uses hardware isolation, cryptographic attestation, and separately controlled encryption keys. These controls aim to verify an environment before any protected model or enterprise data becomes readable.

The announcement targets a persistent barrier to private enterprise AI. Sending regulated information to a hosted model creates privacy, sovereignty, and governance concerns. Moving closed model weights into a customer data center creates a different exposure for the model developer.

VAST is not alone in addressing that problem. NVIDIA supplies the confidential GPU foundations, while Fortanix, Dell, HPE, cloud providers, and open infrastructure projects offer overlapping controls. DataEnclave's test is therefore broader than whether confidential computing works. VAST must prove its integrated approach is deployable, efficient, and trusted by both sides.

VAST DataEnclave Changes Where Closed Models Can Run

DataEnclave attempts to replace contractual trust with technical evidence before a model, key, or protected dataset becomes available.

According to the September announcement, DataEnclave extends confidential execution across the infrastructure processing AI models and sensitive information. It supports VAST installations in enterprise data centers and dedicated cloud environments.

The system is currently a preview, not a generally available production release. VAST plans to ship it through its own organization and participating equipment partners, including Cisco and Supermicro. That distinction matters because current claims describe an architecture and partner commitment, not broad customer deployment.

A traditional enterprise deployment places considerable trust in infrastructure administrators. Those administrators often control the operating system, hypervisor, firmware maintenance, observability tools, and physical machines. That access creates a problem when another company places valuable model weights on the system.

Hosted AI reverses the trust relationship. The model provider controls the service, while the enterprise sends prompts, retrieved documents, or structured records into an outside environment. Contracts and access policies limit use, but the enterprise cannot directly inspect every runtime condition.

DataEnclave tries to separate ownership from infrastructure control. A workload starts inside a confidential virtual machine, or CVM, which isolates its memory from the host operating system and hypervisor. The CPU and GPU generate signed evidence describing the environment and its configuration.

An independent verifier then compares that evidence with the asset owner's policies. Encryption keys are released only after the environment passes those checks. VAST describes this sequence as verify before decrypt.

The model provider can operate its own attestation service and key management system. It can determine which hardware, firmware, workload image, and operating restrictions qualify to receive its model keys. The enterprise retains separate control over its information and decides what reaches the model.

That separation enables a meaningful deployment change. A closed model can operate inside a customer's network without making its unencrypted weights available to customer administrators. Enterprise records can remain under local access and network controls rather than moving into the model provider's hosted service.

The initial partner roster includes Cohere, CrowdStrike, Deepgram, Factory, Fundamental, NVIDIA, and TwelveLabs. These companies cover language models, cybersecurity, voice processing, coding agents, tabular analysis, and video intelligence.

However, the roster does not include every leading closed-model provider. VAST told Blocks & Files that it was speaking with many model companies, but unnamed discussions are not equivalent to signed distribution commitments. Production value depends on which models customers can actually deploy.

The announcement therefore changes the available route to market, not just the security terminology. Model companies gain a possible channel into regulated and isolated environments. VAST customers gain another way to evaluate private AI without immediately surrendering local control.

Why Model Weights and Private Data Need the Same Boundary

The central issue is not storage encryption. It is what happens after valuable information must be decrypted for computation.

Encryption at rest protects files sitting on storage. Transport encryption protects information moving between systems. Neither control automatically protects a prompt, intermediate result, or model weight after an accelerator loads it for inference.

Model weights are the learned numerical parameters that determine how a model processes inputs. They can represent years of research, training data preparation, compute investment, and specialized tuning. Fine-tuned weights can also encode an enterprise's internal processes and domain knowledge.

A conventional GPU workload requires those parameters in usable memory. A privileged operator, compromised hypervisor, malicious diagnostic tool, or firmware vulnerability can therefore become part of the threat model. The same concern applies to prompts and intermediate values derived from protected enterprise information.

Confidential computing addresses data in use through a trusted execution environment, or TEE. A TEE uses hardware-backed isolation to restrict access from the host and other workloads. Its purpose differs from ordinary application permissions because the infrastructure operator is not automatically trusted.

NVIDIA's confidential computing architecture extends that boundary into supported accelerators. It protects GPU execution state and memory while providing hardware-rooted attestation. Newer systems also protect communication across supported accelerator interconnects.

VAST combines that GPU foundation with confidential virtual machines spanning CPUs and GPUs. The company says guest memory, GPU memory, and supported interconnect traffic remain protected from other tenants and privileged administrators.

