AI infrastructure, engineered from the slab to the endpoint.

We bring engineering expertise to every layer of your GPU clusters: power and cooling constraints, the fabric, storage, Kubernetes, the platform your researchers log into, and the on-call rotation when something breaks. Based in France, working worldwide, in EU and US time zones.

Talk to an engineer Read the bill of layers

L4 Orchestration

GPU-aware Kubernetes with gang scheduling, priorities and hard tenant isolation on mixed hardware.

scheduler
Volcano, Kueue, Slurm
GPU stack
Operator, DRA, CDI, NFD
scale
1,000+ nodes
Section A–A through a typical GPU cluster. Hover or tab through the layers, and switch on the security band to see the controls.

Bill of layers

Every layer we take on, what we are accountable for, and the envelope we usually design within. Most clients start with one row. Most incidents cross three. The full parts list follows below.

Ref Layer What we own What we work with Typical envelope
L6 Model serving Inference endpoints sized against real traffic, with autoscaling on queue depth rather than CPU. vLLM, SGLang, TensorRT-LLM, Triton, NVIDIA Dynamo, KServe, MIG p99 under SLO at 10–100× burst
L5 AI platform The environment researchers actually use: notebooks, jobs, pipelines, experiment tracking, quotas. MLOps & AI infrastructure Kubeflow, Ray, PyTorch, FSDP, DeepSpeed, Megatron-LM, JAX, MLflow 100s of users, 1,000s of jobs/day
L4 Orchestration GPU-aware Kubernetes: topology-aware placement, gang scheduling, priorities, multi-tenant isolation. Kubernetes & Containers NVIDIA GPU Operator, DRA, CDI, NFD, Volcano, Kueue, Slurm, Multus 1,000+ nodes per control plane
L3 Cloud & virtualization Private cloud underneath, provisioned and upgraded as code, with rollback that has been tested. OpenStack Services Proxmox VE Multi-cloud for SaaS European clouds OpenStack, Ironic, KVM/QEMU, LXD, Proxmox, Terraform, Ansible, GitOps Zero-downtime upgrades
L2 Storage Data paths sized for checkpoints and dataloaders, not for a benchmark slide. Lustre, Weka, VAST Data, IBM Storage Scale, Ceph, GPUDirect Storage, NVMe-oF 100s of GB/s aggregate, PB scale
L1 Fabric Rail-optimized fabrics, RDMA tuned end to end, and the SDN that ties tenants together. VyOS Solutions InfiniBand NDR/XDR, RoCEv2, Spectrum-X, NVLink, ConnectX, BlueField, GPUDirect RDMA, NCCL, SR-IOV, DPDK, eBPF, OVN 400–800G per port, low-µs RDMA
L0 Datacenter floor Rack design, firmware baselines and bring-up to the first job, with your facility team, inside real power and cooling limits. NVIDIA HGX B300, B200, H200, GB200 NVL72, AMD Instinct MI355X, liquid cooling, BMC/firmware baselines 40–130 kW per rack, PUE 1.1–1.3
All SRE Observability, incident response, cross-layer root cause analysis, runbooks and ADRs in Git. Automation and Monitoring FinOps, sustainability, coaching DCGM, Prometheus, Grafana, Loki, ELK, OpenTelemetry EU and US hours
All Security CISO as a service, SecOps and security engineering on everything we work on: governance, detection and response, hardening, tenant isolation. Security and SecOps Zero Trust, OpenSearch SIEM, SAST/SCA, Kyverno, Falco, Sigstore, Vault, NIS2, DORA, ISO 27001, SOC 2 Policies and evidence in Git

Follow one prompt down to the concrete.

Somebody types a question. Here is everything that has to work for the answer to stream back in under a second. We bring expertise to every layer of it.

