Enclave

Enclave provides confidential GPU computing through hardware-isolated enclaves that cryptographically prove the operator cannot access tenant data. Developers deploy WebAssembly applications onto verified NVIDIA GPUs where isolation happens at the silicon level, not just through software virtualization. Each deployment generates attestation reports from both the CPU using AMD SEV-SNP and the GPU itself, which clients can verify independently before trusting the environment with sensitive workloads. The verification chain traces back to hardware keys fused at manufacturing by AMD and NVIDIA, creating a root of trust that doesn't depend on trusting the operator.

The security model separates what hardware enforces from what software enforces, and Enclave documents this distinction explicitly rather than obscuring it. Hardware-level isolation through confidential computing with an encrypted CPU to GPU link prevents the operator from accessing tenant VRAM, RAM, keys, or network traffic even with physical machine access. TLS encryption terminates inside the enclave boundary, meaning private keys never exist outside the protected environment. The TLS keypair gets generated inside the enclave with the public key hash included in the attestation report data, allowing clients to verify they're communicating directly with the verified environment.

Software-level protections add tenant separation through WebAssembly sandboxing and separate OS processes for each tenant on shared GPUs. Applications cannot access the host filesystem, environment variables, or spawn additional processes. VRAM gets zeroed before reuse between tenants, preventing data leakage through GPU memory. Cross-tenant memory access attempts fault rather than succeeding, and a watchdog enforces compute share caps. The platform explicitly notes that isolation from other tenants relies on the WebAssembly sandbox, operating system, and NVIDIA GPU driver rather than per-tenant hardware partitioning through MIG, which some users might expect.

Computing resources run on flagship NVIDIA GPUs with 140.4 GB VRAM and 989 TFLOPS per card. The current fleet uses AMD SEV-SNP for CPU attestation. Deployments configure GPU share percentage and CPU share percentage using two configuration dials, with each GPU percent granting approximately 1.4 GB VRAM and 9.9 TFLOPS, while each CPU percent provides roughly 0.16 vCPU and 0.64 GB RAM. Minimum allocations depend on application specifications declared in the WebAssembly package.

Pricing runs on per-second metering at six dollars hourly for full GPU access and three dollars hourly for full CPU node access. Partial shares scale proportionally using a formula of GPU percentage times six dollars per hour plus CPU percentage times three dollars per hour. Example configurations range from CPU-only deployments at thirty cents hourly to full GPU allocations at six dollars thirty cents hourly. Rates settle in millionths of dollars and round up, so the smallest slices meter slightly above the theoretical minimum. Payments are final since unspent runtime persists on the platform but isn't refundable, which creates clear cost expectations without surprise charges or overages.

The API enables CORS requests directly from browsers without requiring backend infrastructure. This browser-native approach means client applications can interact with confidential GPU workloads without routing through intermediate servers that would break the trust chain. Deployments follow a five-step lifecycle covering sign-in with passkey authentication, deployment creation via API, runtime funding through payment, attestation verification using the open-source Tinfoil verifier, and stopping when funds expire or users explicitly terminate. An OpenAPI specification at the standard endpoint documents all available operations.

The entire codebase is published on GitHub under EnclaveHost/enclave, allowing security-conscious users to audit the implementation rather than trusting documentation alone. The static site frontend is pinned to IPFS with content-addressed builds. Steven Batchelor, the founder and CEO, maintains an active presence in technical architecture decisions with a background in certified application architecture and enterprise consulting focused on serverless and decentralized systems. For teams that need GPU acceleration but cannot accept the data exposure risks of standard cloud providers, Enclave offers a verifiable alternative where cryptographic proofs replace trust assumptions.