# Cyber Company Profiles: Phala

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-12
Analyzed 2026-08-27
Canonical: https://cybercompanyprofiles.com/companies/phala
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Phala, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [phala.com](https://phala.com/)
- Profile: https://cybercompanyprofiles.com/companies/phala
- Type: Security for AI, Cloud Security, Data Security
- Also known as: Phala Network
- Market readiness: Established (25/40)
- Defensibility: Contested (13/21)
- Founded: 2019
- Last updated: 2026-08-27

## Executive Summary

Phala rents confidential cloud capacity to teams whose data cannot go to an ordinary cloud. Agents, private model inference, and GPU jobs run inside sealed Intel and NVIDIA hardware. Intel and NVIDIA each sign a separate quote, and Phala exposes both through one verifier, so the machine and the GPU prove themselves together. The engine underneath is open source and now hosted by the Linux Foundation. zkSecurity audited it in May 2025, and the most serious finding, that the software still trusted the program running the sealed machine, is recorded as fixed in Phala's documentation. Public evidence of who buys it stays thin: the case studies identify their subjects only by industry, and the paid base Phala last published was 398 paid users at the end of 2025.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Confidential AI cloud that runs agents, private LLM inference, and GPU jobs inside hardware-backed TEEs, keeping their secrets private and proving what ran through verifiable attestation. | [\[f1\]](#company-detail-sources) |
| Founded | 2019 | [\[f2\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Phala Confidential AI Cloud | Confidential compute cloud running agents, private LLM inference, and GPU jobs inside Intel TDX and NVIDIA GPU TEEs with dual remote attestation. |

## Matrix Coverage

Mapped to the [AI Defense Matrix](https://aidefensematrix.com) [\[f3\]](#company-detail-sources):

| Asset | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI-Workload Platforms |  |  | ✓ |  |  |  |
| Runtime AI Data |  |  | ✓ |  |  |  |

Phala Confidential AI Cloud runs agents, private LLM inference, and GPU jobs inside hardware-backed Intel TDX and NVIDIA GPU TEEs and proves what executed through dual remote attestation. These capabilities are mapped to the AI Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (25/40)**

Analyzed 2026-08-27. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Phala names the buyer and the blocker plainly: teams whose prompts, tools, keys, and memory would become provider-visible state on an ordinary model API, grouped on its own site into financial services, healthcare research, AI software platforms, and legal AI. No cited source measures that pain independently, so the urgency stays Phala's own claim. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s13](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | Phala publishes deployment documentation and a GPU page describing one verifier that collects both the Intel and the NVIDIA signed quotes so the machine and the GPU prove themselves together. The outside validation is real: the Linux Foundation hosts the engine, and zkSecurity audited it in May 2025 and published the findings. \[[s4](#profile-analysis-sources), [s8](#profile-analysis-sources), [s13](#profile-analysis-sources), [s16](#profile-analysis-sources), [s19](#profile-analysis-sources)\] |
| Market Timing | 3/5 | The enabler is dated and specific: Phala shipped confidential GPU machines pairing Intel TDX with NVIDIA confidential computing in 2025, and NEAR AI documented a kit built jointly on that combination in January 2025. The record carries one kind of demand signal, an OpenRouter listing that shows distribution rather than buyers searching, and no independently documented budget, procurement, or analyst signal beside it. \[[s2](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\] |
| Team Credibility | 4/5 | Marvin Tong and Hang Yin founded Phala in 2019 and still run it, and the about page records Yin's senior engineering role at Google and a doctorate in computer science. The independent part is standing: the Confidential Computing Consortium admitted Phala as a general member and credited the scale of the trusted-execution network Phala has operated, and the Linux Foundation now hosts the engine the team built. \[[s2](#profile-analysis-sources), [s11](#profile-analysis-sources), [s13](#profile-analysis-sources)\] |
| GTM Proof | 3/5 | Two independent surfaces carry traction: OpenRouter lists 21 models served by Phala, and NEAR AI described a kit built jointly with it in January 2025. Neither corroborates scale. The 398 paid users at the end of 2025 are Phala's own reporting, and the daily token counter is republished from OpenRouter's provider chart by Phala's own account rather than independently corroborated, so the corroborated part is the marketplace and partnership motion. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\] |
| Funding Efficiency | 2/5 | Output is documented in detail, from confidential GPU machines and an audited open-source engine to a trust center and published per-hour prices. No funding amount, round, date, or investor appears anywhere in the reviewed pages, so the capital side of the record is silent rather than adverse and the evidence is one-sided. \[[s2](#profile-analysis-sources), [s5](#profile-analysis-sources), [s10](#profile-analysis-sources), [s16](#profile-analysis-sources)\] |
| Category Clarity | 3/5 | Confidential computing is a placeable category with a Linux Foundation consortium behind it, and Phala sits inside it as a general member. Placing Phala itself still takes explanation, because the same record carries a token network, staking, and governance on an Ethereum layer-two alongside the enterprise cloud. \[[s2](#profile-analysis-sources), [s8](#profile-analysis-sources), [s13](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | Google Cloud's documentation describes NVIDIA confidential computing integrated with its own confidential machines, and AWS sells Nitro Enclaves with attestation, so sealed hardware is already sold by platforms next to the buyer. Phala's counter is a single verifier across processor and GPU and an engine hosted by the Linux Foundation that runs on several backends. Neither one is a structural moat, because a platform vendor could eventually ship the same combination. \[[s4](#profile-analysis-sources), [s12](#profile-analysis-sources), [s13](#profile-analysis-sources), [s17](#profile-analysis-sources), [s18](#profile-analysis-sources)\] |

