Fortanix

• Intel, NVIDIA, and the major cloud providers could bundle confidential-AI orchestration directly onto the enclave hardware they already sell, compressing Fortanix Confidential AI into a thin layer over commodity infrastructure.
• Fortanix's confidential-AI momentum leans heavily on the NVIDIA partnership announced in 2025, so a shift in NVIDIA's confidential-computing roadmap or a competing NVIDIA-native offering could undercut the line.
• The AI line's named references are vendor-displayed, so undisclosed churn or shallow deployments would leave the go-to-market claims unverified against independent evidence.
• The last disclosed raise was the 2022 Series C, so a prolonged capital gap without new financing could constrain the go-to-market expansion the confidential-AI push needs.
• The FIPS-validated key-management advantage matters only while regulated buyers treat attested key release as a purchasing requirement, and a cloud-native equivalent earning the same certification would erode it.

Fortanix Confidential AI targets a specific and legally sharp problem. Regulated enterprises in healthcare, finance, and government want to run modern AI on their most sensitive data, but sending prompts, records, or model weights to a shared cloud model exposes information they are obligated to protect. Fortanix frames the buyer as organizations that cannot move that data off their own controlled environment.

Independent reporting on the 2025 Fortanix and NVIDIA solution describes the same roadblock, that healthcare records, financial transactions, and classified information must stay protected at all times, which forces a choice between AI adoption and compliance. The pain is real and specific, but the public evidence frames it qualitatively through the vendor and press rather than quantifying it with an independent study or a named regulatory mandate.

The buyer and the problem are clear, which places problem definition at a credible middle rather than an independently established urgency. [s1, s9, s7]

Fortanix Confidential AI runs enterprise models and inference inside hardware trusted execution environments so that data, model weights, and intermediate inference stay encrypted in memory, protected even from privileged insiders, hypervisors, and co-resident workloads. Buyers can bring their own models and data or deploy Armet AI, a turnkey agentic-AI platform built on the same confidential computing.

The architecture is documented in specific terms. Composite attestation joins Fortanix Confidential Computing Manager and NVIDIA remote attestation into a single chain of trust across CPU and GPU, and secure key release through Fortanix Data Security Manager unlocks datasets and model artifacts only after that attestation succeeds. The stack runs on NVIDIA Hopper and Blackwell GPUs and Intel SGX and TDX CPUs, with a FIPS 140-2 Level 3 hardware security module holding the keys.

An independent analyst note details the Intel SGX, TDX, and Tiber Trust Authority layers Armet AI integrates, and the deep NVIDIA and Intel co-engineering supplies external validation of the capability beyond the vendor's own pages. [s1, s2, s8]

The distinguishing feature is what sits beneath the enclave. The confidential runtime rests on hardware Intel, NVIDIA, and the major clouds sell, and those vendors could extend into the orchestration above it, so that layer is available to any competitor. Fortanix pairs it with a mature key-management and hardware-security-module franchise that gates decryption, a capability the enclave runtime layer does not itself supply and one the reviewed sources do not establish for the named confidential-AI startups either way.

That position is a real differentiator today, though it depends on regulated buyers continuing to treat attested, FIPS-validated key release as a distinct requirement rather than a feature the platforms absorb. [s2, s1, s9]

The Confidential AI line shows a small set of named references. BeeKeeperAI, created at the University of California, San Francisco, runs healthcare AI on Fortanix confidential computing, and ElevenLabs is cited as a model provider deploying its text-to-speech models on Fortanix and NVIDIA confidential infrastructure. Both appear on Fortanix's own pages.

The strongest recent go-to-market signal is partnership motion that independent outlets reported: the October 2025 joint solution with NVIDIA demonstrated at NVIDIA GTC and its positioning for AI Factories and regulated environments. These are distribution and co-selling moves rather than disclosed customer counts or revenue.

The broader Fortanix business reports customers across highly regulated industries, but the AI line's own traction is vendor-displayed references plus partner announcements, without independent corroboration of scale. [s10, s1, s9, s4]

Fortanix was founded in 2016 by Ambuj Kumar and Anand Kashyap, who built it into a company widely described as a confidential-computing pioneer. Anand Kashyap is described as co-founder and chief executive in 2025 coverage.