Attestation supplies the decision point. It creates signed evidence about the system requesting protected material. The asset owner evaluates that evidence before deciding whether the requester should receive a decryption key.

The underlying idea follows the IETF's attestation architecture. That framework distinguishes evidence generated by an attester from the verifier that evaluates it. It does not declare every attested system trustworthy.

This distinction prevents a common misunderstanding. Attestation does not prove that an application is harmless or correct. It provides evidence that particular hardware and software measurements match a defined policy.

The quality of the policy remains essential. A faithfully measured workload can still contain a vulnerability, excessive permissions, or unsafe application behavior. Reference measurements, signing processes, update procedures, and verifier security all affect the resulting assurance.

DataEnclave adds an ownership model around this flow. Model developers keep their model keys inside their trust domain. Enterprises can use separate keys and policies for their information, including internally tuned models.

VAST says every workload replica must obtain approval when it launches. A model provider can later withdraw authorization through its attestation server. New instances then stop receiving the keys required to decrypt and run the model.

This control is important for commercial distribution. A model developer does not need permanent administrative access to the customer's network. It can enforce runtime eligibility without gaining access to the customer's records or prompts.

VAST also supports connected and air-gapped configurations. Connected deployments can use a remote attestation service. Fully isolated environments can use on-premises attestation and key brokering through integrations that include Fortanix.

The broader result is a two-sided security boundary. The customer does not see the provider's unencrypted weights. The provider does not receive a path into the customer's private network or underlying data stores.

The Mechanism Depends on Evidence, Keys, and Limited Data Access

VAST DataEnclave works only when attestation, key release, workload isolation, and application behavior remain aligned throughout the deployment.

The company's technical explanation describes a workload starting without keys or credentials. Its confidential virtual machine requests signed measurements from hardware roots of trust in the CPU and GPU.

Those measurements can identify hardware, firmware, the booted software image, and restrictions placed on host administration. The evidence travels to an attestation server controlled by the relevant data or model owner.

The verifier checks that evidence against an approved policy. A model provider might allow only specified processors, firmware releases, container images, and geographic environments. It can also reject configurations that permit interactive host commands inside the protected machine.

If the evidence passes, the verifier authorizes key release. The keys are encrypted so only the approved CVM can recover them inside protected memory. A failed check leaves the encrypted model image unusable.

Consider VAST's example of a bank running a proprietary model. The bank stores an encrypted model package beside other applications on its VAST infrastructure. The package includes the inference service, its configuration, and encrypted weights.

When the bank starts the application, the CVM contacts the model provider's attestation service through an outbound connection. The provider does not receive an inbound route into the bank's network. After successful verification, the CVM receives the required model keys.

The bank's administrators operate the GPU servers but cannot inspect the model's decrypted contents, according to VAST. The model provider controls its keys but cannot inspect the bank's prompts and responses through the administrative plane.

Data retrieval remains on the customer side. An internal retrieval application can search authorized records and assemble a limited prompt. Only that selected material enters the protected inference environment.

This design matters for retrieval-augmented generation, where enterprise records are added to a model's prompt at runtime. It limits exposure more precisely than granting a model direct access to an entire document repository.

The approach also reinforces the value of a governed AI knowledge base. Confidential execution cannot correct weak permissions, irrelevant retrieval, or poorly classified source material. Enterprises still need controls over what information a model receives.

DataEnclave records workload lifecycle events in VAST DataBase. These records can identify the application version, CVM image, node, deployment configuration, and launch time. VAST says the logs avoid capturing protected model or customer content.

The asset owner's attestation service maintains a separate record of verification and key-release decisions. That separation gives each party evidence from infrastructure within its own control. Neither party must rely exclusively on the other's operational account.

The architecture also uses open components and published frameworks. VAST says its runtime aligns with Kata Containers, while its attestation options include the CNCF Trustee stack. Its remote attestation model follows the IETF architecture.

Standards alignment supports interoperability, but it does not eliminate integration work. Hardware measurements, application identities, key brokers, policy formats, logging, and recovery procedures must operate together. A production failure in any layer can block service or weaken assurance.

Availability sits outside the strongest confidentiality promise. A server operator can still stop a workload, deny resources, disconnect the network, or power down the system. Hardware isolation does not force an infrastructure owner to keep inference available.

The application interface creates another boundary. DataEnclave protects the environment where code runs, but application developers control what enters and leaves through the inference API. A model can still produce sensitive output if the application supplies excessive context.