### Business Risks

- Google Cloud and AWS already sell sealed hardware with attestation, so either could add the cross-vendor proof path Phala sells and narrow its case to buyers who need the proof to come from outside their own cloud provider.
- The dstack engine is open and Phala publishes paths to run it on Google Cloud, on AWS, and on a customer's own hardware, so a customer could keep the framework and stop paying for the hosting.
- The paid base Phala last published was 398 paid users at the end of 2025 and its case studies identify customers only by industry, so the enterprise pitch could rest on developer and Web3 usage instead.
- Phala's published assurance stops at a SOC 2 Type I report covering a point in time, with ISO 27001 in progress, so a buyer whose procurement requires a stricter attestation could rule Phala out until that work finishes.
- No funding amount, round, date, or investor appears in the reviewed pages, so a buyer cannot check whether Phala is capitalized to support a multi-year commitment.

### Problem & Market

Phala addresses one blocker: an organization that wants to use AI on sensitive data cannot send prompts, tools, keys, and memory to a model API where they become provider-visible state. Its answer is to run the workload inside sealed hardware and hand back a cryptographic record of what executed.

The buyers Phala names are grouped by industry on its own site, which lists financial services, healthcare research, AI software platforms, decentralized AI, and legal AI among its use cases. Developers building agents and private inference are the other half of the pitch, and they reach the product through published per-hour prices rather than a sales call.

The category has an industry home. The Confidential Computing Consortium, part of the Linux Foundation, admitted Phala as a general member in 2025, and Google Cloud documents confidential machines of its own. What the cited record does not carry is any independent measure of how large or how urgent the underlying problem is. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s5](#profile-analysis-sources), [s13](#profile-analysis-sources), [s18](#profile-analysis-sources)\]

### Product Capabilities

The Phala Confidential AI Cloud runs ordinary Docker workloads inside hardware-backed enclaves, pairing Intel TDX for the processor and memory with NVIDIA confidential computing for the GPU. The pairing carries through to the proof. Intel and NVIDIA each emit a signed quote, and Phala collects both and exposes them through one verifier so the machine and the GPU prove themselves together.

For inference, Phala serves OpenAI-compatible endpoints that run inside the enclave and return a proof of the runtime that handled each request. The open-source dstack engine underneath takes one workload definition and translates it into the right runtime for each backend, and NEAR AI describes a private machine-learning kit built jointly on the same Intel and NVIDIA combination.

The protection itself comes from Intel and NVIDIA silicon. Phala's engineering is in operating that protection and proving it across processor and GPU rather than in creating it, and its own pages put the cost at roughly 5 to 10 percent overhead depending on workload and hardware. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s4](#profile-analysis-sources), [s6](#profile-analysis-sources), [s8](#profile-analysis-sources), [s12](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Competitive Positioning

Phala's own site navigation lists entries comparing Phala with AWS Nitro, with Google Cloud's confidential VM, and with Tinfoil. Those entries mark two fronts: another confidential-AI specialist, and the large clouds.

