Bud GPU Foundry

Five ways to consume the same fleet, governed by one control plane

A machine, a guest, a cluster, a scheduler or a container. Choose by what your work needs, not by which product your vendor sells. Adding a service class never adds a second billing path, a second permission model or a second audit trail.

Any use case, any environment, one click

Describe the shape your work needs. The platform filters to what your organization may buy, picks exactly one unit by a published rule, tells you which rule chose it, and places the work — on one node, or gang-scheduled across many with the fabric in mind. Resolution is also a read-only call, so a cost model or a procurement script can ask what a shape would buy without launching anything.

When nothing fits, you are told exactly why

Templates hold a reusable declaration and are copied into the resource at launch, so editing one never changes anything already running. A curated starter library can declare a memory floor, so a request that could never have loaded is refused at declaration rather than at runtime. Every template and image carries a trust tier — official, verified or community.

Many tenants and customer segments on one infrastructure, with nothing else shared

Every sellable unit names exactly one service class, one isolation mechanism, one metering basis and the tenant classes it may be sold to. Isolation is a claim about the unit sold, not about the platform in general — and every unit carries one isolation grade, ranked strongest first. An operator states once that an organization may buy nothing weaker than a given grade, and every request in every project is measured against it.

Resellers and white-label. A reseller organization holds sub-organizations it creates, administers and is billed for. It is granted quota and divides it among its customers in whole instances; consumption aggregates back up the same tree. A reseller administrator has no route to a customer's workloads, sessions or logs — the audit trail records the boundary holding. Brand, logo, color, custom domain and language are properties of an organization, applied to the console, documentation links, invitations and notifications. Rate cards are drafted, compared and published with an effective date, and a published rate never applies retroactively.

Metering starts when what you bought answers. Not a second before.

State is observed from the hardware, never assumed from intent. Three records exist for everything the platform has ever accepted, kept apart on purpose: what was asked for, what was observed, and what was billed. The screen a tenant reads and the invoice they receive come from the same log, so they cannot disagree.

The log is append-only and keyed on allocation and phase, so a replay is a no-op rather than a second row. A metering event's identity is a pure function of the allocation and its window bounds, so a replay after a broker failure cannot double-charge. Completeness is verified by an independent nightly recomputation rather than asserted.

Scales with demand: quota you can sell, placement you can predict

Quota is the instrument an operator sells with. A grant is an organization's allowance for one unit in one region, in whole instances. Projects draw on it through named shares, idle headroom is borrowable inside the organization — never across organizations — and every placement follows the same published rule.

Network isolation, durable storage, and several ways in through one authorizer

Network. A tenant's network is programmed as part of provisioning them, and it is the same private routed scope whichever service class they bought. Multi-node units receive a dedicated fabric partition; a fabric the platform cannot confirm offers no capacity at all. Platform control surfaces default-deny from every tenant, and the orchestration substrate is not a network a tenant workload can see, let alone authenticate to. Egress is metered per tenant whether or not it is billed.

Storage. The platform drives the storage systems you already own — network volumes, a shared POSIX filesystem, boot volumes, S3-compatible object storage, versioned images and declared-ephemeral scratch disk. Each tenant receives its own namespace, access zone and object policy in the backing system; the enforced quota is the number billed; checkpoint writes are acknowledged only once durably stored; and a tenant with a contractual requirement supplies and controls the key protecting its data.

Access. SSH on your own key material or a short-lived certificate, a browser terminal and console on a single-use ticket, managed notebooks, brokered kubectl with credentials issued just in time, and SLURM login over the same gateway. Every session has a beginning, an end, an actor and, where recording is enabled, a replayable transcript. Revocation reaches live connections. Operator staff hold no standing access and cannot attach to a running tenant workload — the break-glass path is cordon and evacuate, refused and audited otherwise.

Billing an enterprise buyer recognizes, and spend caps that act

An allocation window with a provisioning phase priced at zero exists on the first record ever written. Metering, rating, invoices, chargeback, budgets and enforcement all read that one log, which is what makes a disputed charge answerable: a tenant receives a per-window explanation of what was billed and why, including the provisioning windows charged at zero.

