Organizations deploying generative AI face a trust gap when models need access to sensitive information that can't leave their environment, according to a report published by The New Stack on September 22. Even when enterprises ask AI models to hide or remove personally identifiable information from conversations, it's hard to have full confidence that the process worked. The challenge is most severe when AI systems handle customer financial details, patient records, or proprietary intellectual property that must stay under organizational control.
The problem stems from a two-sided dilemma in enterprise AI deployment. Companies need to keep confidential data within their own infrastructure, while model creators want to protect the weights and software representing substantial investments in research and engineering. Model builders are reluctant to place those assets in environments where customers, infrastructure operators, or attackers might gain access. That mutual need for control has created a standoff: organizations can't bring advanced models to sensitive data without asking one side to give up control. The most capable models are increasingly delivered as software-as-a-service offerings because that's the simplest way for their creators to distribute and protect them, but sending information across wide-area networks places it in the hands of more systems, connections, and operators.
The report explains that confidential AI architectures aim to solve this impasse by extending encryption protection into the processing environment itself. Hardware-isolated execution creates a protected enclave where data and model weights can remain encrypted until they're released to an approved workload. Cryptographic attestation verifies the hardware, virtual machine, software, and configuration requesting access before releasing keys. The model builder can encrypt its model using the public key of a specific confidential virtual machine, and only that machine's corresponding private key can decrypt it within protected memory. This lets the customer use the model without accessing its weights, while the enterprise retains control of keys governing its data and the model builder retains control of keys governing its model. According to Alon Horev, chief technology officer at VAST Data, "This world of agentic AI is moving extremely fast, and we need to limit what an agent can see and do."
The report notes that confidential AI can't be bolted onto a fragmented stack because real-world AI systems are living environments where data moves between storage, databases, graphics processing units, networks, applications, and agents. VAST Data launched DataEnclave on September 22 to address the integration challenge by bringing the model, application layer, and data platform together under customer-controlled operating conditions. The ecosystem includes model builders such as Cohere, Deepgram, Factory, Fundamental, and TwelveLabs, along with infrastructure and security providers including Nvidia, CrowdStrike, Fortanix, Nscale, Cisco, and Supermicro. Customer-controlled infrastructure also changes the cost conversation: hosted models can make budgets harder to predict as token consumption varies with usage patterns and workload volume, while enterprises running their own GPU clusters can plan around capacity they own or have already budgeted for instead of allowing inefficient model choices or uncontrolled agent activity to generate an open-ended token bill. Organizations that can't establish strong privacy and governance assurances for today's models will find it even harder to deploy agents safely in the future. The choice between convenience and control will only sharpen as models gain the ability to act with less human oversight.