Get started

Order a Confidential VM node, connect over SSH, and verify the CPU and GPU attestation from inside the guest.

One node, one Intel TDX confidential VM, yours for the term. Ordering, minimums and billing are on the pricing page; this page covers what happens after the order.

What you receive

Once payment is received and the node is provisioned, we send one email to the technical contact named on the order. It contains the SSH host and port, the login user, the SSH public key we installed (the one you supplied on the order), the expected launch measurements for your VM, the GPU count and model, and the handover and release times in UTC.

Nothing else is sent by email. No passwords, no keys.

First login

ssh -p <port> <user>@<host>

Once in, three quick checks that you are inside a TDX guest with GPUs in confidential computing mode:

# The kernel reports TDX
dmesg | grep -i tdx
# expect: "Memory Encryption Features active: Intel TDX"

# The TDX guest device is present
ls -l /dev/tdx_guest

# GPUs are in CC mode and ready
nvidia-smi conf-compute -f     # expect: CC status: ON
nvidia-smi conf-compute -grs   # expect: CC Protected Memory ready state: ready
nvidia-smi                     # expect: all GPUs listed

If any of these fails, stop and email hello@confidential.ai with the output before loading any data.

Verify the CPU attestation

The guest exposes the TDX quote through the kernel's configfs-tsm interface. You supply a nonce; the quote binds it in report_data, so the evidence is fresh and yours.

NONCE=$(head -c 64 /dev/urandom | base64 -w0)
mkdir -p /sys/kernel/config/tsm/report/r0
echo -n "$NONCE" | base64 -d > /sys/kernel/config/tsm/report/r0/inblob
cat /sys/kernel/config/tsm/report/r0/outblob > quote.bin

Verify quote.bin with the verifier of your choice and check:

  • The quote signature chains to Intel's SGX Root CA through the PCK certificate.
  • report_data contains your nonce.
  • MRTD matches the launch measurements we sent. This is the firmware.
  • RTMR[1] and RTMR[2] match. These are the kernel and the root filesystem.
  • The TD is not debug-enabled.

Our open-source verifier and the published measurements are linked from the attestation docs.

Verify the GPU attestation

Each GPU produces a signed attestation report through the NVIDIA driver. The evidence is bound to a nonce you choose, and the certificate chain roots in NVIDIA's device identity CA. Verify with NVIDIA's attestation tooling or ours and check, per GPU:

  • The certificate chain verifies to the NVIDIA root.
  • The report's nonce matches yours.
  • CC mode is on and the GPU is in the ready state.
  • The device UUIDs in the reports match nvidia-smi -L on the host you are logged into.

Storage

Encrypted persistent storage across restarts is not available yet. Treat each start as a cold load: pull model weights and datasets from your own object storage when the VM comes up, and plan for the load time.

Nothing you write is readable by us or by the hosting provider while the VM runs. Memory and storage encryption keys never leave the TDX guest.

Limitations

No root on the bare-metal host. No custom guest image or kernel on Confidential VMs (bring-your-own-image is a Confidential Metal feature). Daily stop and start does not pause billing.

One VM per node; we do not split nodes. Intel TDX today, AMD SEV-SNP on request. No snapshots, no live migration.

Support

hello@confidential.ai. Reply times per your order form.

For attestation questions, include the quote, the GPU reports and the tool output. Do not include your data or keys.