The large clouds sell sealed hardware directly. AWS describes Nitro Enclaves as isolated compute environments whose attestation verifies that only authorised code is running, and Google Cloud's documentation describes NVIDIA confidential computing integrated with its own Intel and AMD confidential machines for CPU and GPU workloads together. A buyer can therefore rent the enclave layer from AWS or Google Cloud directly.

Phala's counter is portability and neutral governance. It aggregates the Intel and NVIDIA proofs behind one verifier, its dstack control plane runs on AWS, on Google Cloud, or on hardware the customer brings, and the Linux Foundation now hosts the engine, with Phala announcing that the code, trademarks, and domain will be held neutrally by the Foundation. For a buyer already inside one cloud, that portability is a reason to prefer Phala only when the proof has to come from outside that cloud. \[[s1](#profile-analysis-sources), [s6](#profile-analysis-sources), [s12](#profile-analysis-sources), [s13](#profile-analysis-sources), [s17](#profile-analysis-sources), [s18](#profile-analysis-sources)\]

### Go-to-Market & Traction

Phala runs a self-serve motion and an enterprise motion together. Developers start on published per-hour prices, from six cents an hour for a small confidential machine, while enterprise clusters, reserved GPU slots, and custom network requirements are quoted through sales.

Two independent surfaces carry traction. OpenRouter's provider page lists 21 models served by Phala, and NEAR AI described a private machine-learning kit built jointly with it in January 2025. Phala announced acceptance into NVIDIA Inception in January 2025, participation in a program that supports startups innovating in AI and accelerated computing, which is ecosystem recognition rather than a check on the product.

The scale figures are Phala's own reporting. Its 2025 review reports 398 paid users at the end of that year, and its homepage counter reported 69.6 billion confidential model tokens for 26 August 2026. The same page publishes 5.2 billion for 9 August and 20.8 billion for 25 August, so that headline number is one day's reading rather than a level, and the page notes that Phala crawls the series from its provider chart on OpenRouter, so OpenRouter measures the tokens and Phala republishes the count.

The homepage names organizations. A trusted-by strip lists NVIDIA, OpenRouter, Z.AI, the Linux Foundation, Venice AI, Intel, Near, Uniswap, Flashbots and Crossmint under the line that Phala is trusted by industry leaders and developers worldwide, and it says nothing about what any of them buys. Phala's own site elsewhere says it partners with NVIDIA, Intel, OpenRouter, OPPO, Z.AI and more than fifty teams, so several of those names are described as partners. The case studies identify their subjects only by industry, so no source in the record names a buyer. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s5](#profile-analysis-sources), [s7](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Team & Credibility

Marvin Tong and Hang Yin founded Phala in 2019 and still run it, Tong as chief executive and Yin as chief technology officer. Yin's entry on the about page records a senior software engineering role at Google and a doctorate in computer science, and Tong's records product management at Tencent and Didi. The same page lists a chief operating officer, a director of sales, a VP of growth, two developer-relations staff, customer success, marketing and a sales development representative, so the commercial bench is staffed.

The independently visible credential is operational. The Confidential Computing Consortium admitted Phala as a general member and credited the scale of the trusted-execution network Phala has operated, and the Linux Foundation now hosts the dstack engine the team built.

The cited record documents no prior exit, and the prior employers the about page names run to product roles at Tencent, Didi, Baidu and ByteDance, engineering at Google, and developer relations at Dell, ForeScout and BNB Chain, with no enterprise-software sales leadership among them. The credential a buyer can check is the infrastructure Phala has run, not a track record of selling to large enterprises. \[[s2](#profile-analysis-sources), [s11](#profile-analysis-sources), [s13](#profile-analysis-sources)\]

### Trust Readiness

Phala sells trust itself. Its argument is that most clouds ask a customer to accept a promise, while Phala emits runtime measurements a customer's software can verify.

The audit paperwork is early. The Trust Center offers a SOC 2 Type I report and HIPAA controls, and the report Phala publishes validates its controls at a specific point in time in its own words. The homepage adds ISO 27001 in progress, a 99.9 percent uptime commitment, GDPR-aligned processing, and enterprise support.

