Confidential AI
Run AI on sensitive data whether you build the application, own the model, run the GPUs or use the AI. Prompts, data and model weights stay protected while they are processed.
the foundation
Confidential AI means running AI workloads, whether training a model, fine-tuning it or serving inference, so that the data, the model and the prompts stay protected while they are being processed, not only while stored or in transit.
Traditional security encrypts data at rest and on the wire, but it has to be decrypted the moment a model touches it. Confidential AI closes that gap using privacy-enhancing technologies such as trusted execution environments, which isolate the computation inside hardware that even the cloud operator cannot inspect.
Confidential AI is what makes “use the data” and “protect the data” compatible instead of opposing goals. Read more about confidential computing with TEEs.
Duality runs on the confidential computing in AWS, Microsoft Azure, Google Cloud and on-premises data centers, and adds the controls that turn a protected environment into a governed workflow.
Keys are released only after the enclave’s attestation and the approved workload are verified.
Data owners and model owners each encrypt under their own key. Duality adds no key store of its own.
Policies set who may use each asset and how often. Every key release and policy decision is recorded.
For software vendors
Serving defense, healthcare, law enforcement, banks and critical infrastructure often means installing and maintaining your software at each customer site. GenAI makes that model harder to scale: customers may lack the GPUs to run new features, and they need verifiable protection for sensitive data before using your cloud.
Duality’s software lets you deliver GenAI from your own cloud while protecting customer prompts and data during processing. Your application runs inside a secure enclave in your cloud account. The customer’s own Duality node verifies the enclave before any of its users connect.
Lower TCO for your customers
Your customers don’t need to run and maintain expensive GPU servers for inference.
Deliver advanced AI without on-site GPUs
Offer LLM summarization, data enrichment and other GPU-intensive features without requiring customers to buy and operate their own GPU infrastructure.
Roll out upgrades faster
Update your cloud deployment with fewer customer-site installations to coordinate.
Reduce deployment and support overhead
Reduce the amount of application software you install and maintain at individual customer sites.
Your application runs in a TEE in your own cloud account. It is stored encrypted, and its key stays in the customer’s key management service.
A Duality node at the customer’s site attests the enclave when it starts and regularly after, then issues the certificates its users connect with.
Users check the attestation in their browser before connecting. They need no Duality software on their machines.
Sovereign AI
Your customers in regulated environments are looking for sovereign solutions. With Duality, you operate the service in your cloud while the customer controls it: the encryption key stays in the customer’s key management service, and the customer’s own node attests the enclave before any data is released. That is Cryptographic and Computational Sovereignty, enforced by the architecture rather than promised in a contract.
Ship LLM summarization, data enrichment and agentic features from your cloud, with no enclave engineering team to build.
A cloud tier for customers who refused the cloud, with no on-site GPUs for them to buy and upgrades on your release schedule.
Their own node decides whether the enclave is trusted, so they rely on evidence rather than on your operations team.
For model providers
Banks, health systems and government agencies want frontier models, but two concerns stall the deal. Hosted, they hesitate to send sensitive prompts to an environment the provider administers. On their own infrastructure, running the model means exposing your weights.
Duality’s software lets you serve these customers while protecting their prompts and data, and your model weights, during processing. Inference runs inside a secure enclave, in your hosted environment or in the customer’s VPC or data center. Keys are released only after attestation verifies the enclave.
Open regulated markets
Address the data protection requirements that keep banks, health systems and government agencies from using hosted models.
Deploy where the customer requires
Offer VPC and on-premises deployments without handing over your model weights.
Support security reviews with evidence
Answer customer questionnaires with attestation and audit records, not only contract terms.
Lower the risk of exposure
Reduce the risk of exposing customer prompts and data, including to your own operators.
Inference runs inside a TEE in your hosted environment. Prompts and data are decrypted only inside the attested enclave, out of your operators’ view.
Duality runs in the customer’s VPC or data center, with Red Hat confidential computing and NVIDIA confidential GPUs. You manage the model; the customer never holds the weights.
Keys are released only after attestation is verified, and a tamper-evident audit trail records every key release and policy decision, metadata only.
Sovereign AI
Regulated and public-sector buyers increasingly ask for sovereign AI. With Duality, you operate the model while the customer controls access to its data: keys are released only after attestation verifies the environment, wherever the model runs. You can offer a sovereign deployment customers can verify, not only one they are asked to trust.
A way through the security review that stalls regulated and public-sector deals.
Runs on confidential GPU infrastructure, with no enclave team to staff.
