Data Locality
Gallium is a cloud-managed platform: you run your virtual machines on your own hypervisor hardware and manage them from the Gallium Console in the cloud. A natural question for any security review is where your data actually lives. In short, the data inside your virtual machines never leaves your hypervisor, while the Gallium cloud holds the metadata that describes your infrastructure and the templates you choose to store there.
This page sets out exactly what lives where.
How Gallium Is Architected
Gallium has two parts:
- The control plane: the Gallium Console and its API, in the cloud. This is where you sign in, see your infrastructure, and issue management actions. It stores metadata, configuration, and your templates.
- The data plane: your hypervisor hardware (Edge, Standalone, or Cluster), running on your own servers. This is where your virtual machines run and where their data lives.
Your hypervisor connects out to the Console over an encrypted (TLS 1.3) link that it establishes itself. There are no inbound VPN tunnels or open firewall ports. Because the host dials out, Gallium can manage it from anywhere without direct access into your network.
What Lives Where
| Data | Gallium Cloud | Your Hypervisor |
|---|---|---|
| Virtual machine and tool templates (stored in your chosen region) | ✓ | |
| Virtual machine metadata (names, descriptions, and specs) | ✓ | |
| Organizations, users, roles, and authentication (including MFA) | ✓ | |
| Single sign-on configuration | ✓ | |
| Hypervisor, cluster, and deployment metadata (status, hardware inventory, capacity, OS version, network addresses) | ✓ | |
| Network configuration (bridges, VLANs, NAT, MTU) | ✓ | |
| Storage Pool configuration and disk inventory | ✓ | |
| Monitoring telemetry (utilization metrics, stored as time-series) | ✓ | |
| Alert profiles, alert rules, and incident history | ✓ | |
| Support PIN and activity log | ✓ | |
| SSH public keys | ✓ | |
| Backup schedules and status (not backup contents) | ✓ | |
| Running virtual machines (the compute itself) | ✓ | |
| Virtual machine disk data (the contents of your virtual disks) | ✓ | |
| Virtual machine memory and running state | ✓ | |
| Cloud-init and Windows configuration drive data | ✓ | |
| Guest operating systems and applications | ✓ | |
| Storage Pool data, on your local disks | ✓ | |
| Backup data (written to a target you control) | ✓ | |
| Files sent through the Console file manager (peer-to-peer to the host) | ✓ |
Your Virtual Machine Data Stays on Your Hypervisor
The data inside your virtual machines, everything written to a virtual disk, only ever exists on your hypervisor. It is never copied to or stored in the Gallium cloud.
The same applies to the sensitive data used to provision a machine: cloud-init and Windows configuration drive data are encrypted in transit and are only ever stored on your hypervisor, never in the cloud.
Templates and Regional Storage
Virtual machine and tool templates are stored in the Gallium cloud so you can deploy them to any of your hypervisors. Templates are held in the region you choose, giving you control over where that data resides.
What Passes Through the Cloud but Isn't Stored
When you open a virtual machine's console, the screen output and your keystrokes are relayed through Gallium's connection brokers in real time, using single-use, short-lived tokens. The session passes through so you can interact with the machine; it is not recorded.