The stronger assurance is the code review. zkSecurity audited dstack in May 2025, and the highest-severity finding was that the build used an OVMF configuration trusting the virtual machine monitor, which the audit recommended moving outside the trusted computing base. Phala's documentation records that the team implemented the recommended configuration. Phala has also announced that the engine's code, trademarks, and domain will be held neutrally by the Linux Foundation, which would move that part of the trust story to a neutral holder. \[[s1](#profile-analysis-sources), [s9](#profile-analysis-sources), [s10](#profile-analysis-sources), [s16](#profile-analysis-sources), [s19](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| tinfoil | competes with | Phala's own site navigation lists a Phala versus Tinfoil comparison entry. |
| Amazon Web Services | competes with | Phala's site navigation lists a Phala versus AWS Nitro comparison entry, and AWS sells sealed enclaves with attestation directly. |
| Google Cloud | competes with | Phala's site navigation lists a Phala versus Google Cloud confidential VM comparison entry, and Google Cloud sells confidential machines directly. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Contested (13/21)**

Band guidance: reinforce or reposition. Analyzed 2026-08-27. Scope: whole company.

The reviewed pages record no dataset, content license, or granted patent that Phala retains. The engine underneath is open source and hosted by the Linux Foundation, so the one durable artifact Phala built is public rather than private. Phala also publishes paths to run it on Google Cloud, on AWS, or on a customer's own hardware. What remains is real and modest: running trusted-hardware networks since 2020, one verifier that collects both the processor proof and the GPU proof, and general membership in the Linux Foundation's confidential-computing consortium. That is a head start rather than a lasting lead, because the clouds Phala runs on sell sealed hardware and attestation of their own.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Phala delivers self-service cloud infrastructure the customer configures and runs, priced by the compute-hour, with managed GPU operations and support layered on top. The customer's own team operates the workload and owns its outcomes, which is the software-product level. \[[s4](#deep-dive-sources), [s5](#deep-dive-sources), [s6](#deep-dive-sources), [s8](#deep-dive-sources)\] |
| Switching Cost | 2/3 | The friction is real but bounded: dstack defines a workload once and translates it across TEE backends, and Phala documents running the same control plane on AWS, on GCP, or on hardware the customer brings, so a customer re-establishes the attestation and compliance trail rather than rebuilding from nothing. The cited record does not size that exit, so the switching mechanism is documented but not shown to be expensive. \[[s6](#deep-dive-sources), [s9](#deep-dive-sources), [s12](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | A SOC 2 Type I report and HIPAA controls are the credibility floor any funded competitor can reach through ordinary enterprise preparation, and ISO 27001 is still in progress. No mandate or authorization in the cited record blocks a customer from replacing Phala, so the paperwork qualifies it to sell rather than locking rivals out. \[[s1](#deep-dive-sources), [s10](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Building confidential GPU compute that collects the Intel and the NVIDIA signed quotes behind one verifier is years of specialized systems work, and Phala's about page dates its first trusted-execution network to 2020. zkSecurity audited the engine underneath in May 2025 and placed its highest-severity finding in the boot firmware configuration that decides what the sealed machine has to trust. \[[s4](#deep-dive-sources), [s11](#deep-dive-sources), [s16](#deep-dive-sources), [s19](#deep-dive-sources)\] |
| Buyer Profile | 2/3 | Phala addresses regulated buyers in finance, healthcare, and law, but the base evidenced in the cited record is developers and AI and Web3 infrastructure teams, with every enterprise case study identified only by industry. No regulated-enterprise or government buyer of this product is named in the record. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources)\] |
| Layer | 3/3 | Phala sits at the confidential-compute substrate where the workload executes, so removing it stops the private workload from running rather than removing a check on it. A customer moves whole Docker workloads into that substrate rather than attaching Phala beside them. \[[s4](#deep-dive-sources), [s6](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 1/3 | Applying the four-part floor: no retained dataset, content license, or granted patent appears in the cited record, the record states nothing that Phala accumulates from, and the one durable artifact it built, the dstack engine, is open source and hosted by the Linux Foundation, which makes it public rather than merely replicable. \[[s9](#deep-dive-sources), [s13](#deep-dive-sources)\] |

### Strategic Market Segmentation

Phala sells to teams that want to run AI on sensitive data but cannot send that data to a public model API. Its site sorts the pitch by industry, naming financial services, healthcare research, AI software platforms, decentralized AI, and legal AI, and it lists developers building agents and private inference as the other half.

The customers visible in the record are more mixed than that framing. Phala Cloud reported 10,004 total users against 398 paid ones at the end of 2025, which describes a broad self-serve base, and the cited record does not disclose customer or revenue concentration. Every enterprise case study on the site identifies its subject only by industry.

