Hyvop

Get 40% offSee the offer

Security & Governance

Built for governance. Designed for security.

Self-hosted FinOps software by default, on your own LLM keys. Your data never leaves your region.

GDPRDORANIS2EU AI Act

Humans validate. The agent will execute (planned).

Discover

AI identifies who is responsible, by title and perimeter.

Validate

Hyvop shows whom it would ask, in the right order. Community mails no approver; paid editions do.

Execute

Planned: the agent acts only after approval. Nothing is executed in this release.

What our FinOps software will never do

Read data inside your workloads
Metadata, tags, and costs only
Keep your cloud credentials outside your cluster
Stored encrypted in your cluster, scoped to roles you control
Act alone on destructive changes
Explicit validation first
Mix your data with others
Single-tenant processing
Send data to external AI
Your LLM, your keys
Flag compliant workloads
Respect your policies

Access and identity

Metadata only

Tags, metadata, and costs. Never data inside your resources.

Your identity provider

Local accounts in Community. Single sign-on is Enterprise only.

Least-privilege IAM

Read-only in this release. Nothing is written to your cloud.

Sovereignty and data residency

Zero-egress execution

Detection, reasoning, and remediation run inside your perimeter. The chart's network policies deny every pod by default and allow only the documented paths: nothing leaves the cluster but the ingestors' calls to your cloud's APIs on 443, and core's calls to the model provider you configure. The list of what may leave is rendered from the same values as the policies (the chart's README, "What leaves the cluster").

EU-headquartered

Hyvop is built and operated from Paris, France, under European jurisdiction.

EU-based support

Support and engineering are staffed in Europe, in your time zone.
YOUR MODEL, INSIDE YOUR NETWORK

With BYOLLM and an OpenAI-compatible model server inside your network, the only calls that leave your cluster are the ingestors' calls to your cloud's APIs. There is nothing to send to a vendor.

Audit-ready by default

Every remediation is meant to generate a complete audit trail. The approval, API call and before/after state arrive with execution (planned):

01

Who initiated the detection

02

Who was identified, with their role and perimeter

03

The exact conversation and approval

04

Who approved, when, and from which IP

05

The cloud API call and its result

06

Full before/after state

Exportable to your SIEM, compliance reporting, or internal audit tools.

SECURITY

Security architecture

Self-hosted by default, single-tenant when managed. Built so your data never has to leave your boundary.

Talk to our security team security@hyvop.comLegal

TLS 1.2+ and AES-256

TLS to the ingestors; HTTPS at the edge once switched on; stored secrets encrypted

Single-tenant

Isolated processing

Pen tested

Security-tested platform

SOC 2 Type II

In progress

BUILT FOR
GDPRDORANIS2EU AI Act