Vast Data launches DataEnclave, confidential computing to protect AI models and sensitive data

Vast Data has unveiled DataEnclave, a new confidential computing capability built into Vast DataEngine and into the broader Vast AI Operating System. The stated goal is to let enterprises run advanced artificial intelligence models against sensitive data without exposing either that data or the model's own intellectual property. To do so, the company draws on Nvidia's confidential computing technology, creating hardware-isolated environments in which both proprietary models and enterprise data can be securely decrypted and processed.

The approach responds to two problems that, according to Vast, currently coexist without a satisfactory solution. On one side are organizations —banks, healthcare providers, government agencies— that cannot send regulated or sensitive information to externally hosted AI services. On the other, model developers are reluctant to distribute the weights of their proprietary models to infrastructure they do not control. Jeff Denworth, co-founder of Vast Data, sums up the heart of the problem: "model weights are quickly becoming the most valuable intellectual property in the world," since base weights define the value of frontier models, while fine-tuned weights increasingly represent the proprietary intelligence of companies operating with AI.

Technically, DataEnclave uses trusted execution environments (TEEs) spanning both CPU and GPU. The system encrypts guest virtual machine memory, GPU memory and NVLink traffic, isolating active models and data from administrators, infrastructure operators and other tenants in the same environment. Before any model or data is decrypted, a cryptographic attestation process verifies the hardware, software and policies governing that environment. Denworth frames it as the central unanswered question: "until now there hasn't been a good solution to guarantee that the memory space where this computation takes place is equally protected... once you get to the final compute destination, is that environment secure enough to decrypt the world's most sensitive data?" Both enterprises and model developers retain control of their respective encryption keys through integrations with their own key management systems.

One notable feature is the ability for a developer's base weights and a customer's fine-tuned weights to operate together inside the same multi-tenant enclave, remaining under separate ownership and key control. According to Denworth, "both can interoperate within this multi-tenant enclave, where we can support both organizations' trust requirements simultaneously." In theory, this would let enterprises build custom models without having to disclose their training or operational data to the base model provider.

The service can be deployed in customer data centers, in AI clouds or in fully air-gapped environments. Its attestation services rely on the Cloud Native Computing Foundation's open source Trustee project, or alternatively on Fortanix's Confidential AI offering. In addition, the system logs attestation events, key release and lifecycle activity for each enclave in the Vast DataBase data store, generating an audit trail documenting which workloads ran and under which policies, without ever revealing the protected data or the model weights.

Initial model and software partners include Cohere, CrowdStrike, Deepgram, The San Francisco AI Factory, Fundamental Research Labs and TwelveLabs, while Cisco Systems and Super Micro Computer appear as hardware partners that will offer integrated systems with this capability.

As for target customers, Vast is initially focusing on organizations with particularly strict security and data residency requirements: large banks, intelligence and defense agencies, and pharmaceutical companies. Denworth explains that in all three cases these organizations have said the proposition "solves major pain points" because they are not allowed to send certain data products to the various external services they would like to use. In his words, these are "basically the most regulated and isolated customers in the world."

The company further argues that DataEnclave could change the economics of enterprise AI: customers could run proprietary models on infrastructure they own or choose a regional AI cloud, reducing the need for model developers themselves to fund the underlying compute capacity. Commercially, Vast has chosen to include the capability within its existing AI Operating System rather than selling it as a separate product: "we're not charging anything extra for this," Denworth says, "it's just part of the AI operating system stack."

DataEnclave is currently available in preview, with general availability planned for the first quarter of 2027, through Vast and its hardware partners, including Cisco and Supermicro.

The announcement fits a broader industry trend toward confidential computing as an answer to two simultaneous frictions holding back AI adoption in regulated sectors: enterprises' reluctance to hand sensitive data to external services and model providers' reluctance to expose their weights outside controlled infrastructure. By leaning on Nvidia technology and open attestation standards such as Trustee, Vast is attempting to position its platform as a neutral trust layer between the two parties, at a moment when the economic value of models —and of their versions fine-tuned for specific use cases— has become an asset as critical as the data they process.