Phala addresses the segment as horizontal confidential-compute infrastructure rather than a packaged answer for one industry, so a buyer in a regulated industry gets the substrate and builds the industry-specific controls on top. The cited record carries Phala's own usage reporting and no independent sizing of the segment. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s3](#deep-dive-sources), [s8](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

The Phala Confidential AI Cloud runs ordinary Docker workloads inside hardware-backed enclaves, combining Intel TDX for the processor and memory with NVIDIA confidential computing for the GPU. The pairing carries through to the proof. Intel and NVIDIA each emit a signed quote, and Phala collects both and exposes them through one verifier so the machine and the GPU prove themselves together.

For inference, Phala serves OpenAI-compatible endpoints that run inside the enclave and return a proof of the runtime that handled each request. The dstack engine underneath is open source and hosted by the Linux Foundation, and NEAR AI describes a private machine-learning kit built jointly on the same Intel and NVIDIA combination. Those are validation points a marketing page cannot supply on its own.

The honest limit is that the enclave hardware and its attestation come from Intel and NVIDIA, so Phala integrates and operates the protection rather than inventing it. Its own pages put the cost at roughly 5 to 10 percent overhead depending on workload and hardware. \[[s1](#deep-dive-sources), [s3](#deep-dive-sources), [s4](#deep-dive-sources), [s6](#deep-dive-sources), [s8](#deep-dive-sources), [s13](#deep-dive-sources), [s15](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Phala runs two motions at once. Developers self-serve through sign-up and published per-hour prices, from six cents an hour for a small confidential machine, while enterprise clusters, reserved GPU slots, and custom network requirements go through a sales-quoted path.

Two independent surfaces carry traction a buyer can check. OpenRouter's provider page lists 21 models served by Phala, and NEAR AI described a kit built jointly with it in January 2025. Phala announced acceptance into NVIDIA Inception in January 2025, participation in a program that supports startups innovating in AI and accelerated computing, which is ecosystem recognition rather than a check on the product.

What stays thin is a roster of named enterprise customers. Phala's 2025 review reports 398 paid users at the end of that year, and every enterprise case study on the site identifies its subject only by industry. The homepage names organizations in a trusted-by strip, among them NVIDIA, Intel, OpenRouter and the Linux Foundation, and the site describes several of the same names as partners, so none of them is shown to be a customer. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s5](#deep-dive-sources), [s7](#deep-dive-sources), [s14](#deep-dive-sources), [s15](#deep-dive-sources)\]

### Pricing Model

Phala charges by the compute-hour and publishes the rates. Its pricing page lists confidential machines from six cents an hour, GPU capacity from $3.80 an hour, and persistent disk at $0.000139 per gigabyte-hour, billed while the machine exists whether or not compute is running.

The GPU page carries the per-chip detail. It pairs a headline rate with a lower reserved-slot rate for each of three chips: an H100 at $3.08 per GPU-hour against $2.38, an H200 at $4.80 against $3.20, and a B300 at $6.50 against $5.60 in a reserved slot. The H100 and H200 carry a 24-hour minimum and the B300 a 30-day one, and the page sets the buying motion out in the same order, inviting a buyer to trial a machine for 24 hours, reserve a slot, then scale into a dedicated cluster.

Phala's own pages do not open GPU capacity at the same number. The pricing page starts it at $3.80 an hour and marks its GPU instance entries as a 180-day commitment, while the GPU page starts at $3.08 per GPU-hour with a 24-hour minimum, so the entry rate and the term both depend on which page a buyer reads.

Above the listed rates the published prices stop. Enterprise clusters, reserved GPU slots, and custom network requirements are quoted through sales, and the pricing page adds that every listed price is a usage estimate that can change with capacity availability. \[[s4](#deep-dive-sources), [s5](#deep-dive-sources)\]

### Product Delivery & Operations

Phala delivers the confidential cloud as a managed service that absorbs the operational work a buyer would otherwise take on: provisioning confidential GPUs, running the Intel TDX runtime, wiring up NVIDIA attestation, and keeping the result working. That managed layer is the product Phala sells on top of hardware Intel and NVIDIA make.

Phala also publishes a self-hosted path. The dstack engine takes one workload definition and translates it into the right runtime for each backend, and Phala documents running the control plane on AWS, on GCP, or on hardware the customer brings, so a buyer is not tied to Phala's own capacity.

