What a confidential H100 and H200 cost per GPU-hour in November 2026, and what the attestation covers

I run VoltageGPU, where confidential GPUs are rented as Intel TDX virtual machines with the NVIDIA GPUs passed through. Two questions come before anyone rents one: the price per GPU-hour, and what the attestation proves.

Prices on 7 November 2026

Read from our public pricing feed, voltagegpu.com/api/pricing/snapshot, at 13:00 UTC (the feed was built at 12:56 UTC):

• $55.62 for eight H100s is $6.9525 per GPU-hour; the feed rounds it to $6.95.
• "Available" counts VMs of that size. The feed is rebuilt every few minutes, so stock moves.
• Billing is per second from a prepaid balance: the first hour is charged at start and its unused part refunded if you release earlier; after it, time is prorated to the second. No contract or reserved instance; the minimum top-up is $5.

Older posts of ours quoted lower H200 prices; the prices above are today's, from the public feed.

What the attestation covers

You produce both proofs yourself, inside your VM, with voltage-verify, our open-source verifier (MIT), from a manifest holding a random challenge you draw: the Intel TDX quote carries the manifest's SHA-512 as its report_data, and NVIDIA's Remote Attestation Service (NRAS) signs GPU claims over its SHA-256. You check the bundle on your own machine, against the Intel SGX Root CA and the NVIDIA intermediates pinned in the tool. We are not in that chain, and nothing is generated on our servers.

A bundle that ends on RESULT: VERIFIED shows:

• a genuine Intel TDX trust domain, not in debug mode (a debug TD lets the host read and modify its memory), on a platform at a TCB level Intel accepts, with no revoked certificate;
• for each GPU, NVIDIA's signed verdict: measurements that match NVIDIA's reference values, secure boot on, debug off;
• that both proofs were made for your challenge, so a replayed or borrowed bundle fails.

We have run it, and it passed, on: 1x H200 (4 September 2026), 1x RTX PRO 6000 Blackwell (17 September, again 9 October), 1x H100 (28 October, and our weekly run of 6 November), 8x H100 (first on 10 September, again on 4 November) and 8x H200 (4 November). The bundles and their commands are public on voltagegpu.com/proofs and in confidential-gpu-attestation-evidence.

What it does not cover

• The software in the VM. The quote carries measurements of the VM's boot (MRTD, RTMR0 to RTMR3), but voltage-verify compares them only with values you pass (--expect-mrtd, --expect-rtmr0 to --expect-rtmr3), and we publish no reference values for our image: that is the tdx.measurements warning below. You have root in the VM; what runs there is yours to check.
• That your model ran. The manifest can name an image and model files, but the hardware signs your description of the workload, not the code the GPU ran.
• That this GPU sits in this trust domain. The quote and the NVIDIA tokens are tied only by the manifest hash they both carry.
• Physical attacks. In TEE.fail, researchers from Georgia Tech and Purdue with physical and root access used a memory-bus interposer built for under $1,000 to extract an Intel server's provisioning certification key, then signed TDX quotes that pass verification. Nothing in a bundle rules that out.
• NVLink on 8-GPU VMs. These run in NVIDIA's multi-GPU Protected PCIe mode: each GPU is attested on its own, and the mode does not encrypt traffic between GPUs over NVLink. On 4 November the four NVSwitches of our 8x H100 and 8x H200 nodes passed NVIDIA attestation, but only with the driver-matched libnvidia-nscq added in the guest, in a separate call outside the bundle; on the image as delivered, switch attestation fails. We do not claim the NVLink fabric.
• B200 and B300. We have run no attestation on them, and neither is sold as a Confidential VM.
• Anything outside a Confidential VM. Standard GPUs, bare metal and sandboxes have no enclave and are never attested. Our inference API goes through a relay that sees requests in clear.
• Your VM, from our bundles. A published bundle proves only the run it came from; for your VM, draw your own challenge.

Check it yourself

With Python 3.10 or later in a fresh virtual environment, and no account or GPU, this checks the bundle of our 8x H200 run of 4 November:

pip install "voltage-verify>=0.3.0" curl -fsSLO https://raw.githubusercontent.com/VoltageGPU/confidential-gpu-attestation-evidence/main/ppcie-8x-h200-2026-11-04/bundle.json voltage-verify verify bundle.json --hwmodel GH100 --gpus 8 \ --challenge 5fe630be5d8455ca3bca9f9bee88d66915c91df39f2136186fbcb2530ef6a206 

Output on 7 November 2026 at 13:06 UTC (Windows 11, Git Bash, Python 3.12.4, voltage-verify 0.3.0 from PyPI), exit code 0:

[PASS] manifest.format manifest is well formed [PASS] manifest.commitments bundle commitments match the manifest [PASS] manifest.challenge challenge is the one this verifier issued [PASS] tdx.structure TDX quote v4, TEE 0x81, 4936 bytes [PASS] tdx.debug TD attributes 0000001000000000 (0x10000000), DEBUG (bit 0) off: not a debug TD [PASS] tdx.report_data quote report_data equals SHA-512 of the manifest [WARN] tdx.measurements TD software not pinned: pass --expect-mrtd to check it [PASS] tdx.signatures attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA [PASS] tdx.collateral TCB info and QE identity signed by Intel (Intel PCS, fetched now) [PASS] tdx.tcb platform TCB UpToDate, QE UpToDate, TDX_01 UpToDate [PASS] tdx.revocation PCK certificate not revoked (57 entries in CRL) [PASS] tdx.revocation PCK CA certificate not revoked (0 entries in CRL) [PASS] nvidia.signatures 9 NVIDIA-signed tokens verify, each GPU token listed by its digest in the verifier token, keys from the bundle chained to a pinned NRAS intermediate (pinned intermediates only) [PASS] nvidia.nonce NRAS eat_nonce equals SHA-256 of the manifest (verifier token and 8 GPU token(s)) [PASS] nvidia.policy overall result true, every GPU: measurements ok, secure boot on, debug off, nonce matched, report signature and chain validated [PASS] nvidia.freshness token issued 2s from bundle creation [PASS] nvidia.mode attestation mode 'multi-gpu-ppcie' [WARN] nvidia.scope not verified: NVIDIA Protected PCIe mode: every GPU is attested on its own, but the NVSwitch fabric between them is NOT attested by these per-GPU tokens TDX: MRTD eea8b6a814569a52bd1e12f6b869bb2d... TCB UpToDate QE UpToDate GPU: GPU-0 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success GPU: GPU-1 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success GPU: GPU-2 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success GPU: GPU-3 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success GPU: GPU-4 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success GPU: GPU-5 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success GPU: GPU-6 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success GPU: GPU-7 GH100 driver 595.71.05 vbios 96.00.CF.00.02 measurements success RESULT: VERIFIED 

The H200 is a GH100 die, hence --hwmodel GH100. With one character of the challenge changed, the run ends on RESULT: NOT VERIFIED (manifest.challenge), exit code 1.

On a VM you rent, the README's flow is: voltage-verify manifest on your machine (it draws the challenge), voltage-verify attest as root inside the VM, then voltage-verify verify --challenge back on your machine. Our image ships without pip; for a single-GPU VM, two-proofs-in-the-vm.sh, the script of our weekly run, installs it and does the VM side.

To read evidence field by field, voltagegpu.com/tools has two in-browser decoders, for Intel TDX quotes and NVIDIA attestation tokens; they decode, and voltage-verify checks the signatures.

Live prices and stock: voltagegpu.com/pricing

Drafted with AI assistance, then checked: the commands were run on 7 November 2026 and their output is copied as printed.