Your models. Your data.
Your perimeter.
Train models, build datasets, and serve endpoints all inside your own cloud or datacenter, governed and owned by you. Your data never transits Union's infrastructure. Not proxied, not cached, not “encrypted in transit through us”. It just never leaves.
Self-hosted control plane is an enterprise plan, where nothing leaves your infrastructure. Explore Enterprise with us →
Owning the perimeter, proved in production.
Four properties of a sovereign platform. Follow a card to the detail.
A Guarantee You Can Inspect,
Not a Promise You Have to Trust.
Most platforms ask you to trust their process. Union's isolation is topological, not behavioral: the data path physically does not pass through the control plane, and you can verify it — in the Helm charts, the tunnel config, and the Envoy filter chains.
References, never payloads
The control plane stores run IDs, schedules, and artifact references. Inputs, outputs, logs, code bundles, and reports live in your object store and are served by a dataproxy inside your perimeter.
Outbound-only connectivity
Your cluster initiates the tunnel. No inbound ports, no firewall changes, no VPN peering into your VPC. Every request is authenticated and authorized by an Envoy router that runs on your side of the line.
Your keys, your custody
Data is encrypted with keys you hold in your KMS. Compromising Union's infrastructure would still not reach your data — an attacker would also need your cloud IAM and your keys.
Faster, not slower
Direct-to-DataPlane isn't a security tax. Reads and writes go straight to your object store, so the secure path has lower latency and lower egress cost than proxying through a vendor.
From the announcement: Zero-Trust Security Architecture
The Lock Is in the Product,
Not the Brochure.
Every surface in the run view carries a lock — inputs, outputs, logs, reports, code. Hover over one and the console tells you exactly where the bytes came from: served by your data plane, through the Direct-to-DataPlane tunnel, never entering the control plane in any form.
The URL under the lock is your data plane's domain — the console fetches these bytes from your infrastructure, not Union's.
⛁ rl-tasks-dataset@uwbwvdrsf2gzj27gmvgp-5j…
⛁ policy-checkpoint@ufe486be308c71f1d-a0-1
Everything a Frontier Stack Needs.
Nothing Leaves.
Sovereignty is worthless if it costs you capability. Union runs the full loop — data, training, evals, serving — on your GPUs, in your VPC, with the same event-wired automation as any managed platform.
Train at cluster scale
Multi-node distributed training with ClusteredTaskEnvironment — torchrun across your own GPU nodes, checkpoints in your object store, OOM recovery mid-run.
Create data durably
Fan out synthesis and filtering across thousands of spot containers with flyte.map. Every element checkpointed; every dataset a versioned artifact with lineage.
Serve inside the VPC
Model endpoints, batch inference, and apps run on the same runtime that trained the model — behind your load balancer, reachable only from your network if you choose.
None of them ever leave
your perimeter.
“References, never payloads” is a claim you can check asset by asset. Here is every thing a run touches, and which plane actually holds it.
Encrypted with your keys.
Isolated between your teams.
The perimeter isn’t only the outer wall. Inside it, projects and domains are real boundaries: separate namespaces, separate service accounts, separate buckets and secrets, and network policy that keeps one team’s workloads off another team’s services.
- In transit — TLS everywhere, and the data path is a tunnel your cluster dials out to. No inbound connection is ever opened into your network.
- At rest — object storage, metadata, and snapshots encrypted with keys you own and rotate.
- Between teams — per-project namespaces and service accounts, scoped secrets, and network policy between workloads.
- Between tenants — each tenant’s work is scheduled by its own owner, so a million-action backfill from one team can’t slow a five-task run from another.
Every signal in one place.
Every action has a deterministic name, and the logs, metrics, errors, inputs, outputs, and cost of a step all hang off it. There is no correlation step, so the queue view, the cost rollup, and a task’s own report are all reading the same state the scheduler runs on.
GRPO + LoRA training progress
✓ completeToken-level clipped-ratio GRPO. The importance ratio comes from vLLM sampling-time logprobs against the adapter-disabled base, which is what makes the one-step-off-policy pipelined training sound.
Reports are published by the task itself, so “how did it do” has an answer in the same place as “did it finish”.
Sovereign AI, proved in production.
The teams already running these properties, and the number each of them reported.
Open source at the core.
Union is built on Flyte, the open-source AI runtime we create and maintain under the Linux Foundation AI & Data.
A sovereign platform is more than a perimeter.
Owning where your AI runs is the first decision. These are the three that follow: a runtime that survives your infrastructure, a factory that makes the models, and a scheduler that shares the fleet.
Durable AI Runtime
Sovereignty is worthless if the run dies. Recover, fork, and replay any workload — and change the hardware inside an except block.
Explore the runtime →AI Factory
Own your data, your models, and your AI — the full training, evaluation, and serving loop running inside the perimeter above.
See the factory →Advanced Scheduling
Every cluster inside your perimeter, shared fairly: priority, quotas per team, and routing across clouds and accelerator classes.
See the scheduler →Draw the Perimeter.
Keep Everything Inside It.
Bring one workload — training, data, or serving. We'll run it inside your cloud this week, and you can inspect exactly what the control plane sees: references, and nothing else.