I run VoltageGPU, which rents confidential GPUs as Intel TDX virtual machines: this comparison comes from a vendor in it. Each cell comes from the provider's own pages on 7 November 2026, linked in the full matrix; a second read that evening found no figure changed.
The criterion
A provider passes if a customer can rent a GPU inside a hardware trust boundary and attest it without taking the provider's word: in full, an Intel TDX or AMD SEV attestation for the CPU and an NVIDIA one for the GPU, both on a nonce the customer picks. Six of the ten pass by their own documentation, though not every guide covers both halves or names the nonce.
Ten providers on 7 November 2026
| Provider | Attestable GPU for rent | CPU technology | Published price per GPU-hour |
|---|---|---|---|
| VoltageGPU | Yes: H100, H200, RTX PRO 6000 Blackwell; 8x H100 and 8x H200 nodes | Intel TDX | H100 $6.95, H200 $9.00, RTX PRO 6000 $3.80; 8x nodes $55.62 and $72.00 per node-hour |
| Microsoft Azure | Yes: one H100 NVL (NCCads H100 v5) | AMD SEV-SNP | $6.98 (East US 2) to $8.90 (West Europe), Linux |
| Google Cloud | Yes: one H100 (A3 High), one RTX PRO 6000 (G4) | Intel TDX (A3), AMD SEV (G4) | No single figure (below) |
| Phala | Yes: H100, H200, B300 | Intel TDX | H100 $3.08, H200 $5.50 (24-hour minimum); B300 $8.50 (30-day minimum) |
| Verda (formerly DataCrunch) | Yes: RTX PRO 6000, B200, B300 | AMD SEV-SNP; Intel TDX also on B200, B300 | RTX PRO 6000 $2.78, B200 $9.32, B300 $11.93 |
| io.net | Yes, on request: H100, H200, B200; its guide attests the GPUs only | Intel TDX or AMD SEV-SNP | Not published (below) |
| NEAR AI | No: inference API, no GPU rental | Intel TDX | Not applicable (per token) |
| AWS | No: Nitro Enclaves have no GPU | Nitro Hypervisor | Not applicable |
| OpenMetal | Not yet: CPU-to-GPU attestation not validated | Intel TDX | Not published |
| Hyperstack | No: "not currently available" | Not published | Not published |
List prices, on demand unless a term is stated, before storage, egress and taxes.
- Ours: our public feed, /api/pricing/snapshot, built at 18:16 UTC. In stock then: 16 single-GPU H100 VMs and two 8x H100 nodes; no H200 or RTX PRO 6000.
- Google publishes parts: in us-central1, a g4-standard-48 is $4.49993 an hour, plus a $0.45 confidential surcharge and a $0.08 NVIDIA licence, $5.03 by our sum. The a3-highgpu-1g has no on-demand confidential price.
- io.net provisions confidential VMs through sales. An io.net FAQ page, its status dated April 2026, lists a confidential H100 at $1.64 an hour that its documentation does not mention.
Who is cheaper
Phala: on demand, $3.87 below us on the H100 and $3.50 on the H200; its reserved slots cost $2.38 and $4.40. Verda's RTX PRO 6000 is $1.02 below ours; Azure in East US 2 is $0.03 above our H100. Spot capacity, which the provider can evict, costs less still: $1.29 an hour for the Azure VM in East US 2, $1.39 for Verda's RTX PRO 6000.
Minimums matter for short jobs: one on-demand Phala H100 costs at least $73.92 (24 hours), which our H100 reaches after about 10.6 hours (H200: $132, about 14.7 hours). Past that, Phala costs less.
We sell no B200 or B300 as a Confidential VM; the table lists Verda, Phala (B300) and io.net (B200, on request).
What else differs
- VM or container. At Phala, workloads run as Docker containers inside a confidential VM; the five other sellers rent out a virtual machine.
- Who generates the evidence. The customer, inside its VM, at VoltageGPU (TDX quote and NVIDIA report, both on its nonce), Verda (SEV-SNP report or TDX quote on its nonce, then nvattest), Google (Confidential VM report, nvattest on its nonce) and Azure (in-guest SEV-SNP evidence, local NVIDIA attestation). io.net's guide covers the GPUs only. At Phala, the dstack runtime returns a TDX quote on reportData the customer chooses and checks the GPU before enabling it; its GPU guide adds NVIDIA's local verifier.
- Minimum and billing unit. Phala: 24 hours (30 days for the B300). VoltageGPU: one prepaid hour, then per second, unused part refunded on stop. Google: per second after one minute. Azure: per full minute. Verda: prepaid 10-minute increments, unused part refunded. OpenMetal: monthly. io.net: not published.
What the table does not show
- We rented no other provider's GPU: each cell repeats their pages, and their stock was not checked.
- Our attestation checks the VM's software only against measurements you supply, and we publish none for our image; it does not rule out physical attacks such as TEE.fail. Our 8-GPU nodes, attested on 4 November 2026, run in NVIDIA's multi-GPU Protected PCIe mode: each GPU is attested on its own, and the mode does not encrypt traffic between GPUs over NVLink.
- Outside our Confidential VMs, bare metal, standard GPUs and sandboxes have no enclave, we have attested no B200 or B300, and our inference API goes through a relay that sees requests in clear.
Check it yourself
Whatever the provider, request both pieces of evidence on a nonce you drew and verify them on your own machine, against Intel or AMD and NVIDIA. Our dated runs and their raw files are on voltagegpu.com/proofs; voltagegpu.com/tools decodes TDX quotes and NVIDIA tokens in the browser, without checking signatures.
Drafted with AI assistance, then checked: every figure was read on the provider's own pages on 7 November 2026.
Top comments (0)