What this preview is

The hosted preview lets you drive real TerraFlow software yourself, against real models, before anything is installed in your environment. It is a preview, not a deployment, and this page says exactly where the difference lies.

What is real

• The engine and the console. Your workspace runs the same TerraFlow code and the same contract format that a Pilot runs. Each invited organisation gets its own workspace: its own TerraFlow plane, database, cache, signing key, evidence ledger and console sign-in.
• The models. Requests go to real hosted models through AutoNous Systems' own provider accounts: Anthropic (Claude Haiku, Sonnet and Opus 5.5), Azure OpenAI (AutoNous Systems' Azure resource) and Google Gemini 2.5 (Flash and Pro, through Google's OpenAI-compatible endpoint). Your prompts leave the server and go to those providers, under AutoNous Systems' provider terms, not yours.
• The prices. Every model carries its vendor's list price, so the cost of each request is its real usage at list price. What the same request would have cost on the workload's baseline model is an estimate at list price: the baseline was never run. Neither is reconciled against a provider invoice; bill reconciliation is planned for Phase 5.
• One private model. An embedding model runs on the server itself (Ollama nomic-embed-text, on CPU). It is the only model in the preview that is genuinely private. A second "private" chat model is simulated: it answers with synthetic text, so you can see where confidential requests are sent. It carries a "simulated" badge in the console, and its adapter type is in the evidence.

What it is not

• Not sovereign. TerraFlow's promise is that your data stays inside your boundary. A hosted service carrying real bank or telco prompts would break that promise, so the preview takes synthetic or public data only.
• Not security-certified. No penetration test, formal threat model or SOC report exists yet; they are planned for Phase 5. The security overview lists the controls that exist and the ones that do not.
• Not production. One server, one replica per workspace, no uptime commitment and no service-level agreement. Workspaces can be reset or deleted.
• Not a benchmark of your workload. The benchmark report measures six synthetic suites with small samples. It says nothing about how TerraFlow would perform on your traffic.

What a Pilot changes

Real customer data belongs only in a Pilot, installed inside your own boundary.

Models offered

These are the models your workspace can use, with the list price each one is billed at. Only models whose list price has been checked against the vendor's published price are switched on; others stay off. Every external model accepts internal data at most, and nothing in which personal data, card data, health data or a credential is detected. Confidential requests can reach only the simulated private model; restricted requests are denied.

"Where it runs" names the provider's processing region as the provider publishes it ("global" means any of its regions) and the jurisdiction the provider is in. "Provider's data terms" is what each model's data terms in the preview catalogue record: how long the provider keeps API prompts (for example, for abuse monitoring) and whether it trains on them, as read from the provider's published terms on the date shown. Two caveats. For Azure OpenAI, no retention period was stated on Microsoft's Azure OpenAI data-privacy and abuse-monitoring pages when they were read on 2026-10-24, so the table shows 30 days, the last period Microsoft published. And Google's no-training term holds only for the paid tier of the Gemini API; that the preview's Gemini key is on the paid tier is to be confirmed by the operator before the preview opens. "Context window" is the most a request routed to that model may hold, its prompt plus the longest answer it may write; TerraFlow routes a longer request elsewhere or denies it. Some windows are set below the model's own limit, so that every request is billed at the list price shown. The window is checked conservatively: a request is measured in bytes rather than tokens, so English text fits roughly a quarter of the window in tokens before TerraFlow refuses it with CONTEXT_WINDOW_EXCEEDED. The starter workloads stay well inside it. The simulated private model is listed because it answers confidential requests; the on-server embedding model is not, because requests are never routed to it.

Limits

The allowance and the ceiling are hard stops. They are enforced outside your workspace, by a spend guard that checks every call to a paid provider before it is made, and that refuses the call if it cannot get an answer. Each call first reserves its worst-case cost and is then settled to what it actually cost, so the stop can come a little before the last cent is spent. Health probes and other calls TerraFlow makes on its own count too. You cannot raise them from inside your workspace. The budgets you see in the console are TerraFlow's own budgets and work as they would in a Pilot. The security overview describes the guard and its known limits.