Best Confidential VPS Providers (2026): Encrypted Memory, Attestation, and Who Still Needs Your Name

Every ordinary VPS can be read by the company that runs it. Not "could be, in theory": the hypervisor holds your RAM in plaintext, the guest agent runs commands as root, and the disk mounts from the host. Confidential computing removes the first of those with hardware (AMD SEV-SNP, Intel TDX) and lets the CPU sign a statement about what it launched. Whether that helps you depends on what else the provider knows and what the attestation actually covers.

This is a ranked list of seven ways to get a confidential virtual machine, judged on what the hardware proves, whether you can verify the boot chain yourself, what the account requires, and price. Every claim was re-checked against the provider's own documentation in September 2026.

What confidential computing does and does not do

• It encrypts memory with a key generated in the CPU's security processor. The hypervisor sees ciphertext. SEV-SNP adds integrity (no replay or remapping by the host); TDX is Intel's equivalent.
• It signs a launch measurement. The CPU hashes what was loaded before the VM started and signs it with a key that chains to AMD or Intel. Anyone can verify that signature; the question is what was measured. On most confidential VMs that is the firmware. Measured boot extends it to the kernel, initramfs and command line.
• It does not hide that the VM exists, its traffic, its CPU use, or your identity if the provider took one. It does not stop the provider deleting the machine. It does not close every microarchitectural side channel; published attacks exist and every vendor says so in the fine print.
• It does not encrypt your disk. That is a separate layer, and it matters where the passphrase is typed. See our measured boot guide for why an unencrypted /boot undoes a confidential VM.

The seven, ranked

1. Servury Blackbox

Hardware: AMD EPYC 7543 (Milan) with SEV-SNP, on servers Servury owns in a Montreal colocation facility; guest policy 0x30000 (debugging and migration disallowed, and you can read that from the report).

What you can verify: everything in the launch measurement. With measured boot the firmware (an AmdSevX64 OVMF), the Debian signed kernel, the initramfs and the command line carrying your SSH key are supplied from a published release, rebuilt reproducibly from public sources, and folded into the CPU-signed measurement. A published verifier checks the report's signature chain, the measurement, and that the SSH host key on the wire is the one bound into the report, before you type a disk passphrase. No guest agent exists; the disk is LUKS2 encrypted inside the guest with a passphrase that never reaches the host.

Account: nothing. No email, no name, no KYC; crypto on Servury's own nodes, a card, or cash by mail in any currency. Price: from $9.99 a month for 2 vCPU, 4 GB, 50 GB NVMe, up to 8 vCPU and 32 GB. Blackbox.

Honest limits: one location for this line (Montreal); Linux only for confidential mode; the template is host-readable until you encrypt it at first boot; founded 2025.

2. Google Cloud Confidential VMs

Hardware: AMD SEV, AMD SEV-SNP and Intel TDX, plus NVIDIA confidential computing on attached GPUs, per Google's documentation; N2D and C3D machine types support live migration under SEV.

What you can verify: boot-time attestation through Google's vTPM under SEV, and SNP attestation reports "requested at any time directly from the AMD Secure Processor" under SEV-SNP. The images are Google's; you can verify measurements against Google's published values, not rebuild them.

Account: a Google Cloud account with billing; identity checks apply to many customers. Price: a premium on the equivalent standard machine; Google's overview page refers to its pricing page rather than stating it.

Honest limits: the operator knows exactly who you are, and the whole control plane is Google's.

3. Azure Confidential VMs

Hardware: AMD SEV-SNP (DCasv5, DCasv6, ECasv5, ECasv6 series and their local-disk variants) and Intel TDX (DCesv6, ECesv6), plus NCCadsH100v5 for confidential GPUs.

What you can verify: a signed attestation report with platform measurements and OS measurements, a dedicated vTPM per VM, and optional confidential OS disk encryption whose keys are bound to the vTPM and can be customer-managed; Azure Attestation refuses to start the VM if SEV-SNP is not enabled. This is the most complete hyperscaler implementation.

Account: an Azure subscription with a card; identity verification is routine. Price: by VM size; Microsoft notes encrypted OS disks incur higher costs from March 2026 and the small VMGS disk has a monthly charge.

