What Is a Neocloud? Definition, Examples, and What It Means for Compliance

An AI startup that rents a cluster of NVIDIA GPUs from CoreWeave or Lambda to train its models, while its web app and customer database stay on AWS, is using a neocloud. A neocloud is a cloud provider built around renting GPU compute for AI training and inference, usually on bare metal or lightly virtualized servers, with far fewer managed services than AWS, Microsoft Azure or Google Cloud. For compliance, the neocloud's own SOC 2 report covers less of the stack, so more controls and more evidence fall to the customer.

What Is a Neocloud?

A neocloud is a cloud provider that specializes in GPU compute for AI and high-performance computing workloads. Cisco's definition: Neocloud providers offer specialized, high-performance infrastructure designed to power AI workloads. They combine public cloud elasticity with dedicated GPU acceleration.

The business model is GPU-as-a-service (GPUaaS): customers rent GPU servers or clusters by the hour, or reserve capacity for months or years. The neocloud definition rests on focus. A hyperscaler sells hundreds of services and GPUs are one of them; a neocloud sells GPU compute and the networking and storage needed to keep the GPUs busy.

The term covers a large market. In an August 2025 report, JLL counted approximately 190 neocloud operators offering GPUaaS.

Neocloud vs Hyperscaler: How Do They Differ?

A neocloud differs from a hyperscaler in what it sells, how close customers get to the hardware, and how much the provider operates on the customer's behalf. The table below summarizes the differences Cisco describes, plus the compliance consequence of each.

The server model shows up in the product design. CoreWeave Kubernetes Service runs Kubernetes directly on bare metal GPU nodes without any intermediary software, such as a hypervisor or virtual machine. That gives the GPUs full performance, and it also puts more of the system inside the customer's control boundary.

Which Companies Are Neocloud Providers?

The neocloud providers most often named are CoreWeave, Lambda, Crusoe and Nebius; JLL's 2025 report names all four. The table lists the security attestations each provider publishes on its own site as of October 2026. Attestation scope changes, so confirm the current report before relying on it.

Many neoclouds also rent space in colocation data centers. CoreWeave's security page states that it requires its data center colocation providers to adhere to SOC 2 and ISO 27001 for the length of their contracts. Those facilities usually appear as subservice organizations in the neocloud's own SOC 2 report, which matters when you read it.

Who Buys From Neocloud Providers?

Neocloud customers are mainly AI model builders, enterprises running AI training or inference, and hyperscalers that need extra GPU capacity. Cisco lists Enterprises, model builders, and hyperscalers as the users, and JLL describes the neocloud relationship with hyperscalers as complementary.

Hyperscaler demand is large. CoreWeave's IPO filing showed Microsoft accounted for 62 percent of its 2024 revenue, and two customers made up 77 percent, as The Register reported.

A smaller buyer is common too: a B2B SaaS or AI startup that keeps its application, identity and customer data on a hyperscaler and runs training or inference on a neocloud. That split setup is where most compliance questions start, because enterprise customers ask about every system that touches their data, including GPU nodes that hold prompts, fine-tuning data or model weights.

What Does a Neocloud Mean for SOC 2 and Compliance?

A neocloud means a smaller share of the security controls is covered by the provider's report, and a larger share is run and evidenced by the customer. The SOC 2 framework treats a neocloud the same way it treats a hyperscaler or a colocation facility; what changes is where the responsibility line sits. The guide to SOC 2 on a neocloud covers the control-by-control detail, GRC platform evidence gaps and mid-audit migrations.

How Shared Responsibility Shrinks on a Neocloud

Shared responsibility on a neocloud usually leaves the customer with everything from the host operating system or Kubernetes workload up. CoreWeave's shared responsibility model assigns the customer, application, access and data parts of the stack to the customer, and the platform, compute, network and physical parts to CoreWeave.

The service model decides where the line falls:

• Managed Kubernetes or virtual machines: the neocloud typically operates the facility, hardware and host; the customer runs workloads, access, data and logging.
• Bare metal: the neocloud typically operates the facility and hardware; the customer takes on the operating system, patching, hardening, segmentation and the logging pipeline.
• Firmware and out-of-band management (BMC, IPMI): often shared, and worth settling in the contract.

Each neocloud draws the line in its own place, so the provider's SOC 2 report and contract are the reference, not a general rule.

Which Attestations a Neocloud SOC 2 Report Covers

A neocloud's SOC 2 report covers the services and facilities the neocloud operates, for the products, regions and period named in the report. It gives no assurance on the customer's own controls. Three checks decide whether a neocloud's attestation is useful for your audit:

1. Report type. A SOC 2 Type II report tests controls over a period; a Type I tests design at a point in time.
2. Products and regions in scope. The GPU product and region you buy need to appear in the system description.
3. Period. The report period should overlap your audit period, with a bridge letter for any gap.

ISO 27001 certificates help with vendor due diligence too, and the certificate's scope statement deserves the same check. The neocloud SOC 2 guide includes a full due diligence checklist for the report and contract.