The homepage advertises a 99.9 percent uptime commitment and enterprise support alongside the compute, and the Trust Center offers a SOC 2 Type I report and HIPAA controls. That moves the offering past raw hardware primitives toward something a procurement team can process. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources), [s6](#deep-dive-sources), [s8](#deep-dive-sources), [s10](#deep-dive-sources), [s12](#deep-dive-sources)\]

### Earning Customers' Trust

Phala sells trust itself. Its core claim is that most clouds ask customers to accept a promise of privacy, while Phala emits runtime measurements a customer's software can verify.

The independent check is a code audit. zkSecurity was engaged in May 2025 to audit dstack, and its highest-severity finding was that the build used an OVMF configuration trusting the virtual machine monitor, which the audit recommended moving outside the trusted computing base. Phala's documentation records that the team implemented the recommended configuration, and the auditors noted that Phala was prompt in addressing findings.

The compliance side is earlier. The Trust Center offers a SOC 2 Type I report, which by its own description validates controls at a specific point in time, plus HIPAA controls and a subprocessor register. Phala has also announced that the engine's code, trademarks, and domain will be held neutrally by the Linux Foundation, which would move that part of the trust story to a neutral holder. \[[s1](#deep-dive-sources), [s9](#deep-dive-sources), [s10](#deep-dive-sources), [s16](#deep-dive-sources), [s19](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Phala runs its ecosystem in the open. Its core engine, dstack, is a Linux Foundation project under the Confidential Computing Consortium, which describes it as a framework that simplifies secure application deployment in enclaves with verifiable execution and zero-trust key management.

That openness cuts two ways. It earns credibility, and consortium membership places Phala inside the industry conversation about how confidential computing should work. The OpenRouter listing puts Phala's models in front of developers through another company's marketplace, and NEAR AI describes an open-source private machine-learning kit it built with Phala, which puts Phala's confidential-computing work inside another organization's product.

The same openness weakens lock-in, because the dstack control plane runs on AWS, on Google Cloud, or on hardware the customer brings. \[[s9](#deep-dive-sources), [s12](#deep-dive-sources), [s13](#deep-dive-sources), [s14](#deep-dive-sources), [s15](#deep-dive-sources)\]

### Team & Execution Capability

Marvin Tong and Hang Yin founded Phala in 2019 and still run it, Tong as chief executive and Yin as chief technology officer. What the record documents is operational experience. Phala's about page dates its decentralized trusted-execution network to 2020, and it ran that network as a Polkadot parachain until November 2025, when it sunset the parachain and consolidated staking, governance, and asset flows onto an Ethereum layer-two while keeping Ethereum layer-one for staking security.

That work has been sustained in the open. The team built dstack and shepherded it into the Linux Foundation, and the Confidential Computing Consortium, which admitted Phala in 2025, credited the scale of the trusted-execution network Phala has operated.

