Managed infrastructure for transactional teams. You commit a monthly capacity envelope. We run it on a single, well-documented substrate out of Amsterdam. Autoscale fires inside the envelope; past it, we return a 429 and email you. No tier-flips, no usage surprises.
Three properties that the rest of the platform follows from. They are not features. They are the shape of the agreement you sign before any vCPU is provisioned.
The autoscaler reads your contract before every provisioning call. Inside the envelope, it grows the pool reactively, median 52 seconds end-to-end. Past it, it returns HTTP 429 and emails the org owner.
Read about autoscaleOne region, by design: Amsterdam (nl-ams-1). All compute, storage, and logging stays in the European Union. DPA and GDPR posted; no transfers to third countries.
Read about residencyEvery postmortem published within ten business days. Every ADR public, every release-note version pinned. The decisions we made are searchable; the ones we haven't yet are on the roadmap.
Read engineeringEvery capacity decision the platform makes comes from these three values. They sit in the contract; the orchestrator reads from them on every call.
vCPU, RAM, block storage, object storage. Paid as committed, in EUR. A typical transactional product signs 64 vCPU · 256 GiB · 2 TiB block.
How far above quota the autoscaler may grow before it refuses. Three options: +5%, +10%, +20%. Higher cap, more reserved headroom on our side.
Provisioning calls return HTTP 429. The autoscaler stops growing the pool. The org owner receives an email within thirty seconds. The decision is not negotiable at 3am.
The autoscale loop goes through the same five layers on every event: signal, policy, orchestration, data plane, audit. Versions are pinned; the bill of materials is public.
Every step is a real wire in production — Prometheus to a policy gate that reads your contract, OneFlow that provisions on top of OpenNebula, Cilium and HAProxy carrying the traffic, Ceph holding the state, an append-only ledger recording the decision.
Read the architecturePostmortems, ADRs, release notes. Written by the people on call, indexed under /engineering/. No marketing reviews, no email walls.
A single OSD's IO thread stalled for a minute and a half. Customer reads got slow, not failed. Here's what we changed about the probe contract.
Read postmortemWhat we run for ourselves, what we hand to customers, and why the boundary is where it is. Retention is yours.
Read ADRWhat 2,184 capped scale events looked like on our P&L. Why refusing capacity is cheaper than inventing it.
Read briefvCPU, RAM, storage, one paragraph on the failure modes you care about. The first reply is from the on-call engineer who would operate it. Not a sales contact, not a marketing automation.