Kumar and Kashyap draw their credibility from a sustained, verifiable build in exactly this domain and from the confidence of strategic investors, In-Q-Tel, Intel Capital, and Goldman Sachs among them. The cited sources emphasize Fortanix's operating history and the founders' security backgrounds rather than a prior in-domain exit or serial-founder pedigree.

A regulatory record corroborates the raise on its own terms. The Form D Fortanix filed with the Securities and Exchange Commission in August 2022 reports an exempt equity offering of $89,781,712, of which $81,999,912 had been sold and $7,781,800 remained to be sold at the filing date. Those figures record capital placed in a single exempt offering, a different measure from the announced round total the company published, and they anchor the investor confidence described above in a filing rather than in a company announcement.

Senior in-domain execution over nearly a decade is clear, while the founder-pedigree signals that would place the team above that level are not established in public sources. [s5, s6, s9, s4, s7, s13]

Trust is central to what Fortanix Confidential AI sells, and the line leans on concrete cryptographic assurances rather than only policy claims. Secure key release runs through a FIPS 140-2 Level 3 hardware security module, and composite CPU and GPU attestation provides a verifiable chain of trust before any model or dataset is decrypted.

The offering supports on-premises deployment for buyers that must retain local control, and it uses Azure confidential VMs, reflecting a long Azure confidential-computing partnership dating to 2020. For regulated healthcare, finance, and government workloads, these are the readiness signals buyers check first.

Two independent records qualify those assurances. The NIST Cryptographic Module Validation Program lists the validated module as the Fortanix SDKMS Appliance, described there as the building block for a unified HSM and key management service, so the FIPS certification the product pages cite is recorded under the platform's earlier name. The National Vulnerability Database separately documents a flaw in the Fortanix Confidential Computing Manager platform for Intel SGX, where missing pointer-alignment validation allowed a local attacker to reach unauthorized information before release 3.32. Attested hardware narrows the trusted computing base, and the enclave runtime above it remains code that can carry defects.

The strongest evidenced trust signals here are cryptographic and hardware-rooted. Public sources focus on those guarantees rather than detailing the service's broader audit-attestation posture, so the hardware-rooted assurances carry the trust story. [s1, s2, s9, s11, s12]

Add analyzed competitors to compare them side by side with Fortanix.

Fortanix Confidential AI aims at organizations whose data is too sensitive or regulated to run on shared cloud AI, concentrating on healthcare and financial services, and government and defense. The product pages describe processing patient records, financial transactions, and classified information under confidentiality guarantees, and the 2025 NVIDIA solution is positioned explicitly for these regulated verticals.

A second segment is AI model providers themselves. Fortanix pitches confidential deployment as a way for a model owner to run proprietary weights inside a customer's environment without revealing the model, a tension the ElevenLabs reference describes directly. This two-sided framing, protecting both the enterprise's data and the provider's model IP, widens the addressable buyer set beyond one side of the transaction.

The segmentation is coherent and matches where confidential computing has real regulatory pull, though the evidenced deployments cluster in healthcare and model-provider pilots rather than spanning all the named verticals.

The core capability is running the full AI lifecycle, fine-tuning, training, and inference, inside trusted execution environments so raw data and model weights are never exposed to the host, the hypervisor, or co-resident workloads. Composite attestation binds Fortanix Confidential Computing Manager and NVIDIA remote attestation into one chain of trust across CPU and GPU, and Data Security Manager releases keys only after that attestation.

Armet AI layers a turnkey generative-AI pipeline on top, with secure chat over internal data, role-based access control, and guardrails that redact sensitive data and filter harmful inputs and outputs, all running inside confidential computing. An independent analyst note credits the integration of Intel SGX, TDX, and Tiber Trust Authority as the security foundation.

The AI-specific advantage is less any model capability and more the verifiable trust envelope around whatever model runs. That envelope is hard engineering, but it is built from hardware primitives the chip and cloud vendors supply, so the durable advantage concentrates in the orchestration and key management Fortanix adds rather than in the enclave itself.

Fortanix reaches the market through a mix of its own enterprise sales, Azure confidential-computing availability, and increasingly through hardware and platform partners. The October 2025 NVIDIA joint solution, demonstrated at NVIDIA GTC and positioned for AI Factories and regulated environments, is the clearest go-to-market lever, pairing Fortanix with NVIDIA's enterprise-AI channel.

