Pricing
There are two ways to run Confidential AI:
- Cloud. Run on our infrastructure. Pay by usage.
- Licensed. Run on your infrastructure. Pay per GPU, CPU core per year.
Invoices are paid monthly in arrears, by card or bank transfer.
Cloud
Confidential Inference is metered per token. Confidential VMs are reserved by the hour. Committed volume gets committed pricing: get in touch.
Confidential Inference
Pay per token. OpenAI-compatible API, open-weight models in TEEs. Prompts and responses stay invisible to us. Fetch and verify the attestation before you send a prompt.
| Model | Status | Input (per 1M tokens) | Input Cached (per 1M tokens) | Output (per 1M tokens) |
|---|---|---|---|---|
| Kimi K3 | Request capacity | $3.00 | $0.30 | $15.00 |
| GLM 5.3 | Request capacity | $1.40 | $0.26 | $4.40 |
| Qwen3.8 27B | Request capacity | $0.30 | $0.03 | $1.80 |
| DeepSeek V4 Flash | Available | $0.20 | $0.018 | $0.40 |
Additional models on request: hello@confidential.ai. Provider integrations for inference routers: hello@confidential.ai. API docs: get started.
Cached input: prompt-prefix tokens served from cache, billed at the cached rate.
Billing: metered per token, invoiced monthly in arrears. Card or bank transfer.
Confidential VMs
GPU VMs: billed per GPU-hour. Rent 1, 2, 4 or 8 GPUs. Each rental is one confidential VM.
| GPU | VRAM | Host CPU TEE | GPU CC mode | Status | Per GPU-Hour |
|---|---|---|---|---|---|
| B300 | 288 GB HBM3e | Intel TDX | Multi-GPU, NVLink encrypted | Available | $7.50 |
| B200 | 192 GB HBM3e | Intel TDX | Multi-GPU, NVLink encrypted | Available | $6.50 |
| H100 | 80 GB HBM3 | Intel TDX | Protected PCIe, NVLink not encrypted | Request capacity | $3.25 |
Available: allocated within a few days of a signed order. Request capacity: send configuration and duration and we confirm lead time.
Single GPU pass-through is available on every listed GPU. Multi-GPU with encrypted NVLink: B200 and B300. Protected PCIe (multi-GPU, NVLink and NVSwitch unencrypted): H100.
CPU VMs: billed per physical core-hour (2 vCPUs = 1 core), plus per GB-hour of RAM.
| TEE Backend | Per Core-Hour | Per GB-Hour (RAM) |
|---|---|---|
| AMD SEV-SNP | $0.05 | $0.012 |
| Intel TDX | $0.05 | $0.012 |
What you get
- Confidential VM with root over SSH. Intel TDX.
- Every GPU in NVIDIA Confidential Computing mode. NVLink and NVSwitch encrypted on B200 and B300.
- CPU and GPU attestation from inside the guest. Verify with our open-source tools or your own.
- 8 GPUs: a whole node. Nothing shared. The host is yours for the term.
- 1, 2 or 4 GPUs: one confidential VM on a shared host. Other tenants' confidential VMs may run beside it. Intel TDX keeps your memory unreadable to them, to the host, and to us.
- Regions: United States (Texas) and Central America. EU capacity coming.
Not offered:
- Root on the bare-metal host. We provision the confidential VM; the host layer stays with us. To run your own hypervisor, use a bare-metal provider.
- Custom guest images or kernels. We provision a measured guest and give you root inside it. Bring-your-own-image is a Confidential Metal (licensed) feature.
- Encrypted persistent storage across VM restarts. Not ready yet. Treat each start as a cold load.
- Daily stop and start to pause billing.
How to get CVMs
Confidential VMs are provisioned by us. A console and API are on the roadmap.
- Email hello@confidential.ai with GPU class, GPU count, region, start date and duration.
- We confirm availability and send an order form.
- Return it signed, with the legal name and billing address of the individual or company, a technical contact, and the SSH public key to install. We run basic KYC on all dedicated-hardware orders.
- First invoice: 50% of the order, by bank transfer. On payment we allocate your VM and send SSH access.
- Final invoice: 50% on completion. Longer engagements are invoiced monthly in arrears.
Minimum order $500. Minimum term 3 months; a short evaluation of up to a week is available first. Rent one, two, four or eight GPUs; each rental is one confidential VM. Billing runs for the reserved period whether the VM is running or not. USD by bank transfer; card payment is not accepted for dedicated hardware. No annual commitment required. Longer engagements: rates slightly below list, depending on term. Ask.
Licensed
Deploy the Confidential AI stack on your own infrastructure: on-prem, bare metal, and all major clouds.
One stack. One license per GPU per year, or per CPU core per year.
What you get
The full confidential-computing stack, one bundle:
- Confidential Metal: attestable, verifiable confidential VMs on bare metal.
- C8s: Confidential Kubernetes. Scale AI workloads to data center scale.
- AI Workload Services: confidential inference, training and fine-tuning.
- Confidential OS: hardened VM guest OS for development and production.
- Client Libraries & SDKs: clients verify confidentiality claims themselves.
No per-component line items. Software updates included. Standard support included.
How pricing works
License per GPU per year, or per CPU-core per year. CPU-cores in machines with GPUs are covered by the GPU license.
Annual license, invoiced monthly in arrears. Same prices in every region.
GPU licenses
Per GPU, per year:
| GPU class | Per GPU-Year |
|---|---|
| RTX PRO 6000 | $2,789 |
| H100 | $3,876 |
| H200 | $4,974 |
| B200 | $7,625 |
| B300 | $9,884 |
Each license covers one GPU of that class. Licenses are not tied to unique GPUs; they transfer freely across GPUs of the same class.
GPU prices include the NVIDIA Confidential Computing (CC) license. We handle CC licensing with NVIDIA. No action required.
CPU-core licenses
Per CPU-core, per year:
| Per CPU-core-Year | |
|---|---|
| CPU-core only | $48.85 |
Covers Intel and AMD cores. Physical cores, not vCPUs or hyperthreads. Licenses transfer freely across cores. Not required for cores in GPU machines.
Support
| Standard | Enterprise | |
|---|---|---|
| Price | Included | 25% of total license price |
| Coverage | Business hours | 24/7 for production outages |
| Response, production outage | 1 business day | 1 hour |
| Contact | Shared queue | Dedicated technical account manager |
Discounts
Multi-year and volume commitments are negotiable. Contact sales.
Example
500 B200s: 500 x $7,625 = $3,812,500/year, invoiced monthly at about $317,708. That is $635 per GPU per month, with the full stack, NVIDIA CC licensing, updates, and support included.
Order of operations at larger scale: license total, any negotiated discounts, then any enterprise support uplift. Multiplicative.
Terms
- Governed by Terms of Service and Privacy Policy.
- Enterprise engagements: we put a master agreement in place. If you have a standard vendor agreement, send it and we work from that.
- Happy to sign NDA. Send yours or ask for ours.
- Regulated data (HIPAA PHI, payment card data): permitted under a written agreement. Ask. DPA for GDPR and UK GDPR: on request.
- Data location: the region you select. We cannot read memory in use, in the VM or on the GPU; neither can the hosting provider. See attestation for how you verify that.
SLA and support terms are set in the order form or master agreement.
Getting Started
Let us know what you need: hello@confidential.ai.
Common questions, answered: FAQ.