Enterprises must therefore pair confidential computing with identity controls, data minimization, egress rules, monitoring, and model-level safeguards. The enclave protects execution from specific infrastructure threats. It does not replace a complete AI security program.

VAST Faces Established Confidential AI Alternatives

VAST's differentiation comes from packaging confidential AI inside its data platform, not from owning the underlying hardware isolation.

NVIDIA provides the accelerator security features and attestation capabilities behind many confidential AI offerings. Its documentation supports local and remote attestation for compatible H100 and later GPUs. The same foundation is available to other infrastructure suppliers.

Fortanix provides attestation and key-management technology for VAST DataEnclave. It also offers confidential AI controls independently of VAST. That makes Fortanix both an important partner and a possible alternative for customers seeking platform-neutral deployment.

Dell and HPE are integrating confidential computing into broader AI factory offerings. These vendors already sell servers, networking, lifecycle support, and security services to regulated enterprises. Their procurement reach can matter as much as technical architecture.

Public cloud providers also operate confidential virtual machines and supported GPU configurations. Their offerings address customers comfortable moving workloads into a hyperscaler environment. VAST focuses more directly on on-premises, sovereign, dedicated, and air-gapped systems.

Infrastructure-neutral stacks offer another route. Organizations can assemble confidential containers, attestation services, key brokers, and NVIDIA components themselves. That approach can reduce dependence on one data platform, although it transfers integration responsibility to the customer.

An independent assessment identifies integration as VAST's strongest advantage. DataEnclave packages encrypted models as managed applications, connects them with local data services, supports owner-controlled revocation, and produces queryable operational records.

That integration can reduce the number of components an enterprise must design and maintain. It can also make confidential AI feel like an extension of an existing VAST environment rather than a separate security project.

The same integration creates a commercial constraint. Organizations must already use VAST or accept its platform as part of the deployment. A company with a different data architecture might prefer an independent confidential computing layer.

Timing presents another challenge. VAST plans to ship DataEnclave in the first quarter of 2027. Some alternatives already provide confidential GPU instances or related enterprise infrastructure. HPE has also described confidential AI milestones scheduled before VAST's general availability.

The partner list gives VAST credible use cases. CrowdStrike can bring security models closer to restricted telemetry. Deepgram can support voice inference where recordings cannot leave customer infrastructure. Factory can process private source code without exporting it to a hosted agent.

Fundamental describes a scenario where its tabular model processes bank or healthcare records while neither party sees the other's protected asset. TwelveLabs targets video archives and sensor feeds that are difficult or prohibited to move.

These examples cover valuable workloads, but they remain partner statements. The market still needs reference deployments with documented operating conditions. Buyers will want evidence covering performance, failure recovery, policy management, and integration with existing security operations.

The most important competitive question is whether VAST can turn integration into adoption before rivals close the gap. NVIDIA's underlying building blocks are not exclusive. Other data-platform providers can build comparable runtime and governance layers.

VAST must also persuade model companies that local distribution expands their business without weakening control. That involves licensing, support responsibilities, model updates, incident response, and usage measurement. Attestation solves only part of that commercial relationship.

The Security Promise Still Has Boundaries

A confidential enclave reduces infrastructure exposure, but it does not make the hardware, verifier, application, or model immune to compromise.

VAST has not published independent production benchmarks for DataEnclave. Blocks & Files reported an expected performance cost ranging from single-digit percentages to low double digits, depending on model size. That estimate remains a company expectation during preview.

Even a modest overhead can matter for real-time voice, coding agents, and large-scale inference. Confidential modes can affect memory movement, startup time, interconnect behavior, observability, and operational tooling. Results will vary across hardware generations and model architectures.

VAST has also not disclosed licensing terms or detailed capacity requirements. Buyers cannot yet compare the complete operational burden with hosted APIs, self-managed open-weight models, or other confidential computing products.

The product's Q1 2027 shipping target creates execution risk. Preview partners can validate an architecture under controlled conditions, but production environments introduce firmware differences, patch cycles, networking constraints, and identity integrations.

Security assurance depends heavily on the verifier. An attacker who compromises policies, reference measurements, signing systems, or key-management infrastructure can undermine the verify-before-decrypt process. Strong hardware evidence cannot repair a verifier that approves the wrong workload.

The IETF framework itself notes that verifier policy and signature validation are critical implementation concerns. It supplies shared roles and terminology rather than certifying a particular product. Buyers still need to examine VAST's implementation and operating procedures.

