Cohere Adds Confidential-Computing Encryption to Model Vault, Locking Even Itself Out of Customer Inference Data
Cohere's new Encrypted Vault tier for Model Vault runs inference inside hardware that encrypts memory on both CPU and GPU, so Cohere and the cloud provider cannot read customer data.
Overview
Cohere has added a confidential-computing tier to Model Vault, its single-tenant inference product, that encrypts customer prompts and responses even while a model is actively processing them — a protection the company says extends to itself and to the cloud providers hosting the workload, according to VentureBeat. The capability, which Cohere calls the Encrypted Vault, went live on September 16, 2026, according to VentureBeat.
What We Know
Model Vault is Cohere’s single-tenant inference platform — a dedicated deployment of Cohere’s models rather than a shared multi-tenant API, according to VentureBeat. Cohere’s own documentation describes two tiers: a Standard Vault, and an Encrypted Vault that adds “confidential computing: prompts, responses, and everything in between stay protected end to end inside hardware-backed trusted execution environments, with verifiable remote attestation,” according to Cohere’s documentation.
Data has long been encrypted at rest and in transit, but that protection has historically disappeared the moment a prompt is actually processed by a model, sitting in plaintext in memory where it is readable by the host operating system or anyone with privileged access to the machine, as VentureBeat reported. The Encrypted Vault is designed to close that gap: according to Cohere, it pairs a confidential virtual machine on the CPU side — running on Intel TDX or AMD SEV-SNP — with Nvidia GPUs operating in confidential computing mode, extending protection across both the CPU and GPU rather than stopping at the CPU as earlier confidential-computing deployments typically did, according to VentureBeat.
“Confidential Computing support in Model Vault is newly available,” Manoj Govindassamy, Cohere’s director of serving inference, told VentureBeat. “As of today, there’s no additional cost for Model Vault customers, pricing remains the same as the standard Model Vault offering.”
Govindassamy said the encryption boundary covers more than the prompt itself. “Within the confidential environment, it remains protected throughout the hardware path, including in memory, across CPU and GPU interconnects, and in other hardware components,” he told VentureBeat. Data is decrypted only at the point where it must be processed inside the protected CPU and GPU execution environment, and the encrypted response sent back to the customer can only be decrypted with the customer’s own keys, according to VentureBeat.
Cohere is also building in a way for customers to check the claim rather than simply trust it. “No one, including Cohere, the cloud provider or the cluster operator can see or access any customer data,” Govindassamy said. “Every inference returns an attestation report that lets customers verify the exact hardware, software, and security policies protecting their workload,” according to VentureBeat. Cohere’s documentation confirms Encrypted Vault includes “verifiable remote attestation” and, unlike the Standard Vault, offers compliance support for GDPR, HIPAA and SOC 2 “plus verifiable attestation evidence,” according to Cohere’s documentation. Cohere also plans to open-source the full Model Vault serving stack so independent auditors can validate that it doesn’t log, export or leak data, and has registered the hardware and software “golden values” with Intel’s Trust Authority so a booting confidential VM can be confirmed against the approved configuration from Cohere, Intel and Nvidia, according to VentureBeat.
The Encrypted Vault launched the same day Cohere signed its definitive merger agreement with Germany’s Aleph Alpha, a roughly $20 billion deal creating dual headquarters in Toronto and Berlin, according to VentureBeat. Cohere CEO Aidan Gomez pitched the combined company around trust and governability rather than raw model capability, describing it as AI “powerful enough to compete, but secure and governable enough to trust,” according to VentureBeat.
Confidential inference is not a new category. Tinfoil runs open-weight models such as Mistral and DeepSeek inside trusted execution environments with public attestation backed by a transparency log, while Edgeless Systems built Privatemode for European government and regulated-industry buyers seeking an EU-based trust story, according to VentureBeat. Phala rents attested GPU capacity and hosts a catalog of open models rather than shipping its own, Maple AI encrypts client-side and talks only to confidential-computing backends, and Confer — built by Signal creator Moxie Marlinspike — offers client-held keys and attested open-source server code modeled explicitly on Signal, according to VentureBeat. What distinguishes Cohere’s approach, per VentureBeat, is that those competitors largely run someone else’s open-weight models inside an enclave, while Encrypted Vault applies confidential computing to Cohere’s own enterprise models inside the Model Vault product it already sells alongside its North platform, according to VentureBeat.
What We Don’t Know
Cohere has not published a dedicated blog post detailing the Encrypted Vault launch alongside its documentation, and pricing or availability details for the underlying confidential-computing hardware across specific cloud regions were not disclosed in the available reporting. It also remains unclear, per VentureBeat, whether attestation verification happens only once when the confidential environment boots or on every individual inference request — a distinction one outside developer, quoted by VentureBeat, argued matters for making attestation “part of the request path” tied to model version, GPU policy and retention rules, according to VentureBeat. The timing of the open-sourcing of the full serving stack was also not specified.
Analysis
The launch arrives as enterprise buyers have grown more focused on what an AI vendor can technically see rather than what it promises not to look at — a shift VentureBeat linked to recent disputes over data retention policies at other large AI labs. By pairing confidential computing with a hardware attestation report rather than a contractual promise, Cohere is betting that regulated buyers such as banks, hospitals and public-sector agencies will pay for inference infrastructure that can produce cryptographic proof of its own boundaries, not just a compliance letter, according to VentureBeat.