Multi-tenancy is usually done by sharing one large environment and keeping customers apart with rules and roles. That works until a rule breaks. We chose a different base model: the node model, where each tenant gets its own isolated OpenStack project.
Isolation as the default
Each tenant runs in its own project with its own networks, storage and encryption keys in EU-resident OpenBao. The isolation is structural rather than merely policy-based — neighbors don’t share the same key material or the same logical environment. The default is separation, not carpooling.
Why the keys belong to the tenant
Storing data in isolation isn’t enough if key management is shared. In the node model, keys live with the tenant, in EU-resident OpenBao, so whoever controls the data is also who should be able to read it. Encryption only protects if the counterparty can’t demand the key.
Isolation by default is more boring to build and easier to trust.
— from Kepler’s product principles
What it gives you
A cleaner blast radius during incidents, a clear boundary for audit and compliance, and an environment that is yours rather than part of someone else’s. For regulated industries, structural separation is often the difference between “maybe” and “yes” in a risk assessment.
Read more about the platform, or start your first isolated environment today.