Data Locality
Gallium is a cloud-managed platform: your virtual machines run on your own hypervisor hardware, and you manage them from the Gallium Console in the cloud. For a security review, the short answer is this. Gallium holds no copy of the data inside your virtual machines. It does hold the metadata that describes your infrastructure, the audit logs of what was done to it, and any templates you store.
How Gallium Is Architected
Gallium has two parts:
- The control plane: the Gallium Console and its API, in the cloud. This is where you sign in, see your infrastructure, and issue management actions.
- The data plane: your hypervisor hardware (Edge, Standalone, or Cluster), running on your own servers. This is where your virtual machines run and where their data lives.
Your hypervisor connects out to the Console over an encrypted (TLS 1.3) link that it establishes itself. There are no inbound VPN tunnels or open firewall ports. Because the host dials out, Gallium can manage it from anywhere without direct access into your network.
What the Gallium Cloud Holds
The cloud holds the records that describe and govern your infrastructure, not its contents.
| Data | Includes |
|---|---|
| Infrastructure metadata | Names, descriptions, and specifications for virtual machines, hypervisors, clusters, and deployments, plus status, hardware inventory, capacity, OS version, network addresses, and network and storage configuration |
| Identity and access | Organizations, users, roles, authentication and MFA, single sign-on configuration, and SSH public keys |
| Audit and activity logs | The record of actions taken against your infrastructure, including support access activity |
| Telemetry | Utilization and usage metrics, stored as time series |
| Alerting | Alert profiles, alert rules, and incident history |
| Templates | Virtual machine and tool templates, held in the region you choose |
| Backup schedules and status | When a backup runs and whether it succeeded, never its contents |
Templates are the one kind of content Gallium stores for you, so that you can deploy them to any of your hypervisors. They are held in the region you choose, giving you control over where that data resides.
What Stays on Your Hypervisor
Everything your workloads produce and consume stays on hardware you control.
| Data | Notes |
|---|---|
| Virtual disk contents | Everything written inside your virtual machines, never copied to the cloud |
| Memory and running state | Present only on the host |
| Guest operating systems and applications | Including anything installed in the guest |
| Cloud-init and Windows configuration drive data | Encrypted in transit and stored only on the hypervisor |
| Storage Pool data | On your local disks |
| Backup data | Written to a backup target you control |
| Files moved with the File Transfer Manager | Transferred peer-to-peer between your browser and the host |
What Passes Through the Cloud but Is Not Stored
When you open a virtual machine’s console, the screen output and your keystrokes are relayed through Gallium in real time, using single-use, short-lived tokens. The session passes through so you can interact with the machine. It is not recorded.