Alternate Clouds · Briefing for municipal government
AI infrastructure your residents' data never has to leave
Hardware-enforced isolation, controlled data routing, and a cost structure that does not charge you a premium for being a government. Prepared for city leadership in the State of Georgia.
What the status quo costs
Local government is now the most expensive place in the economy to have a bad security day. Not because attacks are more sophisticated here, but because the recovery is slower, the services are essential, and the budget was never sized for it.
Sources: Atlanta · Baltimore · Dallas · Columbus · figures as reported at the time of each incident
The trend line is going the wrong way for you specifically
- Public sector was the only sector where average breach cost rose in the 2025 IBM study — up 10.8% to $2.86M, while the global average fell 9%. (IBM Cost of a Data Breach 2025)
- State and local government paid the highest median ransom of any sector: $2.5M in 2025. Across all sectors, average recovery cost excluding ransom was $1.53M. (Sophos State of Ransomware 2025)
- Breaches take an average of 241 days to identify and contain — and those running past 200 days cost $5.49M versus $3.61M. (IBM Cost of a Data Breach 2025)
- In the first half of 2026 there were 187 government ransomware attacks worldwide — roughly one per day, 58 of them in the United States. (Comparitech, H1 2026)
- Cyber insurance repriced sharply — Horry County, South Carolina saw premiums rise 300% to $210,000 in 2022, and carriers now impose MFA, tested backups, and training as conditions of coverage. (Cybersecurity Dive)
No infrastructure vendor can promise you will not be attacked, and we will not make that claim. What infrastructure can change is the blast radius: how much data is reachable from any one compromise, whether an AI workload can quietly ship resident records to a third party, and how fast you can prove to auditors and residents what was and was not exposed. That is what the rest of this document is about.
How we contain it
Three layers, each of which limits what the layer above it can reach.
Hardware-enforced isolation Available today
Workloads run inside confidential virtual machines built on Intel TDX. Memory is encrypted by the processor itself, so the host operating system, the hypervisor, and anyone else on that machine cannot read it. That includes us and it includes Phala Cloud, whose TEE hosts we deploy onto — neither of us can read enclave memory. Each deployment can produce a remote attestation report: a cryptographic statement, signed by a hardware root of trust, identifying exactly which code image was loaded into the enclave.
For an audit, that is the difference between "the vendor says the right software was running" and a signed hardware measurement you can verify independently.
Secure data filtering and routing On the roadmap
The failure mode we see most in government AI pilots is not a breach — it is a well-meaning department pasting resident records into a consumer AI service. Our AI gateway is designed to put a policy boundary in front of every model call: classify and redact sensitive fields (PII, PHI, criminal justice information) before a request leaves your boundary, route by classification so that regulated categories are pinned to enclave-backed or in-jurisdiction models and never reach a public endpoint, and log every decision as an auditable record.
The gateway and metering exist today across eleven model providers; the classification and routing policy layer is in development, and we would want a launch customer shaping it.
Knowing exactly where your data sits Available today
Every confidential deployment reports the specific TEE host and geographic region it landed on — recorded, surfaced in your dashboard, and available for audit. That is a stronger evidentiary position than a region label, because it identifies the actual machine.
We will be precise about the limit: on our confidential-compute provider today, we can report placement but not yet choose it — the provider allocates the host. Contractual placement control is roadmap work, and if guaranteed in-state or in-region residency is a hard requirement for your workload, tell us and we will scope it honestly rather than imply we have it. What is true today is that there is no architectural requirement for resident data to transit a hyperscaler.
Attestation proves identity: that genuine silicon is running firmware at a stated version, and that the image loaded hashes to a stated measurement. It does not prove that code is correct, bug-free, or well-behaved at runtime. And it is not a defense against an adversary with physical access to the host: the TEE.Fail research disclosed on 28 October 2025 used a DDR5 memory interposer costing under $1,000 to extract attestation signing keys from fully patched Intel TDX and AMD SEV-SNP systems — which means forged attestation reports are possible for an attacker who can get hands on the hardware. We would rather you hear the strong version of that from us than the weak version from a competitor.
Standards, stated precisely
Compliance language is routinely abused in this market, so here is the vocabulary we hold ourselves to. A certification is issued by an accredited body after audit. An attestation is an independent assessor's report. An authorization is a government body accepting risk and granting permission to operate. A self-assessment is a vendor's own assertion. They are not interchangeable, and we will not present one as another.