Hardware also has a continuing vulnerability lifecycle. Confidential computing places more trust in processors, firmware, device certificates, and isolation mechanisms. Security teams must monitor advisories and apply updates without disrupting approved measurements or breaking workload compatibility.

An extensive confidential inference study identifies further requirements beyond memory isolation. High-assurance systems need audited workload code, protected keys, secure attestation, contained data paths, and defenses against weight extraction.

The paper also makes clear that confidential inference systems retain meaningful risks. Side channels, implementation flaws, supply-chain compromise, denial of service, and unsafe application interfaces require separate treatment.

Model behavior creates another limit. DataEnclave can restrict an administrator from reading protected memory, but it cannot guarantee that a model will never reproduce sensitive prompt content. Application designers still need output filters, authorization checks, and narrowly scoped retrieval.

Similarly, a model API might expose information through debugging functions, logs, error messages, or intentionally crafted queries. The workload developer remains responsible for those interfaces. Enclave technology does not automatically make the API safe.

Audit records need careful interpretation. A log proving that an approved image started under a stated policy can strengthen accountability. It does not prove that every output was correct, unbiased, authorized, or compliant with every regulation.

Air-gapped environments introduce additional operational complexity. Attestation services, key brokers, firmware references, revocation information, and application updates must function without normal external dependencies. Organizations need tested processes for transferring trusted updates across the boundary.

There is also a concentration question. DataEnclave joins storage, execution, database logging, application packaging, and agent management within VAST's platform. Integration can simplify operations, but it gives customers another reason to evaluate platform dependence and administrative separation.

The right buyer response is therefore neither dismissal nor automatic trust. DataEnclave presents a credible architecture for a difficult two-party security problem. Its production value must be established through transparent testing, threat modeling, and real deployments.

What to Watch Before the Q1 2027 Release

Three signals will determine whether VAST DataEnclave becomes a working distribution channel or remains an appealing preview architecture.

The first signal is production validation from regulated customers. VAST needs deployments that show how attestation policies, key release, audit records, and local data retrieval behave under ordinary operations.

Useful evidence would include workload startup times, inference overhead, model-update procedures, failed-attestation handling, and recovery after infrastructure maintenance. Independent security assessments would provide more value than another collection of partner endorsements.

A successful deployment in banking, healthcare, government, or cybersecurity would strengthen VAST's core argument. It would show that model owners and enterprises can accept the same technical boundary without surrendering their separate controls.

The second signal is participation from additional closed-model developers. The current partners offer meaningful specialized models, yet broader customer demand often centers on a smaller group of major foundation-model providers.

Signed availability from one of those providers would indicate that DataEnclave's commercial and security controls satisfy stricter intellectual-property requirements. Continued absence would leave customers with a narrower catalog than the architecture promises.

Model packaging and updates deserve particular attention. Enterprises need consistent methods for receiving encrypted releases, verifying provenance, testing compatibility, applying patches, and retiring old versions. Model providers need enforceable terms without intrusive access to customer systems.

The third signal is measurable differentiation from Dell, HPE, Fortanix, cloud confidential computing, and open stacks. VAST must demonstrate that integrated deployment and governance outweigh platform dependence.

Performance data will be part of that comparison. Buyers should examine latency, throughput, utilization, replica startup, and multi-GPU scaling with confidential mode enabled. They should also test whether existing observability practices remain effective when administrators cannot inspect workload memory.

Security teams should ask who controls every key, policy, certificate, measurement, and audit record. They should test rejection paths, revocation, expired credentials, firmware drift, compromised images, and unavailable attestation services.

Procurement teams should examine responsibility during incidents. A deployment can include VAST, an OEM, NVIDIA, Fortanix, a model provider, and the enterprise itself. Clear ownership matters when an attestation check fails or a security update changes approved measurements.

Developers should assess the application boundary with equal care. A secure runtime remains only one layer. Retrieval permissions, prompt construction, API authentication, output handling, and egress policy determine which information the workload can process or reveal.

VAST DataEnclave deserves attention because it targets a real deadlock in enterprise AI. Sensitive data cannot always move to a hosted model, while valuable closed weights cannot safely enter every customer-controlled environment.

Its answer is technically coherent: verify the environment, isolate execution, separate key ownership, minimize data access, and record decisions. The remaining question is whether partners and customers can operate that system at production scale.

Before committing, buyers should request a threat model, independent assessment, workload-specific benchmarks, and a complete responsibility map. If VAST supplies that evidence before Q1 2027, confidential AI could become a practical deployment choice rather than a contractual promise.