VAST Data's Confidential AI Lets Enterprises Keep Sensitive Data While Protecting Model Builders' IP

Organizations seeking to deploy artificial intelligence on their most sensitive information face a fundamental standoff: they refuse to send proprietary data to external cloud services, while model creators are equally unwilling to expose the weights and algorithms they've invested heavily in developing. VAST Data's approach to confidential AI attempts to resolve this impasse by allowing both parties to maintain control over their respective assets.

The tension between enterprise needs and model provider concerns has become acute as generative AI moves from research into production. When an organization needs to run a model against information it cannot afford to expose—patient records, financial details, trade secrets—the conventional path of sending data to a cloud service introduces unacceptable risks. The data traverses external networks, gets processed on someone else's infrastructure, and creates accountability questions that ultimately fall on the organization holding the sensitive information.

Alon Horev, CTO and co-founder of VAST Data, frames the problem in terms of confidence and control. "Even if you ask the model today to obfuscate a conversation or redact PII from a conversation, it's hard to have 100% confidence that's the case, and that it worked." The challenge extends beyond simple data protection: organizations must ensure that customer information shared with an AI system doesn't leak to other customers, while also grappling with questions about whether conversations can be retained for model improvement or training purposes.

A two-sided trust problem requires a two-sided solution

The most advanced models today arrive as software-as-a-service offerings, a distribution model that lets creators maintain control over their intellectual property. Yet even when providers offer compliance features, enterprises often bear the legal and reputational consequences if something goes wrong. Expanding the attack surface by routing data across wide-area networks means more systems, connections, and operators must be trusted. Organizations in regulated industries or those subject to data sovereignty rules may find cloud-based AI entirely unworkable.

Horev observes that many organizations are adopting a hybrid approach: "Some applications and datasets can go to the cloud, while others must remain on-premises, sometimes even in the building, or in the country." Confidential computing offers a path forward by extending encryption protections into the processing environment itself. Hardware-isolated execution creates a protected enclave where both data and model weights remain encrypted until released to an approved workload.

The technical mechanism relies on cryptographic attestation, which verifies the hardware, virtual machine, software, and configuration before releasing decryption keys. A model builder encrypts its model using the public key of a specific confidential VM; only that VM's private key can decrypt it within protected memory. This arrangement lets customers use the model without ever accessing its weights. Meanwhile, the enterprise retains control of keys governing its data, while the model builder retains control of keys governing its model. During execution, the infrastructure operator controls neither set.

As AI systems become more agentic—capable of taking actions with minimal human oversight—these controls take on greater importance. Agents will require access to more data, systems, and tools, and will act on that information with far less intervention. Horev warns that "This world of agentic AI is moving extremely fast, and we need to limit what an agent can see and do." Organizations that fail to establish strong privacy and governance assurances now will struggle even more to deploy agents safely in the future.

From architecture to ecosystem

Building a confidential AI system requires more than theoretical architecture; it demands integration across multiple vendors and layers. Most organizations lack the expertise to assemble and maintain an entire AI stack while negotiating separately with each model provider. VAST Data launched DataEnclave on September 22 as a capability within its AI Operating System, designed to bring the model, application layer, and data platform together under customer-controlled conditions.

The system protects both sides: enterprise data remains under customer control, while model builders can distribute their software without surrendering intellectual property. Horev notes that VAST Data is "working with world-class model builders such as Cohere, Deepgram, Factory, Fundamental and TwelveLabs, who continue to innovate and build their expertise." The ecosystem extends to infrastructure and security partners including Nvidia, CrowdStrike, Fortanix, Nscale, Cisco, and Supermicro—a breadth reflecting the reality that confidential AI requires protected GPUs, models, applications, accelerated hardware, data infrastructure, and operational support working in concert.

Customer-controlled infrastructure also reshapes the economics of AI deployment. Hosted models create unpredictable costs as token consumption fluctuates with usage patterns, agent loops, and model architecture. When enterprises manage their own GPU clusters, they gain a more stable cost foundation based on capacity they own or have budgeted for. This arrangement prevents inefficient model choices or uncontrolled agent activity from generating an open-ended token bill. The cluster itself imposes a natural throughput ceiling, helping organizations understand their infrastructure's capacity. Model providers can then price by token, task, or license while enterprises maintain greater visibility into total operating costs.

Why the data platform is paramount

Confidential AI protects data and model weights during inference, but production AI systems are living environments where information constantly moves between storage, databases, GPUs, networks, applications, and agents. Protection cannot be added as an afterthought to a fragmented technology stack. Horev emphasizes that "You need to build security in multiple layers of the platform," with clear accountability for rapidly updating any compromised components.

Confidentiality alone proves insufficient if the resulting system cannot be operated, monitored, and improved. As AI infrastructure grows more distributed, troubleshooting becomes harder and fault attribution becomes unclear. Horev recommends establishing a "single pane of glass" across storage, networking, and compute so teams can observe what's happening and keep resolution times low. An agent investigating an intermittently failing network port in a data center, for example, could identify the root cause if it has access to the right operational data and tightly controlled permissions—permissions that govern which infrastructure it can inspect, which data it can retrieve, and which actions it can take.

The same principle applies to monitoring AI workloads. Teams require visibility into performance, failures, and access patterns without exposing customer data or model weights. Agent sandboxes can restrict which systems and tools an agent can reach, while data platform observability can log which data it accessed, what it did with that data, and how it interacted with downstream systems. Evaluation becomes an ongoing production discipline: teams must observe systems, measure behavior, govern access, and manage change in ways that demonstrate progress. Confidentiality, data-level policy, observability, and correctness must work together.

The emerging ecosystem reflects growing demand for models that can run securely under customer control, wherever sensitive data resides. These are "living systems," according to Horev. "It's not just leveraging a feature inside of a wider platform."