Data sovereignty
Kubernetes cost management that stays in Europe
For teams working under GDPR, NIS2 or DORA. Keep every snapshot, billing row and report in the EU region of KubeOn Cloud, in your own cloud account, or in a data center with no internet egress.
Workspace data residency
EU region| Data | Location | Retention |
|---|---|---|
| Cluster snapshots | EU region | Deleted after 14 days |
| Billing rows | EU region | 90 days by default |
| Allocated costs and reports | EU region | Life of the workspace |
| AI gateway request metadata | EU region | 90 days by default |
| Prompts and responses | Not stored | Unless logging is on for a route |
Choose your level
Three ways to keep control of your data
The agent and the product are the same in all three. What changes is who runs the hub and where its data and keys live.
KubeOn Cloud, EU region
We run the hub in the EU. Snapshots are ingested there, and billing rows and reports are stored there.
Fits: Teams that want EU residency without operating anything.
Self-hosted in your EU account
The hub runs in your own cloud account and region. Billing is queried in place and snapshots land in your bucket.
Fits: Teams whose billing data may not leave their own account.
Air-gapped in your data center
The hub runs on OpenShift, Rancher, Tanzu or kubeadm, with images from your registry and no internet egress.
Fits: Regulated networks, public sector and critical infrastructure.
| Hub option | KubeOn Cloud, EU | Self-hosted | Air-gapped |
|---|---|---|---|
| Who runs the hub | KubeOn | You | You |
| Where billing data is stored | KubeOn Cloud, EU region | Your account, your region | Your network |
| Snapshot destination | HTTPS ingest in the EU | Your bucket | S3-compatible store or HTTPS |
| Encryption keys | KubeOn-managed | Your KMS key | Your KMS or HSM |
| Billing data and snapshots | Stored by KubeOn in the EU | Never leave your account | Never leave your network |
| Internet egress required | Included | For billing APIs | Not included |
Data minimization
Cost data, not your customers' data
KubeOn needs infrastructure metadata and billing lines to allocate cost. It is built so that it never needs anything else.
Collected
- Node names, instance types, capacity and zones
- Namespace, workload and pod names, labels and owners
- CPU and memory requests and measured usage
- Volume sizes, classes and status
- Billing line items: cost, usage type, resource ID
Never collected
- Secrets, ConfigMaps or environment variables
- Container images, logs or application data
- Request payloads or network packet contents
- Credentials of any kind from your clusters
- Personal data about your customers
Any cloud, any data center
Not only the hyperscalers
The agent runs on any Kubernetes. Where there is no AWS, Azure or Google Cloud bill, KubeOn prices the cluster from the source you have.
Your own data centers
OpenShift, Rancher, Tanzu, k3s or kubeadm, priced with a rate card or amortized hardware cost.
Any FOCUS 1.x file
Clusters at other providers are priced from a FOCUS billing file and reconciled to it.
One view across all of them
Hyperscaler, regional cloud and on-premises clusters share owners, budgets and reports.
Same read-only agent
get, list and watch only, outbound HTTPS only, on every cluster wherever it runs.
KubeOn AI
Model traffic that stays in the EU
The gateway sits in the path of your prompts, so it can enforce where they go and what is kept.
EU-only routes
A route's residency setting limits its targets to providers and regions in the EU.
PII masked first
Email addresses, phone numbers and card numbers are masked before a request leaves the gateway.
Metadata by default
Tokens, route, latency, cost and status are recorded. Prompt and response bodies are not.
Gateway in your cluster
Run the same gateway on your own Kubernetes with Helm to keep model traffic in your network.
For your DPO and security team
Everything your review needs, before you install
Bring your security, privacy and procurement teams to the evaluation. We walk through the deployment you choose.
Architecture and data flow
Where each component runs, what it stores and how data moves between them, for your deployment.
Every permission, published
The agent's ClusterRole and each cloud billing role, so your team can check them before install.
Your questionnaire, answered
Answers to your security questionnaire, provided during the evaluation.
An audit log of every decision
Mappings, policies, integrations and proposal decisions, with who made them and when.
FAQ
Questions European teams ask first
Yes. Choose the EU region for a KubeOn Cloud workspace, and snapshots are ingested there and billing rows and reports are stored there. To keep data in your own account, self-host the hub in the EU region of your cloud. For networks with no internet egress, run the hub in your data center.
See KubeOn on your clusters, in the EU.
A 30-minute walkthrough on your billing data, with the hub deployed the way your data rules require.