The about page lists a chief operating officer, a director of sales, a VP of growth, two developer-relations staff, customer success, marketing and a sales development representative beside the founders, so the commercial bench is staffed. The cited record documents no prior exit, and the prior employers those biographies name run to product roles at Tencent, Didi, Baidu and ByteDance, engineering at Google, and developer relations at Dell, ForeScout and BNB Chain, with no enterprise-software sales leadership among them. On the reviewed record the team reads as an experienced infrastructure builder rather than a proven enterprise sales organization. \[[s2](#deep-dive-sources), [s11](#deep-dive-sources), [s13](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Phala: confidential AI cloud homepage](https://phala.com/) | official | 2026-08-27 |
| f2 | [Phala: Phala 2025 Year in Review post](https://phala.com/posts/phala-2025-report) | official | 2026-08-27 |
| f3 | [AI Defense Matrix Catalog mapping (aligned to catalog)](https://catalog.aidefensematrix.com/products/phala-confidential-ai-cloud) | other | 2026-08-27 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Phala: confidential AI cloud homepage](https://phala.com/) “Run agents, private LLM models, and GPU jobs inside hardware-backed TEEs. Keep secrets private, and prove what ran.” | official | 2026-08-27 |
| s2 | [Phala: Phala 2025 Year in Review post](https://phala.com/posts/phala-2025-report) “In September 2025, Phala Network officially rebranded to phala.com, signaling its evolution from a Web3-native project into a global confidential AI infrastructure company.” | official | 2026-08-27 |
| s3 | [Phala: Confidential AI Models product page](https://phala.com/confidential-ai-models) “OpenAI-compatible APIs run inside hardware-backed TEEs and return proof of the runtime that handled the request.” | official | 2026-08-27 |
| s4 | [Phala: GPU TEE product page](https://phala.com/gpu-tee) “Intel TDX and NVIDIA each emit a signed quote. Phala collects both and exposes them through one verifier so the CVM and the GPU prove themselves together.” | official | 2026-08-27 |
| s5 | [Phala: usage pricing page](https://phala.com/pricing) “Enterprise clusters, reserved GPU slots, and custom network requirements are quoted through sales.” | official | 2026-08-27 |
| s6 | [Phala: Confidential VM product page](https://phala.com/confidential-vm) “Deploy existing containers into hardware-backed TEEs. Keep AI secrets private, and prove what ran.” | official | 2026-08-27 |
| s7 | [Phala: NVIDIA Inception announcement post](https://phala.com/posts/phala-network-joins-nvidia-inception-program) “Phala Network is excited to announce its acceptance into NVIDIA Inception” | official | 2026-08-27 |
| s8 | [Phala: Phala Cloud documentation home](https://docs.phala.com/) “Phala Cloud is a Confidential AI native Neocloud solution that provides you with a secure, user-friendly environment for running AI applications.” | official | 2026-08-27 |
| s9 | [Phala: dstack Linux Foundation announcement post](https://phala.com/posts/dstack-linux-foundation) “Phala will continue to be a lead contributor and steward of dstack, while embracing a broader community effort.” | official | 2026-08-27 |
| s10 | [Phala: Trust Center page](https://phala.com/trust) “Service Organization Control 2 Type I report validating our security, availability, and confidentiality controls at a specific point in time.” | official | 2026-08-27 |
| s11 | [Phala: About page with team listing](https://phala.com/about) “Marvin Tong Co-founder & CEO Former Senior Product Manager at Tencent & Didi.” | official | 2026-08-27 |
| s12 | [Phala: dstack across AWS, Google Cloud and Phala post](https://phala.com/posts/dstack-one-confidential-compute-framework-aws-google-cloud-phala) “define workloads once translate them into the right TEE runtime for each platform” | official | 2026-08-27 |
| s13 | [Confidential Computing Consortium: Welcoming Phala post](https://confidentialcomputing.io/2025/10/02/welcoming-phala-to-the-confidential-computing-consortium/) “We are pleased to welcome Phala as the newest General Member of the” | other | 2026-08-27 |
| s14 | [OpenRouter: Phala provider page](https://openrouter.ai/provider/phala) “Browse models provided by Phala ( Terms of Service ) 21 models” | other | 2026-08-27 |
| s15 | [NEAR AI: building NEAR AI infrastructure with TEEs post](https://near.ai/blog/building-next-gen-near-ai-infrastructure-with-tees) “The SDK combines NVIDIA GPU TEE and Intel TDX technologies to create a secure, verifiable infrastructure for running AI models.” | other | 2026-08-27 |
| s16 | [zkSecurity: Audit of dstack technical report](https://reports.zksecurity.xyz/reports/phala-dstack/) “On May 26, 2025, zkSecurity was engaged to perform a security audit of Phala Network's dstack project.” | other | 2026-08-27 |
| s17 | [AWS: Nitro Enclaves product page](https://aws.amazon.com/ec2/nitro/nitro-enclaves/) “AWS Nitro Enclaves enables customers to create isolated compute environments to further protect and securely process highly sensitive data such as personally identifiable information (PII), healthcare, financial, and intellectual property data within their Amazon EC2 instances.” | official | 2026-08-27 |
