Learn / Trust
What a GPU supplier can actually promise
“Secure” means nothing until somebody says who can read what. Prism grades every offer, and the grade comes from evidence the network can check.
One sentence hiding three problems
People call a rented machine untrusted and stop there. Underneath that word sit three separate problems, and each one needs a different control.
Can the operator read what your workload touches? Did the machine run what you asked? Can your money be taken while the work happens? A GPU can be excellent at one of these and useless at another. One label cannot describe it.
Four grades, weakest first
Open
A bonded supplier identity and metered billing against escrow. The operator can read memory, disk and GPU memory. You know who they are and what you will be charged. That is the extent of it.
Isolated
A virtual machine with the GPU passed through exclusively, running an image pinned to a digest. It narrows what a mistake can reach. A host that decides to look inside the guest still can.
Attested
The machine proves what it booted, checked against the hardware vendor's signing keys. This tells you what ran. It says nothing about who was watching.
Confidential
Guest memory and GPU memory are encrypted against the host. Here the operator genuinely cannot read the workload, and reaching this grade takes particular silicon.
Where the grade comes from
A supplier does not choose its own grade. The network computes it from a device-signed report about the machine. When a node claims a grade its hardware cannot support, that claim is a signed statement the dispute process can act on.
The grade is also capped at what the network can check today. Attestation evidence travels end to end but nothing verifies it yet, so no offer is served above isolated whatever a machine reports. Lifting that ceiling takes a verifier in code.
What today's capacity gives you
Every machine available right now is open class. The company hosting it can read what runs there. This follows from the hardware in the fleet, so it will hold until different hardware arrives.
Two things follow. Anything that has to stay private belongs in your vault, encrypted under a key derived on your own machine and never sent to us. And a request can require a minimum grade, so an agent handling something sensitive refuses weak capacity on its own.
Why the top grade needs specific hardware covers what has to change before it exists.