Platform · The dedicated cloud

Proxima

Your own Forge. Run for you.

Proxima is the dedicated cloud for hospitality operations: a single-tenant Forge cell of your own — its own Postgres, its own region, its own jurisdiction — with governed agents and open-weights models served inside the same boundary. The cell is yours; the contract is identical to local.

Proxima Centauri is the nearest star to our sun — a sun of its own, not a shared one. That is the tenancy model in a name: every operation gets its own star — its own database, its own jurisdiction, its own blast radius — never a timeshare in someone else's. The nearest star, run for you.

The architecture, in numbers
1Tenant per dedicated cell
1Jurisdiction per cell
3Postgres instances, quorum sync
2Independent fingerprints per move
100%Writes through governed actions

Read from the architecture, not the brochure — the cell, the control plane, and the relocation protocol are shipped code.

The cellOne tenant · one region · one jurisdiction

A boundary you can point at.

A cell is the whole platform, dedicated: quorum-replicated Postgres, the kernel, the connectors, the console — one operation's world, placed in one region and one jurisdiction, and never anywhere else. Not a namespace in a shared cluster; a boundary with your name on it.

01The data boundaryYour operation's data in its own Postgres — typed tenant isolation and row-level security beneath it, and in a dedicated cell, no other tenant beside it. The blast radius is the cell, and the cell is yours.
02Off the request pathTraffic resolves straight to your cell's own ingress. The management plane is not a front door — it cannot become your outage, your bottleneck, or a residency leak in someone else's region.
03Pull, not pushCells pull their desired state and keep serving through a control-plane outage. Changes arrive as reviewed, versioned rollouts in waves — never a hand on your production.
Residency

A predicate the machine checks.

Every cell carries its region, country, and derived legal zones; your residency requirement — EU-strict, EU-or-adequate, country-specific — is a typed contract the platform evaluates when it places you and re-evaluates before it ever moves you. An unsatisfied contract fails closed: Proxima refuses rather than guesses. Residency is architecture here, not a paragraph in a DPA.

RelocationLive, verified, reversible

Tenants move. Guarantees don't.

Regions change, contracts change, portfolios change hands. Proxima moves an operation between cells as a governed protocol — ordered, verified, and refusing to cut over until the destination has proven it holds your data.

01FreezeThe source quiesces the tenant: reads stay live, writes are politely refused with a retry — a window measured in seconds, not a maintenance weekend.
02VerifyAfter the copy, both cells are fingerprinted independently and compared. Traffic does not move until the two fingerprints agree — the destination proves it holds your data, byte for byte.
03Cut overOwnership flips in a single atomic statement. The old cell then refuses writes for a tenant it no longer owns — a stale DNS answer cannot fork your data.
04Re-serveModel endpoints decommission at the source and recreate at the destination as part of the move itself — pinned to the new cell by construction, not by a runbook.

Any failure before the cutover unwinds cleanly: the source thaws, the move retries, and nothing is half-way.

InferenceOpen weights · in your cell

Your models, inside the boundary.

A model endpoint is a declaration, not a ticket: name the model, size it, and the platform serves it inside your cell — in your jurisdiction, on your boundary — where your agents and applications reach it through the same governed surface as everything else.

# Declare it; the platform serves it — in your cell.
POST /v1/tenants/{tenant}/inference-endpoints
{
  "name": "concierge-llm",
  "model_ref": "hf:meta-llama/Llama-3.3-70B-Instruct",
  "size_class": "medium",
  "replicas": 2
}
no "cell" field

You never pick a cell. The endpoint is pinned to your tenant's cell in the same statement that creates it — residency by construction, not by code review.

ready means serving

An endpoint reports ready only when its rollout has actually converged — health-checked replicas answering, not a job that returned.

moves with you

Relocation tears endpoints down at the source and recreates them at the destination inside the move's own protocol. An endpoint you retired stays retired.

versioned state

Every change bumps a generation, and stale status can never overwrite newer truth. The audit ledger sees every step.

Hosted agents

The agent runtime, run for you.

Proxima hosts Forge Agents inside the cell: Talos and the agents you author in Agent Studio run beside your data, on installation- bound credentials, reaching the platform only through its public contract. Governed autonomy, without the traffic ever leaving your boundary.

The point

Not a hyperscaler.

We don't sell compute by the hour — the clouds beneath us do that well, and Proxima runs on them. What Proxima sells is the boundary: a cell where your data, your models, and your agents act through one governed, audited action surface, operated by the people who built the kernel. Compute is a commodity. A governed operation is not.

Proxima

Your own Forge.
Run for you.

Aerandil is in private development. The next milestone is working with design partners who operate complex, multi-system hospitality businesses.

Design partner channel coming soon.