Exploded axonometric view of an NVIDIA HGX GPU cluster: datacenter hall, racks, GPU topology, fabric, storage, upstream links, Kubernetes, inference engine and the end user's chat window. CDU, direct liquid cooling Overhead busway, A/B feeds HGX node, 8 GPUs 8 GPUs, one NIC each NVLink 5 switch fabric Spine switches Rail-optimized InfiniBand / RoCE, 400–800G Parallel filesystem, NVMe 2 transits + IX peering Control plane ×3 Gang-scheduled job, 32 GPUs Request queue Model replicas + KV cache Summarize this 40-page supplycontract and flag thetermination clauses. Three clauses matter. Section 14.2 allowstermination for convenience with 90 days’notice▌ First token 180 ms, 62 tok/s

  1. L0

    A hall that can feed the racks

    GPU racks draw several times what a classic hall was designed for. We help your facility team size power, busways and liquid cooling loops before the first server ships.

    density
    40–130 kW per rack
    cooling
    direct liquid, CDU per row
    PUE
    1.1–1.3

  2. L0

    Racks, nodes and firmware baselines

    Rack elevations, BMC and firmware pinned per hardware generation, burn-in before anything joins the cluster.

    systems
    HGX B300, B200, H200
    rack-scale
    GB200, GB300 NVL72
    accelerators
    CUDA, ROCm, ARM

  3. L1

    Inside the node: GPU topology

    Eight GPUs on a switched NVLink fabric, each paired with its own NIC so collective traffic leaves the node on the right rail.

    intra-node
    NVLink 5, NVSwitch, 1.8 TB/s per GPU
    NIC per GPU
    ConnectX, 400–800G
    partitioning
    MIG profiles

  4. L1

    The fabric between nodes

    Rail-optimized leaf and spine, lossless where it has to be, and tuned until all-reduce bandwidth matches the spec sheet.

    ports
    NDR 400G, XDR 800G
    transport
    InfiniBand, Spectrum-X, RoCEv2
    tuning
    PFC, ECN, NCCL, SHARP

  5. L2

    Storage that keeps GPUs fed

    Parallel filesystems for checkpoints and dataloaders, object storage for datasets, block for everything else.

    parallel FS
    Lustre, Weka, VAST
    GPU path
    GPUDirect Storage
    throughput
    100s of GB/s

  6. L1

    The edge and the way out

    Redundant routers, upstream transit and internet exchange peering, so users reach the endpoint by the shortest sane path.

    upstream
    2 transits + IX
    routing
    BGP, VyOS, OVN
    security
    segmented, audited

  7. L4

    Kubernetes that understands GPUs

    Highly available control planes, GPU Operator and device plugins, and batch scheduling that places a 32-GPU job all at once or not at all.

    scheduling
    Volcano, Kueue, Slurm
    GPU stack
    GPU Operator, DRA
    isolation
    RBAC, PSA, Network Policies

  8. L6

    The inference engine

    Requests are batched continuously across model replicas, with KV cache sized so latency holds when traffic doubles.

    engines
    vLLM, SGLang, TensorRT-LLM
    serving
    Dynamo, KServe, Triton
    precision
    FP8, FP4

  9. You

    And the answer streams back

    The end user sees a chat window. We make sure the first token shows up fast, wherever the cluster runs.

    time to first token
    < 200 ms
    served from
    your region
    data
    stays where you decide

Parts list

The hardware generations, fabrics and software we work with every day. Vendor-agnostic: we pick per workload, and we have the scars on both sides.

L0 Accelerators and systems

NVIDIA HGX B300
Blackwell Ultra, 8 GPUs per node
NVIDIA HGX B200
Blackwell, 8 GPUs per node
NVIDIA GB300 NVL72, GB200 NVL72
rack-scale, liquid-cooled
NVIDIA HGX H200, H100
Hopper, 8 GPUs per node
NVIDIA GH200 Grace Hopper
ARM CPU + GPU superchip
NVIDIA Vera Rubin
next-generation readiness
NVIDIA L40S, RTX PRO 6000
inference and graphics
AMD Instinct MI355X, MI325X, MI300X
ROCm
ARM servers
Grace, Ampere

L1 GPU interconnect

NVLink 5, NVLink Switch
1.8 TB/s per Blackwell GPU
NVSwitch, NVLink-C2C
all-to-all inside the node
AMD Infinity Fabric
xGMI between Instinct GPUs
PCIe Gen5, Gen6
host and NIC lanes
MIG, vGPU, MPS, time-slicing
GPU partitioning

