Table of Contents
Hippius, the distributed cloud operating as Bittensor Subnet 75, has launched Confidential Compute, bringing hardware-protected execution to virtual machines, managed PostgreSQL, managed Kubernetes, and GitHub Actions runners.
Every newly launched VM runs inside an AMD SEV-SNP trusted execution environment, which isolates its memory from the host operating system and hypervisor. Hippius also encrypts VM disks and releases their keys only after a hardware-signed check confirms the approved boot environment.
The service is available to every Hippius account.
How Hardware Attestation Controls Access
This new protection addresses a privacy issue for distributed cloud users, whose applications run on machines owned by independent miners. Encrypting stored files and network transfers does not, by itself, protect the data an application loads into memory while running.
AMD SEV-SNP, therefore, encrypts each VM's memory using a key held by the processor's security hardware, preventing the server operator from reading its contents through the host. The confidential environment covers the whole VM rather than requiring developers to isolate a small part of an application.
Before the encrypted disk can open, the VM must pass attestation, a signed hardware report proving its launch configuration. Its key broker checks the processor's signature, the software measurement against a Hippius-approved allowlist, and the launch policy. The broker refuses keys to configurations that allow debugging or migration helpers.
The broker encrypts the disk key to a fresh public key generated inside the VM. Only that VM can decrypt the response; the host relaying it cannot. Users can inspect attestation status in the console, with the raw AMD report available when release evidence has been retained.
Deleting a VM crypto-erases its disk by destroying the associated vault key, making the stored encrypted disk and its backups unrecoverable once the VM has stopped.
Four Services Share the Confidential VM Layer
The launch makes the same underlying protection available through four products:
- Virtual machines are SSH-accessible Linux systems, including Ubuntu, Debian, Fedora, Rocky Linux, AlmaLinux, and Arch, alongside preconfigured applications such as WordPress.
- Managed PostgreSQL runs versions 16, 17, and 18, deployed as either a single instance or a three-instance setup.
- Managed Kubernetes uses RKE2 clusters with three confidential control-plane nodes. A cluster key generated in the user's browser protects access to the kubeconfig, the configuration file used to connect to the cluster.
- GitHub Actions runners get a fresh confidential VM for each job, destroyed when the job ends.
For build pipelines, the isolation protects credentials such as signing keys and deployment tokens from the machine's host. Databases gain protection for records loaded into memory, while AI agents and data-processing jobs can use confidential VMs to handle private documents, prompts, and credentials.
Placement, Pricing, and Launch Requirements
Users can let Hippius choose a verified server or select a country with available capacity. Kubernetes clusters must be pinned to one country to keep their three control-plane nodes close together.
Hippius's compute pricing lists a Small VM with one vCPU, 4 GB of memory, and 40 GB of disk at $0.0438 an hour, or an estimated $32 over 730 hours. Public IPv4 addresses cost an additional $0.005 an hour. Managed databases add 25% to their underlying VM costs; managed Kubernetes adds $15 per cluster per month.
Usage is metered per second with a one-minute VM minimum and charged hourly against a prepaid dollar balance. Stopped VMs remain fully billable because their capacity stays reserved; deletion stops billing. New launches require enough balance to cover 24 hours of existing resources plus the new workload.
The products are accessible through the Hippius console, where launch forms display hourly and estimated monthly costs before deployment.
