Summary
ExpressVPN's approach to privacy has always been the same: remove access to customer data, don't just promise not to use it. Making sure ExpressAI worked the same way is what led them to Verda's Confidential Computing, running on NVIDIA Blackwell GPUs.
Most AI tools leave users with no control over their data. It's readable by the provider, and often used to train future models. ExpressAI protects chats differently: every conversation is processed inside a secure enclave, encrypting and isolating it so nothing can leak and nothing is used for training.
"We needed a partner willing to co-engineer at the level we operate at, down to network and firewall configuration, not just rent us GPUs. Verda did that, kept our infrastructure in the right jurisdiction, and got us onto NVIDIA’s Blackwell GPUs early enough to build multi-node confidential computing together."
Peter Membrey, Chief Research Officer, Kape Technologies
Challenge
ExpressAI is a privacy-first AI platform that's part of the ExpressVPN suite. It gives users access to six open source AI models in one interface, covering tasks like writing, reasoning, coding, document analysis, and multilingual work, with the ability to run the same prompt across models to compare results, upload documents and files for AI-assisted analysis, and keep their full conversation history.
For ExpressVPN, shipping ExpressAI meant privacy couldn't be bolted on. It had to be built in from the start. That meant, even ExpressVPN can’t read what users typed, including their conversation history, which has to stay protected under user-controlled encryption.
That condition raised questions most privacy policies don't answer. Chat prompts and uploaded files are personal data under GDPR, and often more revealing than what a VPN typically handles. Where that data got processed mattered just as much: infrastructure exposed to broad government access laws could be compelled to hand over data regardless of what ExpressVPN's contracts promised, so data sovereignty had to be treated as a requirement, not an afterthought. And enterprise buyers evaluating AI tools increasingly ask what technical control actually prevents provider access, not what a policy promises, and "our policy forbids it" doesn't hold up to that question the way "the architecture makes it impossible" does.
In practical terms, the infrastructure had to guarantee four things:
- Prompts stay cryptographically isolated during processing. Not even infrastructure operators can access the data while it's being used.
- No persistence of user data beyond the session. Once the interaction ends, the data is gone.
- No use of prompts for model training. The architecture enforces this, rather than a policy promising it.
- Proof that any customer could check for themselves, not just something ExpressVPN's own engineers could confirm internally.
All of this had to hold without slowing down responses or limiting which models customers could use.
Solution
ExpressVPN partnered with Verda to run ExpressAI inside Confidential Computing on NVIDIA Blackwell GPUs.
Why the newest GPU architecture mattered. ExpressAI couldn't afford to trade privacy for performance. Older or queued hardware would have meant compromising on model quality or speed to get the isolation guarantee, and that tradeoff wasn't acceptable. Getting there also meant ExpressVPN needed more than rack space from a partner. Because ExpressVPN operates its own enclaves and attestation pipeline rather than adopting a pre-built version, it needed a partner willing to work at that level of detail, down to network and firewall configuration for the enclave environment itself, rather than handing over a fixed, closed system.
What they built together. That co-engineering went further than infrastructure setup. Most confidential computing implementations at the time were limited to a single GPU. Together, ExpressVPN and Verda enabled confidential computing across multi-node configurations on NVIDIA HGX™ B200, including early support for distributed secure GPU clusters and validation of performance and isolation at production scale.
How it runs. Each of ExpressAI's six models runs inside its own attested enclave, a hardware-sealed boundary, a Trusted Execution Environment, where a conversation stays encrypted while the GPU is actually processing it, not just before or after. Everything outside that enclave, including the host and hypervisor, sits outside and cannot read what's inside. Scaling ExpressAI means adding more enclaves, not more raw GPU power, each with its own measurement and attestation report. That's only possible because Verda's infrastructure supports confidential computing across multiple nodes.
Results
Running ExpressAI on Verda's Confidential Computing lets ExpressVPN ship a privacy claim that goes further than what most AI providers can make, and back it with a working multi-node production deployment.
- A claim backed by proof, not policy. ExpressVPN can point to something concrete instead of a policy promise: a specific enclave, with its own measurement, that a user can check for their own session. Every logged-in user has access to their own Attestation Report, showing that proof.
- Independently audited, not self-certified. ExpressAI's architecture has been reviewed by Cure53, so the privacy guarantee is checked by a third party rather than resting on ExpressVPN's own word.
- Multi-node confidential computing in production. ExpressAI runs on multi-node NVIDIA HGX™ B200 confidential computing, built jointly with Verda, and validated for large-scale inference. That's a step past single-GPU confidential computing, which is where most public confidential computing offerings still sit today.
Try Verda's Confidential Computing for running your sensitive AI workloads today:
- Sign up to deploy 8x B300, 8x B200, or 1x RTX PRO 6000
- For setup and verification steps, read the docs
- For custom configurations, get in touch with us