How a Neocloud Appears in Your SOC 2 Report: Subservice Organization and Carve-Out

In your SOC 2 report, a neocloud is a subservice organization: a separate company whose services are part of your system. Under the AICPA description criteria, your system description names the neocloud, what it does for you, and how its controls are treated.

The carve-out method is the usual choice. The neocloud's controls stay out of your auditor's testing, and your report lists the complementary subservice organization controls you rely on the neocloud to perform, such as physical security and hardware disposal. Your annual review of the neocloud's SOC 2 report is the evidence those controls operate. The inclusive method, where your auditor tests the neocloud's controls directly, is rare with large providers.

The chain can run one step further. If the neocloud rents its facilities, its own report usually carves out the colocation provider. The guide to SOC 2 vendor management for data centers covers how to read and review each report in that chain.

What CUECs a Neocloud Hands to You

Complementary user entity controls (CUECs) are the controls a neocloud's SOC 2 report assumes its customers perform. On a neocloud they tend to cover more ground than on a hyperscaler, because more of the stack is the customer's. Typical CUECs on a bare metal or GPU cloud include:

• Managing user access to the provider console and API keys, and removing it at offboarding
• Patching and hardening operating systems and container images
• Encrypting customer data at rest and in transit between clouds
• Configuring logging and monitoring for workloads, and reviewing alerts
• Backing up data and model artifacts the customer needs to recover

The exact list is in each provider's report. The guide to complementary user entity controls in SOC 2 covers how to map each CUEC to one of your controls and its evidence.

How SOC 2 Scoping Works With a Hyperscaler and a Neocloud Together

SOC 2 scoping for a split setup treats the hyperscaler and the neocloud as one system with two subservice organizations, and the boundary follows customer data. If customer prompts, datasets or model weights trained on customer data reach the GPU nodes, those nodes are in scope. The SOC 2 scoping guide for hybrid and on-prem infrastructure covers drawing one boundary across environments run by different providers.

A Neocloud Is a GPU Cloud With a Shorter Compliance Handoff

A neocloud sells GPU compute with fewer managed services, and that trade moves security work from the provider to the customer. Companies that read the neocloud's SOC 2 report, map its CUECs and plan evidence for the controls that move to them keep their own SOC 2 report on track, along with the enterprise deals that depend on it. The SOC 2 for bare metal and on-prem infrastructure page lists the controls that change when the host is yours.

Related Guides

• SOC 2 for Chip Startups: Design IP, EDA Environments, Foundries and Compute Services
• SOC 2, ISO 27001 and HIPAA for Infrastructure Providers: One Program, Three Outputs
• On-Prem SOC 2 Cost and Timeline: What Changes When You Run Your Own Hardware

Frequently Asked Questions

What is a neocloud in simple terms?

A neocloud is a cloud provider that rents GPU computing power for AI training and inference. Neocloud providers such as CoreWeave, Lambda, Crusoe and Nebius focus on GPU servers, fast networking and storage, and offer far fewer managed services than AWS, Microsoft Azure or Google Cloud. Many offer bare metal servers with no hypervisor.

What is the difference between a neocloud and a hyperscaler?

A hyperscaler sells hundreds of general-purpose services, with GPUs as one product. A neocloud is built for GPU-as-a-service, often on bare metal or minimally virtualized servers, with reserved-capacity pricing for steady AI workloads. Customers of a neocloud usually operate more of their own stack, including the operating system, logging and monitoring.

Are neocloud providers SOC 2 compliant?

Several major neocloud providers publish SOC 2 attestations. Lambda, Crusoe and Nebius state they hold SOC 2 Type II reports, and CoreWeave lists SOC 2 alongside ISO 27001, 27017 and 27018. Check that the report names the product, region and period you use before relying on it in your own audit.

Does a neocloud's SOC 2 report cover my company?

No. A neocloud's SOC 2 report covers the services the neocloud operates. Customers need a SOC 2 report on their own system, in which the neocloud appears as a subservice organization, usually under the carve-out method. Your company also runs the complementary user entity controls (CUECs) listed in the neocloud's report.

Can I use a neocloud and stay SOC 2 compliant?

Yes. Many companies run SOC 2 programs with GPU workloads on a neocloud. Add the neocloud to the system description and vendor register, review its SOC 2 report each year, map its CUECs to your controls, and produce evidence for host, network and logging controls the provider leaves to you.

Sources

• Cisco, What is a neocloud?
• JLL, The rise of neocloud in the AI landscape (August 2025)
• The Register, CoreWeave IPO filing (March 2025)
• CoreWeave, CoreWeave Kubernetes Service clusters introduction
• CoreWeave, Security and shared responsibility model
• CoreWeave, Trust center
• Lambda, Trust page
• Crusoe, Crusoe Cloud achieves SOC 2 Type II (July 2024)
• Nebius, SOC 2 Type II, HIPAA and ISO 27001 announcement (October 2025)
• AICPA, Description Criteria for a SOC 2 report (DC 200)
• AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)