VAST Data’s $30 Billion OS Chases Data That Cannot Leave

VAST Data previewed DataEnclave on September 22, a runtime that runs outside AI models on hardware the customer owns. Shipment is set for the first quarter of 2027, after a $30 billion Series F in April.

GPU clouds already buy the operating system under those models. Banks, hospitals and air-gapped agencies still cannot send records to a public lab, and DataEnclave is the product aimed at them.

VAST Data’s $30 Billion Round Was Built on GPU Clouds

The New York company, founded in 2016 by Renen Hallak and colleagues, closed its Series F financing at a $30 billion valuation on April 22, 2026. Drive Capital led the round, Access Industries co-led, and Fidelity Management & Research Company, NEA and NVIDIA joined, with new investors beside them. Primary and secondary capital together came to about $1 billion.

That price is more than a threefold jump from the $9.1 billion Series E in late 2023. Hallak, the founder and chief executive, said the firm already supports AI environments spanning millions of GPUs, and that applications, models and infrastructure now run as one system through data.

The April release listed CoreWeave, Lowe’s, the U.S. Air Force and Cursor among organizations on the VAST AI Operating System. Mistral AI co-founder and CTO Timothée Lacroix said the platform lets the lab manage and scale the datasets used to train frontier models. Crusoe’s Erwan Menard, SVP of product management, said the partnership grew more than 10x in the prior year.

THE MONEY DATES

1. 2016: Hallak and co-founders start VAST Data as a remote-first storage software company.
2. Late 2023: Series E values the company at $9.1 billion.
3. November 6, 2025: CoreWeave signs a $1.17 billion commercial agreement that makes VAST the primary data foundation for its AI cloud.
4. April 22, 2026: Series F closes at $30 billion on about $1 billion of primary and secondary capital.
5. September 22, 2026: VAST previews DataEnclave, with shipment set for the first quarter of 2027.

Technology commentator Natalie Fratto, in an October 1 explainer, said the company was noticeably missing from lists of top private tech firms even at that price, because it sits in the unsexy middle of Jensen Huang’s five-layer cake.

Banks, Hospitals and the Data That Cannot Leave

Hallak has used Huang’s cake in public remarks this year: power, hardware infrastructure, software infrastructure (the layer VAST calls an AI operating system), models and applications. VAST sells the software layer. GPU clouds and model labs already live there. The records that cannot follow them do not.

The DataEnclave release is blunt about the bind. In financial services, healthcare, government and other regulated trades, some of the most valuable data stays inside rooms where moving it to an outside AI service is impractical or banned. Model builders will not drop proprietary weights into a shop they do not run. So the job that needs both never gets built.

Jeff Denworth, a VAST co-founder, named the first queue: large banks, intelligence and defense agencies, and drug makers. “In all three cases, they have said that this solves major pains for them in that they’re not allowed to send certain data products up to different services that they want to use,” he said. “It’s basically the most regulated and air-gapped customers of the world.”

Those shops are not new to VAST as storage buyers. Larry Feinsmith, managing director and head of global tech strategy, innovation and partnerships at JPMorganChase, called the platform a key enabling technology for next-gen AI infrastructure, Gen AI applications and agentic workflows. Pixar has been on the system since an 2018 beta for volumetric characters on Soul. Hallak has also named NASA, Boston Children’s Hospital, the NHL, SpaceX and xAI. Storage and training pipelines are one thing. Running a Cohere or CrowdStrike model on a chart, a claim file or an intelligence store that cannot leave the building is another, and that is the gap DataEnclave claims to close.

How DataEnclave Runs a Model the Admin Cannot Read

VAST describes DataEnclave as the confidential AI runtime for sensitive data inside VAST DataEngine, built on NVIDIA Confidential Computing across Hopper, Blackwell and Rubin GPUs. A hardware-isolated container holds the job. Signed proof of that environment is checked before any decryption keys are released. Customer data keys stay with the customer. Model keys and weights stay with the model builder. Operators and admins of the machines see neither while the job runs.

Models are becoming a resource the operating system has to manage, the same way it manages data. That means knowing which model fits which task, what it can see, who can use it and under what rules, and doing all of that inside the same security and operational boundaries an enterprise applies to everything else. Bringing leading AI models securely to the world’s most sensitive data is where this starts.