Honest limits: no live migration, no accelerated networking, disk encryption only under 128 GB, and, again, an identified account.

4. AWS EC2 with AMD SEV-SNP

Hardware: M6a, C6a and R6a instances up to specific sizes; memory is always encrypted on Milan, Graviton2 and Ice Lake hosts, but SEV-SNP attestation is what makes it checkable.

What you can verify: a signed SNP attestation report including a launch measurement, with VCEK signatures on Dedicated Hosts and VLEK on shared tenancy. Shared tenancy is limited to US East (Ohio) and Europe (Ireland).

Account: an AWS account with a card; identity verification for many. Price: no extra charge on Dedicated Hosts; on shared tenancy an additional fee equal to 10% of the On-Demand hourly rate.

Honest limits: two regions for shared tenancy, no hibernation, no Nitro Enclaves alongside SNP, and it is AWS.

5. Phala

Hardware: Intel TDX confidential VMs for Docker workloads and NVIDIA confidential computing on H100, H200 and B300 GPUs, per its site.

What you can verify: attestation quotes carrying mrenclave and TCB level, signed by Intel and NVIDIA, "every result can carry proof" in its words. It is built for confidential AI rather than general VPS use.

Account: not stated on its pages; payment methods not stated. Price: GPU enclaves from $3.20 per GPU-hour (H200); CPU confidential VM pricing not stated on the page we read.

Honest limits: a workload platform, not a root-access VPS; account and payment details were not published where we looked.

6. Edgeless Systems (Contrast, Privatemode)

What it is: software. Contrast builds and manages confidential containers on SEV-SNP and TDX hardware; MarbleRun manages Intel SGX enclaves; Privatemode AI is a hosted confidential inference service. You bring the cloud.

Why it is here: it is the most serious open toolchain for verifying confidential workloads, and if you already have a hyperscaler account it is how you make the attestation mean something. It is not a place to rent a server.

7. enclaive

What it is: a platform for confidential VMs and Kubernetes on AWS, Azure, GCP "or any hybrid setup", with a vHSM for attested key ownership; specific hardware technologies and prices were not stated on its homepage. Same category as Edgeless: software over someone else's cloud.

Side by side

How to check any confidential VM

1. Get a report from inside the VM (/dev/sev-guest on SNP, the TDX quote device on TDX) and verify its signature against the vendor's certificate chain. If you cannot, it is not confidential; it is a promise.
2. Read the guest policy. On SNP, bit 19 permits host debug reads of your memory. It should be clear. Servury's is 0x30000; check the hyperscalers' defaults for the VM you launched.
3. Ask what the measurement covers. Firmware only means the host still controls your kernel and the initramfs that asks for your disk passphrase.
4. Ask whether you can rebuild what was measured. A number you cannot recompute is a number you are trusting.
5. Ask what the account knows about you. Encrypted memory does nothing about a passport on file.

Frequently asked questions

What is a confidential VPS?

A virtual machine whose memory is encrypted by the CPU with keys the hosting provider never holds (AMD SEV-SNP or Intel TDX), and which can produce a CPU-signed attestation report about its own launch. The provider can still stop it and see its traffic; it cannot read its RAM.

Which providers offer SEV-SNP VPS?

Servury (Blackbox, no KYC), Google Cloud, Azure and AWS (M6a/C6a/R6a). Phala uses Intel TDX instead.

Is a confidential VM the same as an encrypted disk?

No. Memory encryption protects the running machine from the host; disk encryption protects data at rest. You want both, and you want the passphrase to be typed somewhere the host cannot intercept, which is what measured boot is for.

Can I verify a confidential VM without trusting the provider?

Yes, that is the point: the report is signed by the CPU vendor's chain, not the host's. What you can conclude depends on what was measured and whether you can reproduce it. Servury publishes the recipe; the hyperscalers publish expected values.

What is the cheapest confidential VPS?

Servury Blackbox at $9.99 a month for 2 vCPU and 4 GB. The hyperscalers charge a premium over their standard instances and require an identified account.