| s18 | [Google Cloud Documentation: Confidential VM overview](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/confidential-vm-overview) “To provide a comprehensive confidential environment for both CPU and GPU workloads, NVIDIA Confidential Computing is integrated with CPU-based confidential computing technologies such as AMD SEV or Intel TDX.” | official | 2026-08-27 |
| s19 | [Phala Docs: dstack Security Audit page](https://docs.phala.com/dstack/security-audit) “Phala Network engaged zkSecurity to conduct a comprehensive security audit of the dstack project in May 2025.” | official | 2026-08-27 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Phala: confidential AI cloud homepage](https://phala.com/) “Run agents, private LLM models, and GPU jobs inside hardware-backed TEEs. Keep secrets private, and prove what ran.” | official | 2026-08-27 |
| s2 | [Phala: Phala 2025 Year in Review post](https://phala.com/posts/phala-2025-report) “In September 2025, Phala Network officially rebranded to phala.com, signaling its evolution from a Web3-native project into a global confidential AI infrastructure company.” | official | 2026-08-27 |
| s3 | [Phala: Confidential AI Models product page](https://phala.com/confidential-ai-models) “OpenAI-compatible APIs run inside hardware-backed TEEs and return proof of the runtime that handled the request.” | official | 2026-08-27 |
| s4 | [Phala: GPU TEE product page](https://phala.com/gpu-tee) “Intel TDX and NVIDIA each emit a signed quote. Phala collects both and exposes them through one verifier so the CVM and the GPU prove themselves together.” | official | 2026-08-27 |
| s5 | [Phala: usage pricing page](https://phala.com/pricing) “Enterprise clusters, reserved GPU slots, and custom network requirements are quoted through sales.” | official | 2026-08-27 |
| s6 | [Phala: Confidential VM product page](https://phala.com/confidential-vm) “Deploy existing containers into hardware-backed TEEs. Keep AI secrets private, and prove what ran.” | official | 2026-08-27 |
| s7 | [Phala: NVIDIA Inception announcement post](https://phala.com/posts/phala-network-joins-nvidia-inception-program) “Phala Network is excited to announce its acceptance into NVIDIA Inception” | official | 2026-08-27 |
| s8 | [Phala: Phala Cloud documentation home](https://docs.phala.com/) “Phala Cloud is a Confidential AI native Neocloud solution that provides you with a secure, user-friendly environment for running AI applications.” | official | 2026-08-27 |
| s9 | [Phala: dstack Linux Foundation announcement post](https://phala.com/posts/dstack-linux-foundation) “Phala will continue to be a lead contributor and steward of dstack, while embracing a broader community effort.” | official | 2026-08-27 |
| s10 | [Phala: Trust Center page](https://phala.com/trust) “Service Organization Control 2 Type I report validating our security, availability, and confidentiality controls at a specific point in time.” | official | 2026-08-27 |
| s11 | [Phala: About page with team listing](https://phala.com/about) “Marvin Tong Co-founder & CEO Former Senior Product Manager at Tencent & Didi.” | official | 2026-08-27 |
| s12 | [Phala: dstack across AWS, Google Cloud and Phala post](https://phala.com/posts/dstack-one-confidential-compute-framework-aws-google-cloud-phala) “define workloads once translate them into the right TEE runtime for each platform” | official | 2026-08-27 |
| s13 | [Confidential Computing Consortium: Welcoming Phala post](https://confidentialcomputing.io/2025/10/02/welcoming-phala-to-the-confidential-computing-consortium/) “We are pleased to welcome Phala as the newest General Member of the” | other | 2026-08-27 |
| s14 | [OpenRouter: Phala provider page](https://openrouter.ai/provider/phala) “Browse models provided by Phala ( Terms of Service ) 21 models” | other | 2026-08-27 |
| s15 | [NEAR AI: building NEAR AI infrastructure with TEEs post](https://near.ai/blog/building-next-gen-near-ai-infrastructure-with-tees) “The SDK combines NVIDIA GPU TEE and Intel TDX technologies to create a secure, verifiable infrastructure for running AI models.” | other | 2026-08-27 |
| s16 | [zkSecurity: Audit of dstack technical report](https://reports.zksecurity.xyz/reports/phala-dstack/) “On May 26, 2025, zkSecurity was engaged to perform a security audit of Phala Network's dstack project.” | other | 2026-08-27 |
| s17 | [AWS: Nitro Enclaves product page](https://aws.amazon.com/ec2/nitro/nitro-enclaves/) “AWS Nitro Enclaves enables customers to create isolated compute environments to further protect and securely process highly sensitive data such as personally identifiable information (PII), healthcare, financial, and intellectual property data within their Amazon EC2 instances.” | official | 2026-08-27 |
| s18 | [Google Cloud Documentation: Confidential VM overview](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/confidential-vm-overview) “To provide a comprehensive confidential environment for both CPU and GPU workloads, NVIDIA Confidential Computing is integrated with CPU-based confidential computing technologies such as AMD SEV or Intel TDX.” | official | 2026-08-27 |
| s19 | [Phala Docs: dstack Security Audit page](https://docs.phala.com/dstack/security-audit) “Phala Network engaged zkSecurity to conduct a comprehensive security audit of the dstack project in May 2025.” | official | 2026-08-27 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.