Bare metal vs cloud GPUs: who can see your data?
Short answer: on a standard cloud GPU, the cloud's software layer can, in principle, read your machine's memory and copy it. Bare metal removes that layer, but you still have to trust whoever runs the hardware. The safest setup is a dedicated bare-metal server from an operator who resets it properly between customers, or a cloud machine with encrypted computing switched on.
This guide explains who can see your data in each setup, where the real risks are, and what to ask before you rent.
What is the difference between a cloud GPU and a bare-metal GPU?
Both are usually rented. The difference is what sits between your software and the hardware.
Standard cloud GPU (virtual machine) | Bare-metal GPU server | |
|---|---|---|
What you get | A slice of a server, or a whole server, run as a virtual machine | The whole physical server, with nothing in between |
The layer in between | The cloud's virtualisation software (the hypervisor) runs underneath your machine | None; your operating system runs straight on the hardware |
Who else is on the hardware | Sometimes other customers, kept apart by the hypervisor | Only you |
Your control | What the cloud allows | Full: operating system, drivers and settings |
What can the cloud layer see?
The hypervisor sits above your virtual machine and controls it completely. That is how a cloud runs many machines on one server. It also means that, technically, it can:
- Read your machine's memory while it runs: model weights, training data and passwords held in memory.
- Take a snapshot of the whole machine, including its memory, and save a copy.
- Move your running machine to another server. Clouds do this for maintenance, and it means copying the memory.
- Copy your disks, because cloud storage runs on the provider's systems, not yours.
This does not mean the cloud is copying your data. The largest clouds design their systems so staff cannot reach customer memory, and have that checked by outside auditors. But the ability exists, so you are trusting their controls. You are also trusting that nobody breaks into that layer. Such attacks are rare, but they have happened.
Can encryption close the gap?
Largely, yes. A feature called confidential computing keeps your data encrypted even while it is being used:
- Encrypted memory on the main processor. AMD (SEV-SNP) and Intel (TDX) processors can encrypt a virtual machine's memory, so the hypervisor sees only scrambled data.
- Encrypted GPU memory. NVIDIA's Hopper GPUs (H100 and H200) and Blackwell GPUs (B200 and B300) can keep GPU memory and the data travelling to the GPU encrypted.
- Proof before you start. The hardware can prove, cryptographically, that it is genuine and unchanged before you load your model. This is called attestation.
The catch: it costs some speed, takes more setup, and is switched off by default on most GPU rentals. If you need it, ask for it by name.
Is bare metal automatically secure?
No. Bare metal removes the hypervisor, so nobody can snapshot your running machine through it. But whoever runs the data centre still controls the hardware:
- The management chip. Every server has a small separate computer for remote management (called the BMC). It has deep access to the server, and the operator controls it.
- Software left by the previous customer. In 2019, security researchers showed that hidden code placed in a rented bare-metal server's management chip could survive after the customer handed the server back. The next customer inherited it. Operators must reset this firmware between customers.
- Leftover data. If disks are not securely wiped between customers, your data can reach the next one, or theirs can reach you.
- Shared storage. If you keep data on the provider's network storage, it can be copied just as in a cloud.
- Physical access. Anyone who can touch the server has ways in that no software fully blocks.
Who can see your data: the comparison
Risk | Standard cloud GPU | Bare-metal server | Cloud GPU with encrypted computing |
|---|---|---|---|
Provider staff copying memory or disks | Possible; limited by the provider's controls | Harder; possible with physical access | Largely blocked |
Another customer on the same hardware | Shared hardware, a small risk | None; the server is yours alone | Shared hardware, but walled off |
Hidden code left by a previous customer | Low | Real, unless the operator resets the server properly | Low; the hardware is checked before use |
Speed | A small cost from the cloud layer | Full speed | Some extra cost from encryption |
Your own mistakes: leaked passwords, open storage | The biggest risk | The biggest risk | The biggest risk |
That last row matters most. Most real breaches start with a leaked password or key, or storage left open to the internet, not with an attack on the cloud layer. Good habits protect you in every setup.
Questions to ask before you rent
Whichever setup you choose, get written answers to these:
- Is the server used only by us, or shared with other customers?
- What happens to the server between customers? Do you reset the firmware and the management chip, and securely wipe the disks? Can you give us a wipe certificate?
- Is the management chip on a private network, never reachable from the internet? Who can log in to it?
- Can we hold our own encryption keys for disks and storage?
- Do you offer confidential computing on these GPUs, if we need it?
- Which security certifications does the data centre hold, such as ISO 27001 or SOC 2? Who can physically reach the servers?
- Which country is the hardware in, and whose laws apply to it?
For the wider list, covering contracts, support and pricing as well as security, see our questions to ask a GPU provider before you sign.
Which should you choose?
If this sounds like you | A sensible choice |
|---|---|
You train or run a valuable model of your own and want full control and full speed | Dedicated bare metal, from an operator who answers the questions above in writing |
You handle regulated data (health, finance, personal data) and must prove who can see it | Encrypted computing with attestation, on bare metal or in the cloud |
You run short tests or occasional jobs on public models and public data | A standard cloud GPU is usually fine |
Your model is worth more than the hardware it runs on | Bare metal plus encrypted computing, and strict control of who holds the keys |
How FlexiCloud helps
We source dedicated bare-metal GPU servers from more than ten partner providers in India, the EU and the US. Each server is yours alone, with full control of the operating system and drivers. Before you sign, we get the operator's answers to the questions above in writing, so you can judge for yourself. If you need encrypted computing, tell us and we will find a partner that offers it.
See our B300 and B200 pages for what is available. Wondering why we work through partners? Read why rent GPUs through FlexiCloud. Or talk to us about what you are building.