Gemini 2.5 retires in · migrate before

Migrate with evidence, not assumptions.

Pathfinder reads your real Gemini usage, replays it against the 3.x models inside your own project, and tells you exactly where every workload should land — and what it will actually cost. Measured, not guessed.

See how it works
Per-workload
right-sized to the cheapest model that still holds quality
Zero egress
every stage runs inside your own cloud project
Evidence-led
every number measured on your real traffic, never guessed
Built for the Gemini 2.5 → 3.x migration · nothing leaves your project
🔒
Runs entirely inside your project

Your data never leaves your GCP project. There is no egress.

Every stage — reading logs, de-identifying with Cloud DLP, replaying traffic on Vertex AI — executes inside your own Google Cloud project, in the region you choose. No prompt, response, or bill is ever copied to Tilicho or any third party. You run it on your infrastructure; you keep every byte.

0 bytes of prompt data egressed Your Vertex & BigQuery quota Your chosen region, end to end
The pipeline

Raw usage in. A signed plan out. The stages between.

It opens with a Survey — is the project even ready, and what will it cost? — then five stages each hand the next a cleaner artifact. marks a stage where a human decides — pick any to see what it does.

What the analysis catches

The list price can't tell you what a workload will cost.

List prices are per token — but your bill is that price times how many tokens a model actually generates, and that count swings wildly from one workload to the next. So a 5× price sheet tells you almost nothing about the real cost: some workloads get cheaper, some get pricier. That's why Pathfinder replays your own traffic instead of doing spreadsheet math. Three kinds of things it turns up:

LIST 5× CHEAPER PRICIER
Pricing

5× the price isn't 5× the bill

A model can list at five times the price per token and still cost less on one workload — and more on the next. What you pay is price × the number of tokens a model generates, and those counts vary hugely from one task to another. There's no shortcut from the price sheet to the bill — you have to measure your own traffic to know.

Responses today · one workload
Your current setup

Problems you already have

Before you migrate anything, the analysis reads how your current setup behaves — and routinely turns up workloads that are already misconfigured: answers cut off mid-response, malformed output, budget quietly wasted. Worth fixing on their own, migration or not.

Measured
Logged
Modelled
Assumed
STRONGESTWEAKEST
Honesty

It never invents a number

Sometimes the model a workload needs isn't available in your region, or there isn't enough data to be sure. Instead of guessing, Pathfinder labels every figure by how it was obtained — measured, estimated, or assumed — and routes the uncertain ones to a person. You always know what's solid and what isn't.

How to read every number
Every cost is labelled with how we got it — and a total is only as reliable as the weakest number inside it.

So you can always tell what to trust. Was a figure actually measured on your traffic, or is it just a default we assumed? Four labels, strongest evidence to weakest:

Try it A portfolio total is built from many numbers, each with its own evidence. Click a line to change how its figure was obtained — the total can never read stronger than its weakest input.
Portfolio total — reliability

See where your estate should land.

The clock is the only thing not negotiable.

Onboarding

Deployed in your cloud — not ours.

Pathfinder installs into your own Google Cloud project. The console, the jobs, and every byte of data stay inside your perimeter. We ship the software in; nothing of yours ever goes out.

1 Pick a GCP project & region
2 Deploy — Terraform or Marketplace
3 Security approves access
4 Open the console · run Survey
What gets provisioned

Everything Pathfinder needs — created inside your project.

One install lays down these components, all in the region you choose. You own every one of them.

Console
A private Cloud Run service serving the UI & API, behind Identity-Aware Proxy and your own SSO. No public URL.
Runner service account
The single least-privilege identity the tool acts as — scoped roles only, nothing broader.
BigQuery dataset
A dedicated pathfinder_derived dataset for outputs, plus read bindings on your billing & Vertex-log datasets.
Sensitive Data Protection
Cloud DLP de-identify templates (PII · PCI · PHI · credentials) that redact every prompt in place.
Cloud Storage bucket
Corpus, baseline responses and ladder-run artifacts — in your region, never copied out.
Orchestration
Cloud Workflows & Jobs run the Survey, ingestion, fingerprinting and the ladder replay on your Vertex quota.
$
Billing budget
A Cloud Billing budget matching the per-stage caps Survey proposes, so spend is bounded in your own account.
Our container image
Pulled from Artifact Registry into your project. Code comes in — signed and inspectable. Your data never leaves.
Access it needs

Least-privilege, scoped, and readable before you apply.