From capacity to AI consumption: inference, model services and tokens on the same stack

Model catalogs, inference endpoints, serverless models, token metering and agent services are delivered by Bud AI Foundry, which runs on GPU Foundry as a tenant like any other. It receives no private interface and no exemption, so a token-billed customer inherits the isolation, quota and audit trail of the capacity beneath them. The capacity plane does not need to know what a token is; the model plane does not re-implement quota, isolation or metering. What connects them is specified, not assumed.

Where several tenants are served by one model process, no tenant code executes and the isolation claim is made at the request boundary — stated as its own unit in the catalog rather than borrowing a compute grade's claim.

Six places in the console, and what each one is for

The API is the product; the console, the command line and the SDKs are clients of it, generated from the same published specification. Every operation has a command-line command, the console may call only published endpoints, and no decision lives in a place the command line cannot reach.

Silicon, environments and delivery

A tenant's life, both halves specified

Onboarding is usually designed carefully and exit usually is not. The exit half is what an enterprise procurement review asks about first, because it decides whether choosing the platform is reversible.

Directory deactivation revokes platform access, active sessions and issued keys within a published time bound. A tenant can move between organizations, resellers, plans or billing models without interruption to what is running and without published addresses changing.

Twenty-two things GPU Foundry will never do

1. Bill for capacity that never became healthyMetering derives from the phase log, and starts at one phase and no other.
2. Display capacity it cannot placeAvailability is derived from placeability per cluster, with a freshness stamp on every figure.
3. Reclaim interruptible capacity on less notice than the tenant's declared checkpoint intervalThe notice period is a property of the unit and is delivered before reclamation begins.
4. Discard logs when a workload crashesLines are read from the tenant log store, never from the thing that wrote them.
5. Publish a best-case latency figure as a typical oneEvery published figure is a measured percentile with its measurement method stated.
6. Require a tenant to detect a platform failure in order to be credited for itCredits are computed from platform telemetry and offered without a claim.
7. Charge a stopped resource more than a running one without saying so at the point of stoppingThe stop preview and the unit's metering basis are both shown before the action.
8. Withhold compliance documentation or security features behind a spend thresholdA published commercial policy, not a matter of sales discretion.
9. Hold the only copy of a key protecting tenant data where the tenant has contracted otherwiseTenant-supplied keys, whose revocation renders the data unrecoverable.
10. Suspend a contract-billed tenant automatically for balance reasonsFor that class, enforcement is a quota ceiling and a notification; suspension needs a recorded human decision.
11. Present utilization telemetry as a charge basis on any unit where it cannot observe the tenantBlind classes are declared in the catalog in advance and render as a stated absence.
12. Offer a fractional tier to mutually untrusting tenants unless the isolation is enforced in hardwareTenant classes are a property of the catalog row, and the generator refuses the combination outright.
13. Expose a tenant to another tenant's residual accelerator memoryVerified memory clearing per hardware generation before a device is re-offered.
14. Return a machine to the pool without verified erasure of the media that held tenant dataSanitization is part of the reclaim workflow, with evidence retained for the deletion period.
15. Sell a dedicated fabric path that is in fact shared with another tenantFabric partitions are per tenant, and a fabric the platform cannot confirm offers no capacity at all.
16. Issue a tenant credentials of any kind to the platform's own orchestration control planeAsserted against the API and against the access gateway's certificate issuer. Your cluster is yours; ours is never reachable.
17. Require a tenant to hold a long-lived credential to reach what they boughtCertificates, tickets and cluster credentials are minted on demand and expire on their own.
18. Let a reseller see inside its customers' workA reseller relation reaches quota, consumption and spend; there is no relation from it to a workload, a session or a log line.
19. Allow a capacity request to bypass quota accounting by any pathAdmission policy checks that work is routed by the scheduler, and anything that slips past is counted.
20. Promise live migration of accelerator-attached guestsStated as impossible rather than deferred, so no plan ever quietly assumes it.
21. Market an isolation grade it does not enforce on the specific unit being soldRuntime pinning by provenance, and grade constraints checked against what the hardware publishes.
22. Give operator personnel an interactive session into a running tenant workloadThe break-glass path is cordon and evacuate; the attempt is refused and audited.

Comparison current as of Q4 2026 · Rafay facts from its own published materials · hyperscaler and DIY columns are category-level, not a named vendor