That joint solution routes Fortanix Confidential AI toward buyers already purchasing AI infrastructure, which suits a product that must sit on specific confidential-computing hardware from a chip or cloud vendor.

The named references are vendor-displayed and adjacent: Fortanix's own case study attributes BeeKeeperAI to its data-security and confidential-computing products rather than the Confidential AI line, and ElevenLabs appears as a collaboration reference rather than a disclosed paying customer, so the public go-to-market evidence is strong on partner distribution and thinner on independently corroborated customer wins for the AI line specifically.

Fortanix does not publish pricing for the Confidential AI line in the public sources reviewed. The offering is sold through enterprise engagements and is available on Azure, with on-premises options for buyers that require local control, which points to negotiated, deployment-dependent pricing rather than a public self-serve tier.

Because the platform runs on specific confidential-computing hardware, total cost also depends on the underlying GPU and CPU capacity a buyer provisions, whether in a cloud or an on-premises AI factory. That coupling to hardware is inherent to confidential computing and shapes the economics more than a list price would.

The absence of public pricing is normal for an enterprise, compliance-driven security product at this stage and is not itself a weakness, though it limits outside assessment of packaging and value capture.

Fortanix Confidential AI is delivered as software packaged around the Confidential Computing Manager control plane, Data Security Manager for key management, and the Armet AI orchestration layer. It runs across cloud, on-premises, and AI-factory environments, and Fortanix has been an Azure confidential-computing partner since 2020.

Operationally, the product's promise is that workloads run inside enclaves while attestation and key release happen automatically before any decryption. The platform supports customer-controlled deployments and produces cryptographic evidence as output, though the cited pages do not document the operating split for every deployment and Fortanix itself describes Armet AI as a service.

This is a software-product delivery model. It scales through partner infrastructure and cloud availability rather than through a services organization, which keeps delivery lean but places the operational burden of running confidential workloads on the customer.

Trust is the product, and Fortanix roots it in hardware rather than assertions. Secure key release runs through a FIPS 140-2 Level 3 hardware security module, a named cryptographic-module validation, and composite CPU and GPU attestation provides a verifiable chain of trust before any model or dataset is decrypted.

For regulated buyers, the offering supports on-premises deployment and targets HIPAA-governed healthcare data, financial data, and government classification levels. The FIPS-validated key management is a concrete, hardware-rooted trust signal beyond a self-asserted attestation.

The strongest evidenced trust signals here are cryptographic and hardware-rooted. Public sources focus on those guarantees rather than detailing the service's broader audit-attestation posture, so the hardware-rooted assurances carry the trust story.

Fortanix Confidential AI is deeply embedded in a hardware and cloud ecosystem it does not own. It runs on Intel SGX and TDX CPUs and NVIDIA Hopper and Blackwell confidential-computing GPUs, uses NVIDIA remote attestation, and is available on Microsoft Azure, with a confidential- computing partnership dating to 2020.

The October 2025 NVIDIA joint solution makes NVIDIA the central platform relationship. This ecosystem position is a distribution advantage, routing Fortanix toward buyers already committed to confidential-computing hardware.

The same dependence is a strategic exposure. The chip and cloud vendors that supply the enclave primitives could extend into competing or bundled confidential-AI orchestration, a risk inferred from Fortanix's dependence on their platforms rather than documented current competition, so the ecosystem is simultaneously its channel and its most likely source of absorption.

Fortanix was co-founded in 2016 by Ambuj Kumar and Anand Kashyap and grew into a company widely described as a confidential-computing pioneer. Anand Kashyap is described as co-founder and chief executive in 2025 coverage.

Strategic investors reinforce the team's standing. In-Q-Tel, Intel Capital, and Goldman Sachs backed the company through its 2022 Series C, and In-Q-Tel's involvement in particular signals credibility with government and intelligence buyers.

The cited sources emphasize Fortanix's operating history and the founders' security backgrounds rather than a prior in-domain exit. The team's demonstrated strength is operating and scaling Fortanix itself over nearly a decade, rather than the serial-founder pedigree that distinguishes some direct peers.