Joint solution lets operators run customers’ AI workloads in attested, hardware-isolated environments where sensitive data and models stay encrypted even while in use.
SUNNYVALE, Calif., Nov. 12, 2026 /PRNewswire/ — Rafay Systems and Fortanix® Inc. today announced a joint solution that lets neoclouds, sovereign AI clouds and enterprises deliver confidential AI as a Service. The Rafay Platform now orchestrates workloads that run on CNCF® Confidential Containers (CoCo) with Fortanix Confidential AI, extending the companies’ existing integration for confidential virtual machines.
With the joint solution, operators can offer AI workloads that run inside hardware-based Trusted Execution Environments (TEEs), where encryption keys are released only after Fortanix verifies the environment and AI workload through cryptographic attestation. End users launch those workloads from the Rafay Developer Hub without filing a support ticket.
In regulated industries such as financial services, healthcare and the public sector, many of the mission critical AI use cases involve sensitive data such as customer records, patient information and financial transactions, and model providers need to protect the proprietary models that process it. These workloads often run on GPU infrastructure operated by a 3rd party: a neocloud, a sovereign cloud or a shared internal AI factory. Encryption protects data at rest and in transit, but without confidential computing, data and model weights must be decrypted for processing, leaving them exposed in CPU and GPU memory to anyone with privileged access to the infrastructure. Research from Fortanix and Atomik Research found that while 93% of AI leaders understand traditional encryption does not protect data while AI is processing it, only half can fully verify that protection is in place during inference.
“Confidential computing enables model owners to deploy proprietary AI models on third-party infrastructure with reduced risk of exposing valuable intellectual property, while creating new revenue opportunities for cloud operators to offer premium, security-focused AI inference services.” said Mohan Atreya, chief product officer at Rafay. “Fortanix verifies the environment through cryptographic attestation and controls the secure key release. Rafay turns that into a governed, multi-tenant service, so a neocloud or sovereign cloud can offer confidential AI as a SKU, and its customers can run sensitive workloads on infrastructure they don’t operate. With Confidential Containers, that model now reaches the Kubernetes pod, where AI teams already ship their workloads.”
How the Joint Solution Works
CoCo, a CNCF Incubating project, applies confidential computing to the Kubernetes pod. Built on Kata Containers, CoCo runs each pod in its own lightweight confidential virtual machine, with memory encrypted by the CPU and, on supported hardware, GPUs included in the trust boundary. Developers deploy workloads with standard Kubernetes workflows.
Fortanix Confidential Computing Manager (CCM) performs composite attestation across the confidential computing environment, verifying the integrity of CPU and GPU trusted execution environments, firmware, and software components before authorizing the release of encryption keys. Fortanix Data Security Manager (DSM), backed by a FIPS 140-3 Level 3 HSM certification, releases encryption keys only to environments CCM has attested. If attestation fails, encryption keys remain protected, preventing the workload from accessing sensitive data or executing successfully.
The Rafay Platform turns that infrastructure into a service operators can deliver to their own customers:
- Cluster automation: Rafay blueprints install the Fortanix CoCo add-ons and keep them in sync on every confidential cluster.
- Multi-tenancy: Operators onboard GPU infrastructure once, then give each customer an isolated tenant.
- Self-service SKUs: Administrators package a confidential workload as a SKU in Rafay SKU Studio, and end users launch it on demand from the Rafay Developer Hub.
- Governance: Policy, access controls and quotas apply across tenants and clusters.
“Every AI Factory faces a trust dilemma. Model owners want their weights hidden from operators and customers; enterprises want their data hidden from model owners and operators; and operators must prove they can see neither, even via another tenant or compromised software,” said Anuj Jaiswal, Chief Product Officer at Fortanix. “Fortanix and Rafay resolve that dilemma in one click. Rafay orchestrates the deployment of proprietary models and AI applications across on-premises, sovereign and cloud infrastructures. Fortanix Confidential AI releases keys only to attested workloads, so model owners, enterprises, and operators, each keep control of what they own, every time it runs.”
Use Cases
Neoclouds and GPU cloud providers can offer confidential AI as a premium service, backed by attestation evidence that tenant workloads run in TEEs and that keys go only to verified workloads. Sovereign AI clouds can keep keys in an HSM under the operator’s control, on-premises or as SaaS, and attest what is running before any data is decrypted. Regulated enterprises in financial services, healthcare and the public sector can run AI on customer, patient or financial data while keeping it protected from the infrastructure operator during processing. AI model providers can deliver proprietary models into customer environments with weights that stay encrypted until the environment is attested.
A recorded demo shows the end-to-end workflow, with a customer of a neocloud launching a confidential application via the Rafay end user portal with attestation and key release by Fortanix.
Availability
Rafay support for CoCo-based deployments with Fortanix Confidential AI is available now, alongside the existing confidential VM integration. Fortanix announced Fortanix Confidential AI for CoCo on Oct. 19, 2026.
About Rafay Systems
Rafay Systems is a leading software provider powering the operators building the AI cloud, including neoclouds, telecommunications providers, enterprises, and sovereign AI operators. The Rafay Platform lets these organizations operationalize GPU and compute infrastructure with self-service automation, governance, and multi-tenancy, spanning bare metal provisioning, infrastructure lifecycle management, virtual machines, Kubernetes, GPU PaaS, AI development environments, and Token Factory for publishing AI models as token-metered inference services. By simplifying orchestration and operations across this stack, Rafay helps operators increase GPU utilization and turn raw infrastructure into monetizable, production-ready AI services, all while maintaining security, consistency, and control. Rafay is a validated partner in the NVIDIA AI Cloud Ready initiative. For more information, visit rafay.co.
About Fortanix
Fortanix is the global leader in data and AI security and a pioneer of Confidential Computing, delivering a unified platform to protect sensitive data, AI models, and applications across on-premises and multi-cloud environments—at rest, in transit, and in use. Built on hardware-enforced security, Fortanix enables workloads to run in tamper-proof, isolated enclaves, protecting against data leakage, model extraction, and unauthorized access, even from privileged insiders.
As enterprises scale modern AI factories, Fortanix provides a Confidential AI foundation built on attestation-based trust, secure key release, and zero-trust enforcement. This ensures AI systems remain verifiable, auditable, and trustworthy—while enabling crypto agility and long-term resilience through post-quantum cryptography (PQC).
Trusted by leading enterprises and sovereign entities in highly regulated industries and powered by an industry-standard approach to Confidential Computing supported by leading technology providers, including Intel, Microsoft, and NVIDIA, Fortanix enables organizations to safely use sensitive data and drive AI adoption with confidence.
Media Contacts
Rafay Systems: Angela Shugarts, angela@rafay.co
Fortanix: BOCA Marketing for Fortanix, Fortanix@bocamarketing.com
SOURCE Rafay Systems