Pathfinder reads your real Gemini usage, replays it against the 3.x models inside your own project, and tells you exactly where every workload should land — and what it will actually cost. Measured, not guessed.
Every stage — reading logs, de-identifying with Cloud DLP, replaying traffic on Vertex AI — executes inside your own Google Cloud project, in the region you choose. No prompt, response, or bill is ever copied to Tilicho or any third party. You run it on your infrastructure; you keep every byte.
It opens with a Survey — is the project even ready, and what will it cost? — then five stages each hand the next a cleaner artifact. ● marks a stage where a human decides — pick any to see what it does.
List prices are per token — but your bill is that price times how many tokens a model actually generates, and that count swings wildly from one workload to the next. So a 5× price sheet tells you almost nothing about the real cost: some workloads get cheaper, some get pricier. That's why Pathfinder replays your own traffic instead of doing spreadsheet math. Three kinds of things it turns up:
A model can list at five times the price per token and still cost less on one workload — and more on the next. What you pay is price × the number of tokens a model generates, and those counts vary hugely from one task to another. There's no shortcut from the price sheet to the bill — you have to measure your own traffic to know.
Before you migrate anything, the analysis reads how your current setup behaves — and routinely turns up workloads that are already misconfigured: answers cut off mid-response, malformed output, budget quietly wasted. Worth fixing on their own, migration or not.
Sometimes the model a workload needs isn't available in your region, or there isn't enough data to be sure. Instead of guessing, Pathfinder labels every figure by how it was obtained — measured, estimated, or assumed — and routes the uncertain ones to a person. You always know what's solid and what isn't.
Every cost is labelled with how we got it — and a total is only as reliable as the weakest number inside it.
So you can always tell what to trust. Was a figure actually measured on your traffic, or is it just a default we assumed? Four labels, strongest evidence to weakest:
The clock is the only thing not negotiable.
Pathfinder installs into your own Google Cloud project. The console, the jobs, and every byte of data stay inside your perimeter. We ship the software in; nothing of yours ever goes out.
One install lays down these components, all in the region you choose. You own every one of them.
The runner service account is granted exactly these roles — no project-wide owner, no surprises. Everything is in the install code for your security team to review first.
| What it does | Role | Why |
|---|---|---|
| Read billing export & Vertex logs | roles/bigquery.dataViewer | Survey & Ingestion read spend and request logs |
| Query & write derived tables | roles/bigquery.jobUser · dataEditor | Fingerprinting and aggregation (scoped dataset) |
| De-identify prompts | roles/dlp.user | In-place redaction during Ingestion |
| Read billing account & budgets | roles/billing.viewer | Survey sizing and the budget proposal |
| Replay traffic on Vertex | roles/aiplatform.user | The cost-ladder walk, on your own quota |
| Artifacts & state | roles/storage.objectAdmin | Corpus and run outputs (scoped bucket) |
| People reach the console | roles/iap.httpsResourceAccessor | You grant your own users via SSO |
APIs enabled: BigQuery · Sensitive Data Protection · Vertex AI · Cloud Run · Artifact Registry · Identity-Aware Proxy · Cloud Workflows · Secret Manager · Cloud Billing.
Both deploy the same components into your project, in your region. Choose the path your platform team is comfortable with.
You run our published Terraform in your own project. It's the professional default for enterprises with infrastructure-as-code.
Deploy Pathfinder straight from the Google Cloud Marketplace into your project — a guided, UI-driven setup with no Terraform required.
What "zero egress" means, precisely: no prompt, response or bill ever leaves your Google Cloud project to Tilicho or any third party. The ladder replay does call Google's own Vertex AI — that's you using your own AI service, in your own region, not third-party egress.
Tell us your project and region and we'll walk your platform and security teams through the install — Terraform or Marketplace, your call.
Contact us →