Renen Hallak, Founder and CEO, VAST Data, September 22, 2026 release

CPU-only isolation is not enough for this job, because inference has to hold unencrypted weights, prompts and mid-layer results in GPU memory. VAST’s own technical note says confidential computing has protected data in use on CPUs for years, and that DataEnclave extends that boundary across CPU and GPU so the host OS, the hypervisor and other tenants cannot read the live contents.

Introducing VAST DataEnclave. Built on NVIDIA Confidential Computing, this new runtime in the VAST AI Operating System enables leading models to securely run against sensitive enterprise data while protecting customer and model IP. pic.twitter.com/WCxJ6aswUa

— VΛST Data (@VAST_Data) September 22, 2026

A Bank Launching a Packaged Model

The company’s worked example is a bank that wants a proprietary frontier model on accounts it cannot export. Each model release arrives as a VAST Application: an inference service plus the config DataEngine needs, with the container image and weights encrypted under keys the model lab holds. The bank stores those releases on its own VAST cluster. Launch uses the same interface as any other app, plus the address of the lab’s attestation server.

The confidential virtual machine boots with no keys. It asks its hardware root of trust for evidence of the chip, firmware, boot software and host limits, signed with keys that never leave the silicon. That packet goes to the lab’s attestation server, which follows the IETF remote attestation architecture and can sit on the CNCF Confidential Containers project stack, or on Fortanix gear for a fully sovereign site. Only if the evidence matches policy are the keys released, and only in a wrap the CVM can open inside protected memory.

The bank owns the GPU servers. Its admins never see the decrypted image or the weights. Search and prompt assembly stay on the bank’s systems, so the model sees only the prompt the bank built. Because the CVM starts the outbound call, the lab never needs a route into the bank network. If the license ends, the lab can revoke entitlement on its own server and new CVMs stop getting keys, with no help from the bank’s operator.

Denworth said the capability sits in the existing AI operating system rather than as a paid add-on. “We don’t charge anything extra for this,” he said.

CoreWeave Already Wrote a $1.17 Billion Check

The valuation did not wait on that runtime. On November 6, 2025, VAST signed a commercial agreement valued at $1.17 billion with CoreWeave, the GPU cloud, extending a partnership that already treated the VAST AI OS as CoreWeave’s primary data foundation. Hallak called it a long-term alignment of roadmaps. Brian Venturo, CoreWeave co-founder and chief strategy officer, said the operating system underpins how CoreWeave designs and delivers its AI cloud.

VAST’s CoreWeave case study lists more than 1.2 exabytes of capacity and training goodput of up to 96 percent. That is the work GPU clouds pay for: keep the accelerators fed during training and inference, at the scale of whole data halls. Hallak told Matt Turck’s MAD Podcast that one AI cloud came in asking for 500 petabytes and later revised the ask to 2 exabytes, a jump he said sometimes scares him. Labs, he added, are moving from tens of exabytes toward much larger stores. Disk demand on that curve is what a $30 billion software layer can be priced on.

THE GPU-CLOUD STACK VAST ALREADY SELLS

• The CoreWeave check: A $1.17 billion commercial deal dated November 6, 2025, with VAST as the primary data foundation.
• Listed scale: More than 1.2 exabytes of capacity on the CoreWeave case study, with training goodput of up to 96 percent.
• The demand scare: Hallak described one cloud revising a 500 petabyte plan to 2 exabytes.
• Named labs and clouds: Mistral, xAI, Crusoe, Nscale and SpaceX sit on the same software layer.

None of that volume is a substitute for a hospital chart that legally cannot ride to a hosted API. The round priced the first customer. DataEnclave is a bid for the second.

Who Can See the Weights, the Records and the Prompts

VAST published a three-party split for a bank that both owns the data and runs the machines. When a third party hosts the cluster, that host is the infrastructure operator and both other parties need protection from its admins.

