Security

What protects your machine

Every statement on this page describes the machines as they run today. Where a protection is missing, it is listed under known gaps.

How a booking is built

• One machine per booking. It is created in Google Cloud when you pay and deleted, with its disk, when the booking ends. No other customer has used it.
• HTTPS ends on the machine. Each machine gets its own Let's Encrypt certificate for its own address. There is no proxy between you and it, ours or anyone else's.
• Only you can open it. GLM-5.3-Flash answers only requests carrying your booking's API key; ComfyUI opens only with your booking's token.
• Three stops at the end. The booking server deletes the machine when your time ends; the machine also powers itself off five minutes after its own end time; and Google deletes any machine after six hours and 45 minutes, the longest a booking can run plus preparation.
• Nobody logs in. SSH and remote desktop are closed at Google's firewall for every customer machine, and project-wide SSH keys are blocked on them.
• The booking server cannot do more. It runs as a Google service account whose only rights are creating, reading, tagging and deleting machines and setting their end time. It holds no long-lived Google key: it signs a short-lived token that Google exchanges for an hour of access.

Confidential GPU

• Confidential VM. The processor encrypts the machine's memory with AMD SEV, so the host it runs on cannot read it.
• GPU in confidential mode. The RTX PRO 6000 runs in NVIDIA's confidential-computing mode and is set ready before ComfyUI starts.
• What it reports. At start the machine records its GPU, its confidential-computing status and its memory-encryption status, and your booking page shows those lines as reported. A machine booked on Oct 16 reported CC status: ON, Confidential Compute GPUs Ready state: ready and Memory Encryption Features active: AMD SEV.
• Sealed once ready. As soon as it is ready the machine is moved behind a firewall rule that blocks all outbound connections. It still answers you.
• Your files stay in memory. Uploads, results, saved workflows and ComfyUI's log live only in RAM, which SEV encrypts, and go when the machine is deleted.
• A clean image, and only ComfyUI's own code. The machine starts from an image built for customers, with no operator accounts, logins or saved work on it, and ComfyUI runs with every custom node switched off.

GLM-5.3-Flash

Google offers confidential GPUs only as single-GPU machines, and GLM-5.3-Flash needs four, so its machine is a standard virtual machine: private to your booking, but its memory is not encrypted in hardware. Nothing it receives or produces is copied off it, vLLM's usage statistics are turned off, and the machine and its disk are deleted when the booking ends.

What we keep

Your prompts, files, images and outputs go straight to your machine; they never pass through our servers and we do not store them. We keep your account email and name, your bookings (model, machine, zone, times, the machine's address) and your payment records. Details are in the privacy policy.

Known gaps

• No remote attestation yet. You cannot verify the Confidential GPU's state cryptographically from outside; the status lines on your booking page are what the machine reports about itself.
• SEV, not SEV-SNP. Memory is encrypted, but the stronger integrity protections of SEV-SNP are not on.
• You trust the operator. NGG runs the Google Cloud project, so in principle NGG could change a machine's firewall or configuration. We do not, and the settings above are how every machine is created.
• GLM-5.3-Flash is not confidential, as described above.
• Spot capacity. Google can reclaim a machine at short notice; the unused time is refunded.

Report a problem

Write to hello@noahgeneralgroup.com with "security" in the subject. We read every report.