Attestation evidence and audit logs to answer customer security questionnaires.
For neoclouds
Regulated and enterprise AI buyers often keep sensitive workloads off shared GPU infrastructure. Before they move, they need to verify that neither your operators nor other tenants can access their prompts and data. Competing on price alone does not answer that.
Duality’s software lets you offer LLM inference that protects each tenant’s prompts and data during processing. Inference runs inside secure enclaves on your confidential GPUs, and each tenant can verify the enclave from a browser before sending a prompt.
Add a premium tier
Sell confidential inference alongside standard GPU capacity.
Win regulated workloads
Address the requirements that keep banking, healthcare and government AI workloads off shared GPUs.
Compete on trust, not only price
Stand out from hyperscalers and other GPU clouds with protection tenants can verify.
Launch without an enclave team
Deploy ready-made software on the confidential GPUs you already run.
Duality runs on your confidential GPUs. Each tenant’s applications connect to an attested enclave that your operators and other tenants cannot see into.
TEE clusters scale out across confidential computing nodes, and one dashboard manages every inference service.
Each tenant gets its own audit trail and can verify the enclave from a browser before sending a prompt.
Sovereign AI
Sovereign compute is a growing market, and data-center location alone does not show who controls a workload. With Duality, you operate the GPUs while each tenant holds its own keys and verifies the enclave before releasing data, so your sovereign offer rests on evidence tenants can check.
A confidential inference tier priced above shared inference, and regulated workloads that will not run on shared GPUs today.
A ready-made software layer on the hardware you already own.
Attestation and audit evidence tenants can hand to their auditors, and sovereign compute they can verify for themselves.
For enterprises
Most organizations already encrypt data at rest and in transit. The exposure comes when AI processes it: a prompt sent to a hosted model, records an AI application reads, a training job that needs cloud GPUs. As a result, many teams keep their most valuable data away from AI.
Duality’s software lets you run AI on sensitive data while protecting prompts, data and models during processing. Hosted models, your own AI applications and agents, and cloud training jobs run inside secure enclaves. Keys are released only after attestation verifies the environment.
Use hosted models with sensitive data
When a provider runs inference in a Duality-protected enclave, your prompts and data stay protected during processing.
Protect AI applications in use
Deploy LLM inference, AI applications and agents in enclaves, with one layer for deployment, monitoring and security.
Extend on-prem AI to cloud GPUs
Run training and inference in the cloud to reduce cost and GPU-shortage risk, with data and models encrypted on the way.
Govern AI agents
Set which agents can use which data and tools, with every action recorded in an audit trail.
When a model provider or neocloud runs inference inside a Duality-protected TEE, your prompts and data are processed out of view of the host and the cloud vendor.
In addition to encryption at rest and in transit, Duality enables you to securely run your applications with encryption in use. Deploy LLM inference, fine-tuning workloads, AI agents or custom applications inside trusted execution environments (TEEs) within your own infrastructure.
Run a job started on-prem on confidential cloud GPUs. The workload and data travel encrypted, and the trained model returns encrypted.
Set which agents can use which data and tools, with every action recorded in an audit trail, on a unified platform for deployment, management, monitoring and security.
Sovereign AI
Sovereignty is not only where data is stored. With Duality, your cloud or model provider operates the infrastructure while you control the keys and the policies, and attestation verifies the environment before any data is released. Read more about sovereign data and AI.
Reduce the operational headache of running your AI applications in confidential computing.
Add encryption in use to all your enterprise applications and dramatically reduce the risk of attacks.
Policies that set who may use what, how many times, and until when.
Beyond trusted execution environments (TEEs), securing applications means addressing a wide range of operational, security and compliance challenges. Duality provides a turnkey solution for managing applications across all your customers, covering the full application lifecycle: management, monitoring, auditing and compliance. The platform delivers an enterprise-grade security framework your customers can trust.
No. Duality ships software you run. It does not operate the service and adds no key store of its own: each data owner and model owner encrypts under its own key.
On AWS, Microsoft Azure and Google Cloud, in on-premises data centers and in air-gapped networks, including on confidential GPUs.
Yes. Duality can be deployed anywhere, including in sovereign cloud environments.
A TEE operates much like a conventional server, with negligible impact on performance.
With one workload, scoped as a proof of concept. See how it works on the Secure AI Factory page.
An AI feature your on-prem customers cannot host, a model a customer wants on its own premises, a confidential inference tier, or an AI application on sensitive data. Bring one, and we will scope it with you.