Meet us at GTC Berlin, October 20 to 22

After Hours
Book a meeting
protopia logo

Neoclouds and Sovereign Clouds

Serve your next hundred customers on GPUs you already own

Stained Glass Transform (SGT): the inference privacy layer for Sovereign Token Factories.

Get Started How SGT Works →

Annual revenue on the same 128 GPUs

$5.6M

$10.1M

+$4.5M

Without SGT

Dedicated nodes, rented

With SGT

Serverless, pay-per-token

Illustrative: 128 NVIDIA B200 GPUs, gross revenue a year.

Unused GPU Capacity

Earn on GPUs beyond the anchor tenant

Stained Glass Transform converts prompts and context into protected representations, meaning no plaintext lands on your system. Customers get full data sovereignty, and operators can monetize excess capacity as pay-per-token serverless inference.

Same 128 GPUs, two ways to sell them. Dedicated boxes: 16 customers on one 8-GPU box each, about 38 GPUs of real work and about 90 booked and idle. Serverless pool with SGT: the same 16 customers' load in about 40 GPUs, about 88 free to sell by the token to the next 100+ customers. Same 128 GPUs, two ways to sell them. Dedicated boxes: 16 customers on one 8-GPU box each, about 38 GPUs of real work and about 90 booked and idle. Serverless pool with SGT: the same 16 customers' load in about 40 GPUs, about 88 free to sell by the token to the next 100+ customers.

Dedicated Capacity

What dedicated GPU capacity costs a token factory.

Supply

Every customer on dedicated capacity takes at least a whole node. The nodes run out quickly while the GPUs sit idle, and the next customer hears "no capacity."

Revenue

Idle GPUs leave money on the table. Dedicated endpoints bill by the hour whether requests arrive or not. Every idle cycle on a dedicated GPU is a token you could have sold and never will.

Trust

Dedicated does not mean protected. Your stack still handles plaintext in transit, at rest and in compute: logs, traces, metadata, host and GPU memory. That’s why customers keep their most sensitive work off your platform.

For Neoclouds

Why build Stained Glass Transform into your token factory

Expedite security reviews for highly regulated customers.

On dedicated and serverless endpoints alike, your stack receives protected representations, not plaintext, which customers can inspect.

Unlock serverless for more customer workflows.

Any request can land on any GPU, so idle time becomes sellable time. Bill the SGT-enabled endpoint by the token like any catalog item and monetize every cycle.

Add SGT early and the share you must dedicate stays small as you grow.

Customers who still want dedicated endpoints bring the workflows they kept at home onto them, because their plaintext is never on your stack.

How It Works

Sovereign isn't a location, it's who controls the data.

Your customers own their plaintext. You serve their tokens.

Regulated customers, a bank or insurer, a hospital, a public body and a neo-ISV, send plaintext to Protopia AI Stained Glass Transform. Your serving stack, its model endpoints, logs, traces, metadata, and host and GPU memory, receives protected representations only. Regulated customers, a bank or insurer, a hospital, a public body and a neo-ISV, send plaintext to Protopia AI Stained Glass Transform. Your serving stack, its model endpoints, logs, traces, metadata, and host and GPU memory, receives protected representations only.

Plaintext, video, and images are transformed by SGT. Your serving stack receives protected representations, on dedicated and serverless endpoints alike.

Created per target model.

The model is not retrained or modified; the transform is what is trained. The unchanged model reads its output directly on vLLM or NIM. Transforms exist today for NVIDIA Nemotron 3 and Llama 3.3 70B among others.

Runs where the data owner wants it, with no code changes.

As a container in the customer's environment, or as the entry point of your token factory with an API the customer can call to see the transform's output; the client still talks to an OpenAI-compatible endpoint.

Costs the request a few percent, keeps the answers.

The transform runs once per generation call. Output quality lands within a few points of the raw model, some benchmarks at parity.

Complements encryption, masking and redaction.

Mask or redact what policy requires; the model still has to reason over what remains, and encryption ends where the AI factory begins. SGT protects that context in transit, at rest and in compute, with no key and no inversion step. Compatible with, but not dependent on, Confidential Computing.

Partners

Part of a best-in-class sovereign token factory stack

Read more

Protopia and Rafay logos

Rafay blog · July 2026

Private Token Factories: How Rafay and Protopia AI Let Sensitive Workloads Run on Shared GPU Capacity

 Eiman Ebrahimi and Haseeb Budhani on theCUBE

Protopia blog · Sept 2026

Rafay Token Factory publishes and meters your SGT-enabled endpoints, and Protopia AI Stained Glass Transform keeps customer plaintext off your stack.

 Isometric illustration of an AI factory

Protopia blog · May 2026

Zero-Trust AI Factories Unlock Sensitive AI Anywhere with Protopia AI Stained Glass Transform and NVIDIA Confidential Containers

Next Step

Stand up your own Sovereign Token Factory.

Protopia AI provides the container and a transform for an evaluation period. Launch the model you already serve, route requests through the transform, inspect what reaches the endpoint, run your own benchmarks. Then price the SGT-enabled endpoint onto your catalog.

Get Started with SGT

Business Case

Get the Sovereign Token Factories brief

Common Questions

Sovereign Token Factories FAQ

Does this replace data residency?

No. Where data is stored, and the residency rules that apply to it, still matter. What changes is where AI inference can run and who can see the data while it is processed: your stack receives protected representations, not plaintext.

What changes in my stack?

One component is added in front of your endpoints: the transform, running as a container in your customer’s environment or as the entry point of your token factory. Your models are not retrained or modified, and they read the transform’s output directly on vLLM or NIM. Clients keep calling an OpenAI-compatible endpoint with no code changes.

Which models can it run?

A transform is created per target model; the model is not retrained or modified. Transforms exist today for NVIDIA Nemotron 3 and Llama 3.3 70B among others.