SUNNYVALE – November 12, 2026 -- Rafay Systems and Fortanix Inc. have launched a joint solution that lets neoclouds, sovereign AI clouds and enterprises sell confidential AI as a service, with workloads running in hardware-isolated environments where data and models stay encrypted during processing.
The Rafay Platform now orchestrates workloads on CNCF Confidential Containers (CoCo) combined with Fortanix Confidential AI. The release extends the companies' existing integration for confidential virtual machines. Support for CoCo-based deployments is available now. Fortanix announced Fortanix Confidential AI for CoCo on Oct. 19, 2026.
Encryption keys are released only after cryptographic attestation
Workloads run inside hardware-based Trusted Execution Environments (TEEs). Keys are released only after Fortanix verifies the environment and the AI workload. If attestation fails, the keys stay protected and the workload cannot access sensitive data or execute successfully.
Fortanix Confidential Computing Manager performs composite attestation, verifying CPU and GPU TEEs, firmware and software components. Fortanix Data Security Manager, backed by a FIPS 140-3 Level 3 HSM certification, releases keys only to environments that have passed that check.
CoCo moves the trust boundary to the Kubernetes pod
CoCo is a CNCF Incubating project built on Kata Containers. It runs each pod in its own lightweight confidential virtual machine, with memory encrypted by the CPU. On supported hardware, GPUs sit inside the trust boundary. Developers deploy with standard Kubernetes workflows.
Rafay packages confidential workloads as self-service SKUs
Rafay supplies the operator layer on top of that infrastructure:
- Cluster automation: blueprints install the Fortanix CoCo add-ons and keep them in sync on every confidential cluster.
- Multi-tenancy: operators onboard GPU infrastructure once, then assign each customer an isolated tenant.
- Self-service SKUs: administrators package a confidential workload in Rafay SKU Studio, and end users launch it from the Rafay Developer Hub without filing a support ticket.
- Governance: policy, access controls and quotas apply across tenants and clusters.
Mohan Atreya, chief product officer at Rafay, said the model gives cloud operators a way to sell premium, security-focused AI inference services. It also lets model owners deploy proprietary models on third-party infrastructure with reduced risk of exposing intellectual property.
Research shows only half of AI leaders can verify protection during inference
Research from Fortanix and Atomik Research found that 93% of AI leaders understand traditional encryption does not protect data while AI is processing it. Only half can fully verify that protection is in place during inference. Without confidential computing, data and model weights must be decrypted for processing, leaving them exposed in CPU and GPU memory to anyone with privileged infrastructure access.
The exposure matters most in financial services, healthcare and the public sector, where AI runs on customer records, patient information and financial transactions, often on GPU infrastructure operated by a third party.
Anuj Jaiswal, Chief Product Officer at Fortanix, framed the problem as a trust dilemma: "Every AI Factory faces a trust dilemma." He said model owners, enterprises and operators each keep control of what they own.
Four buyer groups targeted, from neoclouds to model providers
Neoclouds and GPU cloud providers can sell confidential AI as a premium service, backed by attestation evidence that tenant workloads run in TEEs. Sovereign AI clouds can keep keys in an HSM under operator control, on-premises or as SaaS. Regulated enterprises can run AI on sensitive data while keeping it shielded from the infrastructure operator. Model providers can deliver proprietary models into customer environments with weights that stay encrypted until the environment is attested.
A recorded demo shows a neocloud customer launching a confidential application through the Rafay end-user portal, with attestation and key release handled by Fortanix.