Data sovereignty
Cost management that stays in Europe
For teams working under GDPR, NIS2 or DORA. Keep every snapshot, billing row and report in the EU region, with your billing exports read in place in your own accounts.
Workspace data residency
EU region| Data | Location | Retention |
|---|---|---|
| Cluster snapshots | EU region | 14 days |
| Pod usage samples | EU region | 30 days |
| Billing rows | EU region | 90 days |
| Allocated costs and reports | EU region | Life of the workspace |
| AI gateway request metadata | EU region | 90 days by default |
| Prompt and response bodies | Not logged | Unless logging is on for a route |
| Cached responses | EU region | Until the route's cache TTL ends |
On first connect, UnitVane reads 180 days of billing history and allocates it. The raw rows leave the hub after 90 days; the allocated costs stay for the life of the workspace.
Controls you keep
Three ways your data stays where it belongs
UnitVane runs every product for you. These are the residency controls you set.
EU region
Choose the EU region for your organization. Snapshots are ingested there, and billing rows and reports are stored there. KubeOn runs in the EU region.
Fits: Every team that needs EU residency, without operating anything.
Billing exports read in place
Your exports stay in your own accounts. UnitVane reads them through identities that cannot change them, and keeps only the cost data it needs.
Fits: Teams whose source billing data must remain in their own accounts.
EU-only AI routes
A gateway route's residency setting holds every target, fallback included, to EU providers and regions.
Fits: AI programs processing prompts under GDPR.
Data minimization
Cost data, not your customers' data
To allocate cost, the agent and hub need infrastructure metadata and billing lines, and nothing else. The AI gateway handles prompts, so it is covered separately below.
Collected
- Node names, instance types, capacity and zones
- Namespace, workload and pod names, labels and owners
- CPU and memory requests and measured usage
- Volume sizes, classes and status
- Billing line items: cost, usage type, resource ID
Never collected by the agent or hub
- Secrets, ConfigMaps or environment variables
- Container images, logs or application data
- Request payloads or network packet contents from your clusters
- Credentials of any kind from your clusters
- Personal data about your customers, unless gateway prompts you choose to log contain it
Any cloud, any data center
Not only the hyperscalers
The agent runs on any Kubernetes. Where there is no AWS, Azure or Google Cloud bill, KubeOn prices the cluster from the source you have.
Your own data centers
OpenShift, Rancher, Tanzu, k3s or kubeadm, priced with a rate card or amortized hardware cost.
Any FOCUS 1.x file
Clusters at other providers are priced from a FOCUS billing file and reconciled to it.
One view across all of them
Hyperscaler, regional cloud and on-premises clusters share owners, budgets and reports.
Same read-only agent
get, list and watch only, outbound HTTPS only, on every cluster wherever it runs.
UnitVane AI
Model traffic that stays in the EU
The gateway reads every prompt and response in transit to route it. That is also where you decide which regions they reach and what is kept.
EU-only routes
A route's residency setting limits every target, fallback included, to providers and regions in the EU.
Emails, phones and cards masked
Email addresses, phone numbers and card numbers are masked before a request leaves the gateway. Names and other free text are not detected.
Metadata by default
Tokens, route, latency, cost and status are recorded. Bodies are logged only on routes with logging on, and cached only on routes with the cache on.
Gateway in the EU
Organizations in the EU region are served by the gateway in the EU region.
For your DPO and security team
Everything your review needs, before you install
Bring your security, privacy and procurement teams to the evaluation. We walk through the deployment you choose.
Architecture and data flow
Where each component runs, what it stores and how data moves between them.
Agent and billing permissions, published
The agent's ClusterRole and each cloud billing role, so your team can check them before install.
Your questionnaire, answered
Answers to your security questionnaire, provided during the evaluation.
An audit log of every decision
Mappings, policies, integrations and proposal decisions, with who made them and when.
FAQ
Questions European teams ask first
See KubeOn on your clusters, in the EU.
A 30-minute walkthrough on your billing data, with the hub deployed the way your data rules require.