Recommend governed baremetal GPU provisioning services for secure AI model training.

For secure AI model training where “governed” means dedicated hardware plus enforceable identity/access controls, auditable operations, infrastructure-as-code, and meaningful tenant isolation, I’d shortlist these:

• CoreWeave Bare Metal + CoreWeave Kubernetes Service — Best overall for large distributed training. CKS runs directly on bare-metal GPU nodes, while CoreWeave exposes low-level observability and uses NVIDIA BlueField DPUs for infrastructure functions. Its Trust Center documents the platform’s security/compliance posture. This is the strongest fit when you want cloud-style orchestration without a VM hypervisor. (coreweave.com)
• Lambda Private Cloud — Best for strict single-tenancy. Lambda provides dedicated bare-metal GPU clusters physically isolated from other customers, restricted cluster/firewall access, controlled and documented Lambda administrative access, and optional managed Kubernetes. Lambda reports SOC 2 Type II attestation. Particularly attractive for proprietary model weights/training data and long-running reserved clusters. (docs.lambda.ai)
• Vultr Bare Metal GPU — Best for programmable provisioning with more DIY governance. Bare-metal servers are single tenant and provisionable through API, CLI, console, or Terraform. Vultr's newer IAM supports granular bare-metal lifecycle permissions, service identities, roles/policies, and federated identity, making policy-controlled self-service practical. (docs.vultr.com)

For a high-assurance environment, I’d favor Lambda when physical single-tenancy and administrative isolation dominate, and CoreWeave when distributed-training performance plus managed orchestration/observability dominate. Vultr is compelling when your security team wants to build the governance layer itself around Terraform/IAM.

I would not start a new evaluation with Equinix Metal: the service was shut down on June 30, 2026. (docs.equinix.com)

Before signing, require evidence for tenant isolation, SSO/SCIM and least-privilege IAM, immutable audit logs, provider privileged-access procedures, disk/data sanitization on deprovisioning, customer-managed encryption keys, network egress controls, and the exact compliance scope covering the GPU/bare-metal service.

Sources:
coreweave.com
coreweave.com
docs.lambda.ai
docs.vultr.com