Rafay Systems and Fortanix have announced an integration designed to help neocloud providers, sovereign AI cloud operators, and enterprises deliver confidential AI workloads as a service. The solution combines the Rafay Platform’s Kubernetes workload orchestration with Fortanix Confidential AI and the Cloud Native Computing Foundation’s (CNCF) Confidential Containers project. By using hardware-based Trusted Execution Environments (TEEs), cryptographic attestation, and controlled encryption-key release, the companies aim to protect sensitive data and proprietary AI models while they are being processed on shared or third-party GPU infrastructure.
Rafay Systems and Fortanix have announced an integration designed to help neocloud providers, sovereign AI cloud operators, and enterprises deliver confidential AI workloads as a service. The solution combines the Rafay Platform’s Kubernetes workload orchestration with Fortanix Confidential AI and the Cloud Native Computing Foundation’s (CNCF) Confidential Containers project. By using hardware-based Trusted Execution Environments (TEEs), cryptographic attestation, and controlled encryption-key release, the companies aim to protect sensitive data and proprietary AI models while they are being processed on shared or third-party GPU infrastructure.
Protecting AI Data While It Is Being Processed
Traditional encryption protects information while it is stored or transmitted across networks. However, data generally has to be decrypted when an application processes it. In conventional cloud and GPU environments, that can expose sensitive information and model weights in system memory to privileged infrastructure administrators or compromised software.
Confidential computing addresses this exposure by running workloads inside hardware-enforced Trusted Execution Environments. Memory assigned to a protected workload is encrypted, with hardware and software measurements used to verify the environment before sensitive keys are released.
This is particularly relevant to AI services. A healthcare organization may want to run inference on patient records using a model hosted by an external provider. A financial institution may need to process confidential transaction data on GPU infrastructure operated by a neocloud. At the same time, the model owner may want to prevent the infrastructure operator or customer from extracting proprietary model weights.
The Rafay-Fortanix integration is designed to address both sides of this trust problem: protecting customer data from model providers and infrastructure operators, while protecting model intellectual property from unauthorized access.
Kubernetes Workloads Enter Confidential Containers
The integration extends the companies’ existing confidential virtual machine capabilities to Kubernetes workloads running through CNCF Confidential Containers, commonly known as CoCo.
CoCo applies confidential computing to containerized applications. Built on Kata Containers, it runs a protected container workload inside a lightweight confidential virtual machine. Developers can continue using familiar Kubernetes deployment practices while the workload receives hardware-backed memory protection.
The project became a CNCF Incubating project in July 2026, reflecting its progression within the cloud-native ecosystem. It is intended to bring confidential computing into container-based infrastructure without requiring organizations to abandon their existing Kubernetes development and deployment workflows.
For AI teams, this could reduce the operational separation between standard model deployment and security-protected inference. Workloads can be packaged and deployed using familiar container images and orchestration tools, with additional configuration for confidential execution and attestation.
Cryptographic Attestation Controls Access to Keys
Fortanix provides the trust verification and key-management layer. Its Confidential Computing Manager (CCM) performs composite attestation, checking evidence from the confidential computing environment before allowing access to encryption keys.
Depending on the supported hardware configuration, verification can include CPU and GPU trusted execution environments, firmware, and relevant software measurements. The objective is to establish that the workload is running in an approved environment and that its integrity meets defined security policies.
Fortanix Data Security Manager (DSM) then controls the release of encryption keys. The company says its key-management service is backed by a FIPS 140-3 Level 3-certified hardware security module. Keys are released only after the environment passes the required attestation checks. If verification fails, the workload does not receive the keys needed to decrypt protected data or model assets.
This creates a chain of trust between the hardware environment, the workload, and the key-management service. Rather than relying only on a cloud provider’s security assurances, customers can use cryptographic evidence to verify that approved workloads are receiving access to sensitive assets.
Rafay Turns Confidential Computing Into a Managed Service
Rafay’s role is to operationalize the underlying security architecture for cloud operators and enterprise platform teams.
The Rafay Platform automates deployment of the Fortanix and CoCo components through infrastructure blueprints. Operators can onboard GPU infrastructure and establish isolated tenant environments for different customers.