WHO CAN SEE WHAT INSIDE A DATAENCLAVE JOB

The same note is honest about what the design does not cover. Isolation does not guarantee that a job will keep running. An operator can refuse to start a workload or can stop one. VAST logs which app and version launched, from which image, on which node and under which config, into VAST DataBase, without capturing the data inside the CVM. Each side keeps its own record of attestations and key releases, so neither has to take the other’s word.

Justin Boitano, vice president of enterprise AI at NVIDIA, said the integration gives enterprises and model builders security, identity, permissions, governance and compliance as a foundation of the agent architecture. Jeremy Fraenkel, CEO of Fundamental, said the firm’s tabular model can run inside a bank’s or health system’s own rooms, in a sealed environment where the model and the records are exposed to neither party.

The Rule of 228 Is Why the Round Was Optional

Alongside the $30 billion mark, VAST said it had surpassed $4 billion in cumulative bookings and had exited the prior fiscal year with more than $500 million in committed annual recurring revenue, plus a positive operating margin and free cash flow. In that same fiscal year it posted a Rule of X score of 228%, the company’s label for growth rate plus profit margin, the same mix software investors call the Rule of 40.

Hallak has said the company was generating more than $100 million in cash every quarter by the April round, and that it does not need outside capital to fund operations. He has also said the most recent fiscal year was the first profitable year, after several years of positive free cash flow. Fratto put the public-software average for the Rule of 40 at 61, with 40 treated as the elite bar. A VAST spokesperson compared the 228% score with Palantir at 127% for fiscal 2026.

GROWTH PLUS MARGIN, AS DISCLOSED

Hallak told interviewers in April and May that the raise was a way to bring in partners and to show customers the firm would be around for the large projects now on the books, not a way to fund payroll. He said the company could be ready to go public by the end of 2026, with no filing date attached. As of early October, it has not filed.

He also said VAST manages about half of all data-center NAND, that APAC and the Middle East are the fastest AI-adopting regions, and that NAND supply will not catch demand until about 2029. Those constraints sit on Huang’s bottom layers, power and chips, and they are why a software company that keeps GPUs busy can clear a Rule of X of 228% while many AI builders still burn cash.

DataEnclave Ships in the First Quarter of 2027

The runtime is in preview. VAST says it will ship in the first quarter of 2027 through VAST and OEM partners including Cisco and Supermicro. Attestation can run on-prem for air-gapped halls. Connected sites can use CNCF Trustee or Fortanix Confidential AI.

THE FIRST PARTNER LIST

• Model builders: Cohere, CrowdStrike, Deepgram, Factory, Fundamental, TwelveLabs and NVIDIA.
• AI clouds: BUZZ HPC, Nscale and Sharon AI.
• Hardware and trust: Cisco, Supermicro and Fortanix, on Hopper, Blackwell and Rubin confidential computing.

Frank O’Dowd, Cohere’s chief revenue and commercial officer, said customers want encryption at rest, in motion and during inference, and that the tie-up lets them run Cohere models where the data already lives. Dr. Bartley Richardson, CrowdStrike’s chief AI and autonomous systems officer, said defenders in regulated industries want SafeMind models on sensitive data inside their own boundaries. Scott Stephenson, CEO of Deepgram, said voice AI is real time and that shops should not have to pick between a working conversation and control of the audio. Eno Reyes, co-founder and CTO of Factory, said source code is among an enterprise’s most sensitive assets. Jae Lee, CEO and co-founder of TwelveLabs, said video archives and sensor feeds often sit in rooms that are disconnected by design.

That roster is a sales floor, not a live regulated deployment. Hyperscalers have months to ship their own confidential wrappers before VAST’s date. GPU clouds will keep revising exabyte orders in the meantime, which is the business that already paid for a $30 billion mark. The records that cannot leave the building still wait on a 2027 ship date.

Disclaimer: This article is news reporting and analysis of VAST Data’s disclosed financing, customer contracts and product plans, and it is for information only. It is not investment advice, a solicitation to buy or sell any security, or a recommendation about any private round, secondary sale or possible IPO. Readers who are considering an investment, a vendor contract or a deployment of confidential computing should consult a licensed financial adviser, securities lawyer or qualified security architect who can review the actual documents and controls. Figures, customer lists, preview status and the first-quarter 2027 ship window reflect company statements and named speakers as published through early October 2026 and may change.