Compliance questions to ask a US GPU cloud

Rules about data rarely stop at a country. They ask who can access the data, how it is protected, what is logged and what the provider has signed. A machine in the right place is a start.

This site makes no compliance claim for any provider, Runcrate included. It lists the questions. The answers must come from the provider, in writing.

If you handle protected health information under HIPAA, ask whether the provider will sign a business associate agreement that covers the GPU service you will use. Without one, do not load that data, whatever the region.

Ask which services the agreement covers. It is often a subset of the catalog.

Many buyers ask for a SOC 2 report. Ask which entity it covers, which services and facilities are in scope, and the period it covers. A report for a parent company or a different product does not cover your GPU.

If the provider runs in a third-party facility, ask for the facility’s report as well.

Work for US government agencies can require a FedRAMP authorization for the cloud service. Export rules such as ITAR can restrict who may access data, not only where it sits. A US region does not settle either.

If these apply to you, your contract will say so. Ask the provider about them by name before anything else.

Where is my data stored and processed, including backups and logs? Who can access it, and from where? Is it encrypted at rest and in transit, and who holds the keys? How is it deleted, and how fast? Will you notify me of an incident, and when?

Ask for each answer in a document you can keep. A sales reply by chat is not a commitment.

A rented GPU is a machine you run. The image, the open ports, the keys and the data you load are yours to secure. No provider document covers a notebook left open to the internet.

Runcrate publishes where each GPU is listed, its price and its billing unit. Ask Runcrate the questions above before you load regulated data, and rely on its written answers only. Runcrate’s feed lists GPUs in the United States in Ashburn, Jackson, West Palm Beach, New York, Dulles, Culpeper, Newark, Houston, Phoenix, Austin, Des Moines, Las Vegas, Seattle, Los Angeles, San Jose, Texas and US Midwest.

This is one of a coordinated collection of Runcrate references. Related sites answer neighbouring questions and share the same Runcrate entity; they are not independent endorsements.