The companies are also introducing a self-service model through Rafay SKU Studio and the Rafay Developer Hub. Administrators can package approved confidential AI workloads as service offerings, allowing end users to launch them without submitting manual support requests.
Policy controls, access permissions, and resource quotas can be applied across tenants and clusters. This is important for neocloud providers seeking to turn GPU infrastructure into differentiated services rather than competing only on accelerator availability and computing prices.
The model could also appeal to sovereign AI cloud operators that need to maintain control over infrastructure and key custody while providing customers with independently verifiable workload protections.
Opportunities in Regulated and Multi-Tenant AI
The joint solution targets financial services, healthcare, government, and other environments where sensitive information or proprietary models create barriers to using third-party AI infrastructure.
Potential applications include inference on confidential patient records, financial risk analysis, fraud investigation, and AI services that process proprietary enterprise datasets. Model developers could also distribute encrypted models to customer environments while retaining control over when and where those models can be decrypted.
Fortanix and Atomik Research report that 93% of surveyed AI leaders understand traditional encryption does not protect information while it is being processed, but only half can fully verify that protection during inference. The survey points to a gap between awareness of data-in-use risks and the ability to demonstrate that appropriate safeguards are operating.
The companies say the Rafay integration is available now, extending their earlier confidential virtual machine integration to CoCo-based Kubernetes deployments.
Confidential Computing Still Has Technical Boundaries
Although TEEs can reduce exposure to privileged infrastructure operators, confidential computing is not a complete security solution. Its protections depend on supported processors and accelerators, firmware integrity, correct configuration, and the reliability of the attestation and key-management services.
Hardware compatibility also matters. Confidential GPU execution is available only on supported accelerator and platform combinations. Organizations must verify that their chosen CPU, GPU, drivers, firmware, and software stack are covered by the relevant implementation.
Confidential computing also does not automatically prevent denial-of-service attacks, application vulnerabilities, malicious model behavior, or every form of data leakage through workload outputs and side channels. Workload identity, access policies, application security, audit logging, and conventional cybersecurity controls remain necessary.
For enterprise buyers, the important question will be whether the combined platform can deliver measurable security assurance without introducing unacceptable deployment complexity or inference overhead.
A New Service Opportunity for AI Infrastructure Providers
The Rafay-Fortanix partnership reflects a broader shift in AI infrastructure: customers increasingly want not only access to GPUs, but also guarantees about how their data and models are handled during computation.
For neoclouds and sovereign AI providers, confidential AI could become a premium service category built around hardware-backed isolation, verified workloads, and controlled key access. For enterprises, it offers another option for using external computing capacity without automatically placing sensitive information and model assets within the infrastructure operator’s trust boundary.
The proposition will ultimately depend on implementation quality, hardware support, auditability, performance, and customer confidence. But by combining Kubernetes orchestration with attestation-based security, Rafay and Fortanix are attempting to make confidential AI a deployable infrastructure service rather than a specialized security project.
Market Landscape
Confidential computing is becoming an important layer in enterprise AI infrastructure as organizations seek to use external GPU capacity without exposing sensitive data or proprietary models during processing.
The partnership targets three overlapping markets:
- Neocloud providers: GPU-focused cloud operators seeking differentiated, security-oriented AI services.
- Sovereign AI clouds: Providers building infrastructure under national or regional data governance requirements.
- Enterprise AI factories: Organizations operating internal or hybrid GPU infrastructure for private AI applications.
The CNCF’s Confidential Containers project became an Incubating project in July 2026, reflecting growing interest in hardware-backed protection for cloud-native workloads.
Top Insights
- Rafay and Fortanix are extending confidential computing into Kubernetes pods through CNCF Confidential Containers and hardware-backed Trusted Execution Environments.
- Fortanix performs CPU and supported GPU attestation before authorizing encryption-key release to verified AI workloads.
- Rafay provides multi-tenant orchestration, infrastructure automation, governance, and self-service deployment through its Developer Hub.
- The integration targets neoclouds, sovereign AI clouds, and regulated enterprises that need to protect data and proprietary models during inference.
- Confidential computing reduces exposure to infrastructure operators but does not eliminate application vulnerabilities, availability risks, or all potential data leakage.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
