Strategic PartnersIssue 022 records
VAST Data
State and higher education: the Massachusetts AI Hub's state-funded AICR cluster runs on about 14.3 PiB of VAST all-flash storage with encryption at rest, but its operator documents snapshot-only protection, no off-site backups and Beta status, with no published performance outcomes. Health and human services: a VAST blog maps encryption, retention locks, WORM and immutable snapshots to HIPAA; it is a vendor feature claim, and HHS's Security Rule overhaul is now projected for July 2027. The CSCS independent evaluation remains inaccessible.
- Evidence records
- 2
- Cross-source patterns
- 1
- Evidence classes
- 1 public-sector association guidance1 vendor claim
- Outcomes
- 1 mixed1 emerging
- Source freshness
- 2 recent
- Research completed
- 2026-10-31
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
VAST data-protection outcomes depend on operator configuration and policy, not the platform alone
At the Massachusetts AI Hub's AICR, the operator enabled encryption at rest but relies on snapshots only, with no off-site backups and no snapshots on scratch. VAST's HIPAA guidance likewise shows per-tenant keys, retention locks and immutability are options to configure, and concedes compliance needs policy and training. Interpretation: public buyers should evaluate the configured protection posture and recovery evidence, not the feature list.
Operating questionFor a VAST-based public AI or ePHI data store, which protections are actually enabled, who owns keys and backups, and has recovery been tested?
Supporting evidenceMassachusetts Green High Performance Computing Center (MGHPCC) with Boston University, Harvard, MIT, Northeastern, UMass and Yale; Commonwealth of Massachusetts (Massachusetts AI Hub)VAST Data
Evidence ledger
Full record · every source keeps its link and limitations
Massachusetts AI Hub's state-funded AICR cluster runs on ~14.3 PiB of VAST all-flash storage, with snapshot-only protection and no off-site backups
AICR's system description (page dated October 8, 2026) lists 31 B200 nodes (248 GPUs), 19 RTX PRO 6000 nodes (152 GPUs) and 32 service nodes, with ~14.3 PiB effective VAST all-flash storage rated at 360 GB/s, encryption at rest and GPU Direct Storage over NFS-RDMA on InfiniBand NDR400. Home and work areas have 7-day snapshots; scratch has none and is purged; the operator warns there are no off-site backups. UMass's AICR page (modified October 20, 2026) marks the system Beta, proposal-only with per-project caps, and bars interactive inference.
Why it matters, evidence and limitations
- Why it matters
- Direct state and higher-education relevance: a $31M Commonwealth of Massachusetts grant via the Massachusetts AI Hub, matched by six universities, built a shared AI resource whose data layer is VAST. It is the first U.S. state-funded VAST deployment found by this stream, and shows how a public consortium actually operates the storage: protection, quotas and use limits.
- Evidence and measured results
- Operator documentation from the public-private university/state consortium that runs the system (configuration and policy, not an evaluation), corroborated by the UMass Unity AICR page and MGHPCC's December 2025 announcement of the state grant and hardware providers. The 360 GB/s figure is a stated system rating; no measured application throughput, utilization, baseline or user outcomes are published.
- Limitations and uncertainty
- Documentation can change without notice and is not an independent evaluation. Hardware vendor for compute/service nodes is Dell (covered in the Dell stream); this record concerns only the VAST storage layer. The $31M figure and university match come from MGHPCC's December 2025 post, not the October pages. Interpretation (not source finding): snapshot-only protection is an operator design choice, not a VAST limitation.
VAST blog maps AI OS encryption, retention locks, WORM, VIP isolation and immutable snapshots to HIPAA, while conceding compliance needs policy and training
VAST's October 15, 2026 blog (re-shared on its community site October 27) describes software AES-256 encryption at rest using FIPS 140-3 validated libraries, internal keys or KMIP external key managers (per-tenant or per-folder keys only with an external EKM), in-flight encryption for NFS, SMB, S3 and replication, retention locks and WORM, VIP-based client isolation with LDAP/ABAC, and immutable snapshots. It states compliance requires training, policies and technology, yet closes by saying healthcare IT on VAST is compliant.
Why it matters, evidence and limitations
- Why it matters
- Relevant to state HHS agencies, public hospitals and university medical research that hold ePHI and are piloting AI on large datasets. It is a vendor feature mapping, not an assessment, attestation or deployment report.
- Evidence and measured results
- Vendor blog (vendor claim). It is a refresh of a 2024 VAST post; the visible change is FIPS 140-2 to FIPS 140-3 validated libraries. No customer, audit, certification, or third-party assessment is cited. Independent regulatory context (Davis Wright Tremaine, July 8, 2026): HHS moved final HIPAA Security Rule amendments from May 2026 to July 2027 and to long-term actions, so the current Security Rule still governs.
- Limitations and uncertainty
- Single vendor source; the concluding 'compliant' statement is a marketing claim not supported by an assessment. No mention of business associate agreements, audit logging or AI-specific data flows. Interpretation: SLED buyers should treat this as a feature checklist to verify, not evidence of compliance.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Public-sector association guidance
- Practitioner guidance or an association-supplied case; not independent outcome evidence.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.