L1 HPC networking

InfiniBand NDR 400G, XDR 800G
Quantum-2, Quantum-X800
Ethernet for AI
Spectrum-X, RoCEv2, Ultra Ethernet
ConnectX-7, ConnectX-8 SuperNIC
one NIC per GPU, per rail
BlueField-3 DPU
offload, isolation, storage
GPUDirect RDMA, NCCL, RCCL
collectives, SHARP in-network reduction
Rail-optimized fat tree
leaf/spine, non-blocking
SR-IOV, DPDK, eBPF
kernel and userspace datapaths
BGP, EVPN-VXLAN, OVS/OVN
underlay, overlay, SDN

L2 Storage

GPUDirect Storage
NVMe straight to GPU memory
Lustre, BeeGFS
parallel filesystems
Weka, VAST Data
all-flash for AI
IBM Storage Scale (GPFS)
parallel filesystem
Ceph, S3 object storage
datasets and checkpoints
NVMe-oF, iSER, ZFS
block and local tiers

L0 Datacenter

Direct liquid cooling
CDUs, manifolds, facility water
Rear-door heat exchangers
hybrid air and liquid
40–130+ kW racks
busways, A/B feeds
Redfish, BMC, firmware baselines
per hardware generation
Burn-in and acceptance
NCCL tests, HPL, DCGM diagnostics
PUE, WUE
energy and water efficiency

L3 Cloud and bare metal

OpenStack, Ironic
bare-metal GPU cloud
KVM/QEMU, Proxmox VE, LXD
virtualization, GPU passthrough
MAAS, PXE provisioning
fleet bring-up
Terraform, Ansible
infrastructure as code
Argo CD, Flux
GitOps

L4 Kubernetes and scheduling

NVIDIA GPU Operator, Network Operator
drivers, device plugins
DRA, CDI, NFD
dynamic resource allocation
Volcano, Kueue
gang and batch scheduling
Slurm, Slurm on Kubernetes
HPC job scheduling
Cilium, Multus
multi-network pods
containerd, CRI-O
runtimes

L5 Training

PyTorch, FSDP, DeepSpeed
distributed training
Megatron-LM, NeMo
large model parallelism
JAX, TensorFlow
frameworks
Kubeflow, Ray, KubeRay
jobs and pipelines
MLflow, JupyterHub
experiments and notebooks

L6 Inference

vLLM, SGLang
LLM serving
TensorRT-LLM, Triton Inference Server
optimized engines
NVIDIA Dynamo, llm-d
disaggregated prefill and decode
KServe, Ray Serve
model serving on Kubernetes
FP8, FP4, speculative decoding
throughput per GPU

All SRE and observability

DCGM, DCGM Exporter
GPU health, XID errors
Prometheus, Grafana, Loki, OpenTelemetry
observability
ELK, OpenSearch
logs and audit trails
Go, Rust
our tooling

All Security

RBAC, Pod Security Admission, Network Policies
Kubernetes hardening
Kyverno, OPA Gatekeeper
admission policy as code
Falco, Tetragon
runtime detection
Sigstore, cosign, SBOM, Trivy
software supply chain
Vault, SPIFFE/SPIRE
secrets and workload identity
MACsec, EVPN segmentation, InfiniBand partition keys
fabric isolation
Confidential computing
NVIDIA Hopper and Blackwell, AMD SEV-SNP, Intel TDX
CIS Benchmarks, MITRE ATT&CK, MITRE ATLAS
hardening and threat models
OWASP Top 10 for LLM
inference and agent risks
Zero Trust
identity-based access everywhere
OpenSearch SIEM, SOC
detection and response
SAST, SCA, secure SDLC
DevSecOps in CI/CD
CSPM, CWPP, WAF, DDoS protection
AWS and Azure cloud security

All Compliance

NIS2, DORA
EU operational resilience
ISO/IEC 27001
information security management
GDPR, EU AI Act
data and AI regulation
SOC 2, HIPAA, PCI DSS
SaaS, health and payment data
NIST CSF, ISO/IEC 27032
cybersecurity frameworks
SecNumCloud, HDS
French sovereign and health hosting requirements

Product names are trademarks of their owners. Listed as technologies we work with, not as partnerships.

