VAST Data launched a confidential AI runtime designed to let enterprises run advanced AI models against sensitive data while keeping both customer information and proprietary model weights within controlled environments.
Called VAST DataEnclave, the system is part of the company's VAST AI Operating System and VAST DataEngine. It uses Nvidia Confidential Computing and hardware-based attestation to verify the computing environment before sensitive data and model weights are decrypted and loaded for processing.
The launch addresses a security gap in AI computing involving accelerator memory. While conventional encryption protects data at rest and in transit, AI models must be decrypted in GPU memory during inference.
“The last gap that's actually existed until very recently is actually the memory, the high bandwidth memory that now sits on these accelerator cards, on these GPUs,” said John Mao, VAST vice president for global business development.
The DataEnclave uses hardware-isolated execution, verify-before-decrypt attestation and independent key control. VAST said customer data keys remain under customer control, while model builders retain control of their model keys and weights.
“If it is authorized to run, then there's a key that's basically exchanged to be able to decrypt the model and execute as you expect,” Mao said.
The architecture is intended for enterprises and governments that cannot move sensitive information to external AI services, including regulated and air-gapped environments.
“Obviously, there's also air-gapped environments, classic air-gapped environments, like government agencies, that can never do that,” Mao said.
For fully air-gapped deployments, Mao said a hardened appliance would be needed.
“In the completely air-gapped model, you would need a hardened appliance, effectively, that would have to be deployed on-prem,” he said.
VAST said DataEnclave can operate in connected or fully air-gapped environments. The system uses attestation services based on the Cloud Native Computing Foundation's Trustee project and can also work with Fortanix's confidential AI infrastructure for fully sovereign deployments.
The platform records attestation events, key releases and enclave lifecycle actions in a tamper-proof audit trail, allowing organizations to verify what ran, where it ran and under what policy.
VAST also said the same secure runtime can provide isolated environments for AI agents through its AgentEngine, controlling the data, systems and tools available to agents and recording their actions.
“Models are becoming a resource the operating system has to manage, the same way it manages data,” said Renen Hallak, founder and CEO of VAST Data. “That means knowing which model fits which task, what it can see, who can use it and under what rules, and doing all of that inside the same security and operational boundaries an enterprise applies to everything else.”
The launch includes model builders such as Cohere, CrowdStrike, Deepgram, Factory, Fundamental, Nvidia and TwelveLabs. VAST also identified Cisco, Supermicro and Lenovo among its server partners and NScale, Buzz and Sharon AI among its AI cloud partners.
Jeff Denworth, VAST co-founder, said model weights are becoming an important category of intellectual property as enterprises develop and fine-tune their own AI systems.
“Base weights define the value of frontier models, while fine-tuned weights will increasingly represent the proprietary intelligence of AI-driven enterprises,” Denworth said.
Nvidia Vice President for Enterprise AI Justin Boitano said the integration of Nvidia Confidential Computing with VAST DataEnclave is intended to provide security, identity, permissions, governance and compliance for AI deployments.
VAST said confidential computing introduces some performance overhead because of the additional processing required during inference. Mao said the impact varies according to model size, with the company planning to publish benchmark results.
