The enterprise control plane for self-hosted AI
Identity, budgets, guardrails, retrieval and audit for the models you run on your own GPUs.
The problem
When two people ask the same question, do they see the same documents?
Retrieval without permissions. If access is checked on the results, the model has already read what the person asking was never allowed to see.
Would you know if a model checkpoint ran code when it loaded?
Weights nobody checked. A pickled checkpoint can execute code the moment it is loaded.
What did the GPUs cost each workspace last month, idle hours included?
Spend without an owner. The cards are shared, idle time is invisible, and the bill arrives for the whole cluster.
If any answer takes longer than a minute, your AI platform has outgrown the controls around it.
The idea
In a Greek house the hearth sat at the centre. Guests were received at it, oaths were sworn at it, and its fire never left the house. Hestia kept it.
Hestia does the same for AI: one gateway every inference request passes through, inside your own walls. It runs your engines, or governs the ones you already run.
Architecture
Hestia wraps vLLM with identity, multi-tenancy, cost attribution, guardrails, permission-aware retrieval and audit. It is not a model, an inference engine, or a proxy to hosted AI providers. Every request ends at an engine on infrastructure you control.
Your applications
OpenAI SDK, unmodified
hestia-gateway
The only ingress for inference
Your GPUs
vLLM in GPU pods Hestia starts
Engines you already run
The pipeline order is fixed. Retrieval runs before guardrails, so retrieved content is itself inspected.
Later (v1)Hybrid burst to hosted providers for overflow. Today every path terminates inside your network.
helm install hestia oci://<your-registry>/charts/hestia \
--namespace hestia --create-namespace \
--set gpuPods.enabled=true \
--set artifactStore.enabled=true
✓ hestia-server 1/1 control plane · console · lifecycle controller
✓ hestia-gateway 2/2 the only ingress for inference
✓ hestia-postgres 1/1 event stream · pgvector
# Every base image pinned by digest. No component requires
# network egress at runtime.The data plane is released and rolled independently of the control plane, because it must keep serving when the control plane is down. Postgres is bundled for trials only.
Coming soonSigned offline bundle and one-command install for air-gapped sites. Signature verification is built and cannot be disabled; the installer has not yet been run end to end.
# Applications keep their OpenAI client. Two values change.
$ curl https://hestia.internal/v1/chat/completions \
-H "Authorization: Bearer $HESTIA_KEY" \
-d '{"model": "claims-triage", "messages": [...]}'
# "claims-triage" is a deployment in the claims workspace.
# Repoint it at a new model version from the console —
# the claims service keeps calling the same name.The key is a workspace API key (hk_…) or a person's own access token (hp_…).
Coming soonModel routes: one name resolving across several deployments with fallback, and the key's allowlist checked against the deployment actually chosen.
workspace: claims
budget: # PUT /v1/workspace/{id}/budget
period: monthly
limit: EUR 12,000
enforcement: hard_stop # 429 budget_stop, refused at the gateway
alert_at: [50, 80, 100] # signed webhook, once per threshold
quota: # PUT /v1/workspace/{id}/quota
max_tokens: 50000000
max_requests: 250000
rate_limit_rpm: 600
guardrail: # PUT /v1/workspace/{id}/guardrail
mode: enforce # audit_only until the evidence says otherwise
pii: redact # the model receives [REDACTED:iban]
detects: [email, phone, credit_card, national_id,
iban, ip_address, secret]
injection: block # assessed on input only
retrieval:
acl: pre-filtered at the index, by the caller's own groups —
never a filter applied to results after the factDetectors validate rather than pattern-match: Luhn for cards, mod-97 for IBAN, so an order number is not reported as a payment card. Guardrails start in audit_only and budgets in alert_only, so a control can be switched on without refusing production traffic on day one.
Coming soonConfigurable audit retention, and data-residency expressed as configuration and enforced by the platform.
$ curl -H "Authorization: Bearer $HESTIA_SESSION" \
"https://hestia.internal/v1/event/export?from=2026-03-01T00:00:00Z&workspace_id=$WS"
{"occurred_at":"2026-03-04T09:12:44Z","event_type":"inference","workspace_id":"claims",
"model_name":"claims-triage","prompt_tokens":812,"completion_tokens":143,"latency_ms":690}
{"occurred_at":"2026-03-04T09:12:51Z","event_type":"access_decision","decision":"deny",
"reason":"guardrail_block","workspace_id":"claims","request_id":"…"}
{"occurred_at":"2026-03-04T09:13:07Z","event_type":"access_decision","decision":"deny",
"reason":"budget_stop","workspace_id":"claims","request_id":"…"}
# NDJSON — one record per line, straight into Splunk or Elastic.
# DELETE, UPDATE and TRUNCATE are revoked from the application's database role,
# on the table and on every monthly partition. No API path can alter a record,
# and no role holds audit:delete — platform administrators included.Five event types: inference, retrieval, admin, access_decision, lifecycle. The audit trail and every cost figure are derived from them.
Coming soonA hestia CLI covering what the console does, so this becomes one command.
The record
Every request, decision and change is written as an event. The audit trail and every cost figure come from the same append-only stream, so the page your auditor reads and the one your CFO asks for cannot disagree.
Append-only. DELETE, UPDATE and TRUNCATE are revoked from the application's database role.
Sample data, generated in your browser. Field names and event types are the product's own.
Why enterprises buy it
The ACL filter is a pre-filter at the index, not a filter on the results. Two people asking the same question of the same corpus get different answers, decided before the model sees anything, so no prompt can talk it into disclosure.
Every model artifact is re-hashed against its content address, and its pickle opcode stream is disassembled without ever being unpickled. A checkpoint that would execute code on load is quarantined.
Spend per workspace, user and model, plus allocated and idle card time, derived from an append-only event stream. A budget hard stop is a backstop against a runaway job, not a guarantee that spend never exceeds the number.
A constraint, not a feature flag. No component requires network egress at runtime, and every base image is pinned by digest.
Use cases
Three situations Hestia is built for.
Same question, different answers, decided before the model reads anything.
HR policy, legal memos and board papers sit in one corpus, and not everyone who asks may read all of it.
Retrieval is pre-filtered at the index by each caller's own groups. Retrieval runs before guardrails, so the retrieved text is inspected too.
Keep the engines. Gain the controls.
vLLM already runs on OpenShift for several business units, with no per-unit identity, budget or record.
The existing engines are adopted as they are. Each unit becomes a workspace with its own keys, quota, guardrails and audit.
Idle cards finally have an owner.
Finance sees one GPU bill. Nobody can say which workspace used which cards, or how long they sat idle.
Spend per workspace, user and model, with allocated and idle card time, derived from the event stream and exported as NDJSON.
Trust
Every control below is a mechanism a platform or security team can inspect, not a badge.
Where it runs
Controls you can inspect
hk_…) and personal access tokens (hp_…)audit:delete, platform administrators includedPricing
Tell us three things and we will come back with a number. Trials run on the same Helm chart, with Postgres bundled.
Your GPUs
How many cards, and on what hardware.
Your workspaces
How many workspaces: each one gets its own keys, budgets, policy and record.
Your network
Connected, or air-gapped.
Next step
Book a demo. Bring your platform and security teams, and the questions they will ask.