The runner service account is granted exactly these roles — no project-wide owner, no surprises. Everything is in the install code for your security team to review first.

What it doesRoleWhy
Read billing export & Vertex logsroles/bigquery.dataViewerSurvey & Ingestion read spend and request logs
Query & write derived tablesroles/bigquery.jobUser · dataEditorFingerprinting and aggregation (scoped dataset)
De-identify promptsroles/dlp.userIn-place redaction during Ingestion
Read billing account & budgetsroles/billing.viewerSurvey sizing and the budget proposal
Replay traffic on Vertexroles/aiplatform.userThe cost-ladder walk, on your own quota
Artifacts & stateroles/storage.objectAdminCorpus and run outputs (scoped bucket)
People reach the consoleroles/iap.httpsResourceAccessorYou grant your own users via SSO

APIs enabled: BigQuery · Sensitive Data Protection · Vertex AI · Cloud Run · Artifact Registry · Identity-Aware Proxy · Cloud Workflows · Secret Manager · Cloud Billing.

Before you onboard

A short checklist to have ready.

A GCP project & region to deploy into — existing, or a fresh *-pathfinder project for a clean blast radius.
Cloud Billing export to BigQuery enabled (standard GCP feature) so Survey can read the last ~6 months of spend.
Vertex request-response logging on — or leave it to Survey, which recommends enabling it and running a 7-day capture first.
An installer with Owner (or a scoped deploy role) on the project, to enable APIs, create the service account and deploy Cloud Run.
Security available to review the DLP templates and the IAM bindings — both are human-readable in the install code.
Your SSO / Cloud Identity ready, so you can grant your own people access to the console through IAP.
Two ways to install

Pick whichever fits how your team ships.

Both deploy the same components into your project, in your region. Choose the path your platform team is comfortable with.

Terraform module
Recommended

You run our published Terraform in your own project. It's the professional default for enterprises with infrastructure-as-code.

  1. Set the project ID, region, and your billing-export & Vertex-log dataset names.
  2. terraform apply — it enables the APIs, creates the service account & IAM, and pulls our image.
  3. It deploys the console behind IAP, and provisions the BigQuery dataset, DLP templates, bucket and budget.
  4. Security reviews the plan before it's applied; you grant your users access and open the console.
Best for teams that manage cloud with IaC and want everything reviewable in code.
Google Cloud Marketplace
Click-to-deploy

Deploy Pathfinder straight from the Google Cloud Marketplace into your project — a guided, UI-driven setup with no Terraform required.

  1. Find Pathfinder by Tilicho Labs on the Marketplace and choose your project & region.
  2. Licensing and billing run through your existing Google Cloud account.
  3. The deployment provisions the same console, service account, datasets, DLP templates and budget.
  4. Approve the access it requests, then open the console and run Survey.
Best for a fast, guided setup without touching Terraform.
How you prove zero egress

You don't have to take our word for it.

VPC Service Controls
Wrap the project in a perimeter and exfiltration to anything outside it becomes physically impossible — the strongest form of the guarantee.
Cloud Audit Logs
Every call the runner makes is logged. There is no call to a Tilicho endpoint — only Google services in your own region.
Binary Authorization
Enforce that only our signed image runs, and inspect its contents (SBOM) before you ever deploy it.

What "zero egress" means, precisely: no prompt, response or bill ever leaves your Google Cloud project to Tilicho or any third party. The ladder replay does call Google's own Vertex AI — that's you using your own AI service, in your own region, not third-party egress.

Get started

Ready to see it in your own project?

Tell us your project and region and we'll walk your platform and security teams through the install — Terraform or Marketplace, your call.

Contact us →