Compute,
enclosed.
Single-tenant GPU nodes and clusters for teams whose models, weights and data must stay theirs. Every machine is yours alone, measured at boot, and verifiable before your keys reach it.
You rent a room,
not a slice of one.
Most clouds isolate tenants in software on shared machines. We draw the boundary in hardware, at every scale you buy — and you can check where it is.
Hall
An enclosure is a locked cage or dedicated racks. Entry is logged against your account, and your network edge terminates inside it.
Rack
Whole nodes only. A host and its top-of-rack ports are never split between customers.
Node
Bare metal. No hypervisor is shared with anyone, and firmware is measured on every boot before the node is handed to you.
GPU
On supported accelerators, confidential-computing mode encrypts traffic between CPU and GPU and attests the GPU's firmware.
Three ways
to hold capacity.
Start with a single node for a week. Grow into a reserved cluster. Move regulated work into an enclosure with its own physical boundary. The software and the API stay the same.
| Form | Unit | Boundary | Interconnect | Term | Typical work |
|---|---|---|---|---|---|
| Node | 1–8 GPUs on one host | Whole host | NVLink inside the node | Per second, or reserved | Fine-tuning, inference, evaluation |
| Cluster | 16–1,024 GPUs | Hosts and their fabric ports | Rail-optimised 400 Gb/s per GPU | Reserved, 1–12 months | Pre-training and large-scale training |
| Enclosure | Dedicated racks or a cage | Physical space and network edge | Your topology, your edge routers | 12 months and longer | Regulated data, sovereign workloads |
Read the hardware
before you rent it.
Every accelerator we offer, with its published memory, bandwidth, interconnect and power — and whether it can run in confidential-computing mode.
NVIDIA · Blackwell Ultra
B300
Largest memory per GPU in the catalog. For long-context inference and frontier-scale training.
- Memory
- 288 GB HBM3e
- Bandwidth
- 8 TB/s
- Interconnect
- NVLink 5 · 1.8 TB/s
- Board power
- 1,100 W
- Confidential computing
- Supported
Published figures vary: 270–288 GB usable memory and 1,100 W+ board power. Confirm against the NVIDIA HGX B300 datasheet.
from $6.20 per GPU-hour Sample
B300 configurationsNVIDIA · Blackwell
B200
Two-die package with fifth-generation NVLink. Large-scale training and high-throughput serving.
- Memory
- 180 GB HBM3e
- Bandwidth
- 8 TB/s
- Interconnect
- NVLink 5 · 1.8 TB/s
- Board power
- 1,000 W
- Confidential computing
- Supported
from $4.90 per GPU-hour Sample
B200 configurationsNVIDIA · Hopper
H200
Hopper with 76% more memory than H100. Fits 70B-class models with room for KV cache.
- Memory
- 141 GB HBM3e
- Bandwidth
- 4.8 TB/s
- Interconnect
- NVLink 4 · 900 GB/s
- Board power
- 700 W
- Confidential computing
- Supported
from $3.10 per GPU-hour Sample
H200 configurationsNVIDIA · Hopper
H100
The established training and inference workhorse, with the deepest software ecosystem.
- Memory
- 80 GB HBM3
- Bandwidth
- 3.35 TB/s
- Interconnect
- NVLink 4 · 900 GB/s
- Board power
- 700 W
- Confidential computing
- Supported
from $2.40 per GPU-hour Sample
H100 configurationsAMD · CDNA 3
MI300X
192 GB per accelerator on ROCm. Memory-bound inference without model sharding.
- Memory
- 192 GB HBM3
- Bandwidth
- 5.3 TB/s
- Interconnect
- Infinity Fabric · 896 GB/s
- Board power
- 750 W
- Confidential computing
- Not available
from $2.10 per GPU-hour Sample
MI300X configurationsNVIDIA · Blackwell
RTX PRO 6000
Server Edition. Inference, fine-tuning and graphics workloads that fit in 96 GB.
- Memory
- 96 GB GDDR7
- Bandwidth
- 1.6 TB/s
- Interconnect
- PCIe Gen5
- Board power
- 600 W
- Confidential computing
- Unconfirmed
from $1.45 per GPU-hour Sample
RTX PRO 6000 configurationsNVIDIA · Ada Lovelace
L40S
Cost-efficient inference, small-model fine-tuning and rendering.
- Memory
- 48 GB GDDR6
- Bandwidth
- 0.864 TB/s
- Interconnect
- PCIe Gen4
- Board power
- 350 W
- Confidential computing
- Not available
from $0.95 per GPU-hour Sample
L40S configurationsVerify,
then trust.
A node is not yours until you have checked it. Provisioning returns signed evidence of what booted; your policy decides whether your keys are released.
- 01Provision. Choose a plan and region. The node is wiped and re-flashed before it is assigned.
- 02Attest. Fetch boot and GPU measurements, signed by hardware keys rather than by us.
- 03Release. Your key service hands over decryption keys only when the evidence matches your policy.
# Provision one node with confidential mode on
cloister nodes create --plan cl.h200.x8 --region eu-n --confidential
# Fetch the boot attestation and verify it against your policy
cloister attest verify node_7Hq2 --policy ./policy.rego
# Release your disk key to the node only if verification passed
cloister keys release kms://acme/train-weights --to node_7Hq2
POST /v1/nodes
Authorization: Bearer $CLOISTER_TOKEN
Content-Type: application/json
{
"plan": "cl.h200.x8",
"region": "eu-n",
"confidential": true
}
GET /v1/nodes/node_7Hq2/attestation
// → signed evidence: firmware measurements, GPU CC mode, boot policy
Interface preview. The CLI and API are in private preview; names may change before general availability.
General notes
On a drawing set, general notes are the rules every sheet obeys. These are ours.
- 01
Hardware is named. Every configuration lists the exact accelerator, host CPU, memory, storage and network — never a “GPU class”.
- 02
Prices are published per GPU-hour, with reserved terms shown beside on-demand. There is no quote-only tier for standard configurations.
- 03
A host is never divided between customers. The smallest thing we rent is a whole machine.
- 04
We do not inspect workloads. Operator access to a running node requires a ticket you approve, and every session is logged to your project.
- 05
Between tenants, drives are cryptographically erased and firmware is re-flashed from signed images. The record is kept with the node's history.
- 06
Incidents that affect customers are published with timeline and root cause, whether or not they breached a commitment.
Tell us what you need to run.
Model size, GPU count, how long, and where the data has to stay. An infrastructure engineer replies — not a sequence of sales emails.