| Framework | What it actually is | Where we stand |
|---|---|---|
| Intel TDX enclaves | Hardware capability protecting data in use; supports NIST SC-39 process isolation and argues toward SC-28(1) | Live in production |
| GovRAMP formerly StateRAMP, rebranded Feb 2025 | Government authorization. The State of Georgia is a participating government; no Georgia city or county is currently listed | Our primary authorization target |
| SOC 2 Type II | Independent assessor attestation | Underway, targeted for late 2026 |
| ISO/IEC 27001 | Certifiable ISMS standard, 3-year cycle | Roadmap; architecture built to its control set |
| ISO/IEC 27017 & 27018 | Codes of practice — scoped into a 27001 audit, never certified standalone | To be scoped into the 27001 program |
| ISO/IEC 42001 | The first and, today, the only certifiable AI management system standard | Roadmap — the credential we think matters most for AI procurement |
| CJIS Security Policy v6.0 | No such thing as "CJIS certified" — compliance runs through your state CJIS Systems Agency — in Georgia, the GBI's Georgia Crime Information Center | Architecture maps to it; agreement executed per agency |
| NIST SP 800-53 Rev 5 · AI RMF | Control catalog and voluntary risk framework — neither is certifiable | Used as our internal control and AI-risk baseline |
| IRS Publication 1075 | Federal tax information — requires a FedRAMP-authorized provider at Moderate or above | Not yet eligible. If your workload touches FTI, we will tell you so and stay out of it. |
Two Georgia-specific notes. The Georgia Technology Authority builds its security standards on the NIST Risk Management Framework, NIST CSF, and CIS 18 — binding on state agencies and available to municipalities as guidance and shared services. And the State of Georgia is a participating GovRAMP government, which is why GovRAMP authorization is our first compliance investment rather than FedRAMP — though we would note that GovRAMP participation is currently at state level, and municipal procurement here generally is not yet gated on it.
GTA administers Georgia's share of the federal State and Local Cybersecurity Grant Program, under which at least 80% of funds must benefit local governments and at least 25% must reach rural areas. Two caveats your grants officer will already know: the program's original appropriation ran through FY2025 and reauthorization is pending in Congress, and the local match rate rose across the program's life to 40% in FY2025. Worth confirming the current cycle before building a budget around it.
Separately, UGA's CyberArch program (Carl Vinson Institute of Government) provides no-cost cybersecurity assessments to Georgia local governments — a useful independent baseline before any procurement.
What you are paying for the government label
Government cloud regions charge a premium over the identical commercial service. That premium is real, and it is not evenly distributed: compute runs roughly 26% higher, but storage and egress — the two lines that grow every year in a city — run up to 72% higher. All figures below are AWS list prices, pulled from the AWS Price List API on July 28, 2026, comparing us-gov-west-1 against us-east-1. Azure Government prices at a near-identical +26% on Linux compute, which suggests this is a market-wide compliance premium rather than one vendor's policy.
| Line item | Commercial | Government region | Premium |
|---|---|---|---|
| General-purpose compute, per hour m5.large, Linux on-demand | $0.096 | $0.121 | +26% |
| Object storage, per GB-month S3 Standard, first 50 TB | $0.023 | $0.039 | +70% |
| Outbound data transfer, per GB first 10 TB to internet | $0.090 | $0.155 | +72% |
| Free egress allowance per month | 100 GB | none | billed from byte one |
| H100 GPU, per GPU-hour p5.48xlarge, 8× H100 | $6.88 | $8.26 | +20% |
The same workload on Alternate Clouds
| Line item | AWS GovCloud | Alternate Clouds |
|---|---|---|
| Confidential VM (Intel TDX), per hour tdx.small through tdx.xlarge | no confidential-VM equivalent | $0.07 – $0.58 |
| Confidential GPU, per hour NVIDIA H200, TEE-backed | not offered | quoted at proposal |
| Egress on compute | $0.155/GB | no surcharge |
| Egress on object storage | $0.155/GB | provider cost, passed through |
Two numbers to take to your budget conversation
- A city of roughly 150,000 moving 20 TB per month outbound — body-worn camera footage, GIS tiles, public records portals — pays about $33,200 a year in GovCloud egress alone, against roughly $21,500 on commercial rates. That is a line item purchased entirely from the compliance label, not from capability.
- Migrating 500 TB out of AWS GovCloud costs approximately $38,800 in egress fees before a single hour of engineering — computed across the published GovCloud tiers. That is the price of changing your mind, and it is worth knowing before you commit.
Two things to be straight about. Our confidential GPU offering is NVIDIA H200 today — H100-class confidential instances are not yet live on our platform, so we have not printed a headline GPU number we cannot honor; you will get a firm quote at proposal. And on compliance: we are not FedRAMP or GovRAMP authorized today. For workloads that require an authorized provider — anything touching federal tax information, and whatever your CJIS Systems Agency agreement specifies — that authorization is the binding constraint and no discount overcomes it. What we would propose is starting where it does not: internal document processing, permitting and licensing workflows, 311 and constituent services, GIS and public records. Those are real budget lines, and they are where a pilot can prove itself without putting a compliance obligation at risk.
What we would propose
A scoped pilot on one workload that does not carry a CJIS or FTI obligation, run against your existing cost baseline so the comparison is yours rather than ours. We would bring the enclave deployment and attestation verification; we would want your team's requirements shaping the data filtering and routing policy layer while it is still being built. If a GTA cyber assessment or grant cycle is in your calendar, that is a natural place to anchor the timing.
If it does not save money against your own numbers, there is no reason for you to proceed, and we would rather establish that in six weeks than six quarters.
Continue the conversationAngela Steffens, Co-founder & CEO · angela@alternatefutures.ai