We follow the fault, not the org chart.

In a GPU cluster, most failures surface two layers above where they start. We were trained to look down.

  1. T+00
    L5, platformStep time up 31% on a 512-GPU training job. No errors in the job logs.
  2. T+04
    L4, orchestrationPlacement as expected, all pods inside one topology domain. Ruled out.
  3. T+09
    L2, storageCheckpoint writes within baseline. Ruled out.
  4. T+15
    L1, fabricAll-reduce bus bandwidth down on one rail. PFC pause frames climbing on one leaf port.
  5. T+22
    L0, floorOptic on that port running hot with intermittent symbol errors. Replaced, rail drained and requalified.
  6. T+41
    ClosedStep time back to baseline. Alert added on the error-rate threshold, runbook updated in Git.

Composite example, representative of what we see in production. Not a specific engagement.

Security is drawn in, not stamped on.

AI infrastructure has its own attack surface: shared GPUs, RDMA fabrics that bypass the kernel, models and datasets worth more than the hardware, endpoints that take instructions in plain language. We bring the security function with the build, from the board to the kernel.

CISO as a service

A part-time CISO who knows your infrastructure down to the fabric.

  • Building the security function from the ground up
  • Governance, policies, risk register, roadmap and budget
  • Board and audit committee reporting, regulator relations
  • SOC 2, ISO 27001, NIS2, DORA, HIPAA, PCI DSS readiness
  • Business continuity, crisis management, tabletop exercises
  • Security awareness and phishing programs

SecOps

Day-to-day security operations on the platforms we engineer and operate, or on yours.

  • SOC design, SIEM on OpenSearch, SOC provider governance
  • Detection and response, automated playbooks
  • Zero Trust access, access reviews, least privilege
  • Cloud security posture on AWS and Azure: CSPM, CWPP, WAF
  • Vulnerability management, attack surface management
  • Incident response, post-mortems, pentest follow-up

Security engineering

Security designed into every layer of the build, not added for the audit.

  • Threat modeling for GPU clusters and AI platforms
  • Tenant isolation from the fabric to Kubernetes
  • DevSecOps: SAST and SCA in CI/CD, secure SDLC
  • Software supply chain: signed images, SBOM
  • Model and training data protection
  • Security architecture reviews and design testing

NIS2, DORA, ISO/IEC 27001, SOC 2, GDPR, HIPAA, PCI DSS, NIST CSF, EU AI Act, SecNumCloud and HDS requirements

Our team has led security programs through SOC 2, ISO 27001, HIPAA and PCI DSS audits and holds an ISO/IEC 27032 Lead Cybersecurity Manager certification. Certification of your organization is issued by accredited bodies.

Security and SecOps

Based in France. Working wherever your clusters run.

44.84°N 0.58°W engineering base, Bordeaux, France
clients worldwide, EU and US time zones

General notes

  1. Clients worldwide. We work on infrastructure in the US, in Europe and beyond, alongside your datacenter, hardware, platform and research teams.
  2. EU and US time zones. Our engineers work from France with daily overlap into US hours, and 24/7 on-call coverage when you need it. Handover happens in your channel, not in a ticket queue.
  3. Expertise across the stack. From power and cooling constraints to the model endpoint, we bring engineering to every layer and work with your existing teams and vendors.
  4. European deployments, European rules. For clusters in Europe, we know the sovereignty, GDPR, NIS2 and energy constraints that come with them, and how to design for them.
  5. Vendor-agnostic. NVIDIA or AMD, InfiniBand or Ethernet, any parallel filesystem. We pick for the workload.
  6. Everything in Git. Runbooks, ADRs, configuration baselines and change history. You keep it all.
  7. No logos here. Our clients’ infrastructure is their business. Ask us about orders of magnitude instead.

Start a drawing with us

Tell us what you are building and where. An engineer replies, not a sales rep.

Drawn by
OPSaaS engineering
Based in
France, clients worldwide
Hours
EU and US time zones, 24/7 on demand
Scope
Advise, design, engineer, operate
Sheet
A-01, general arrangement, rev. 2026
Hiventive