There's a phrase network engineers use that sounds like a pickup line: meet me in the meet-me room.
What’s a meet-me room, you ask?!
For the uninitiated, it's a room in the corner of a colocation facility where private networks physically shake hands (usually a patch panel and some cross-connects). These rooms are the beating heart and the critical hub of the physical internet. But you can’t truly participate if you don’t have access to a private network and all the good stuff that comes with it.
That’s why we’ve built Galactic VPC: a virtual backbone service with a meet-me room vibe that you can conjure from an API call. And not just one, but thousands of them. One per agent, per workload, per customer, wherever your stuff happens to be.
Networking never got the memo
I like to say that everything else in the stack learned to abstract itself, but networking never got the memo.
- Virtualization hid the hardware.
- Cloud hid the infrastructure.
- Kubernetes hid the deployment.
- Serverless hid the databases and queues.
Save a few notable exceptions, if you try to connect two things in different clouds (or a cloud and a rack in your basement, or an edge device in a factory) then you're suddenly reading BGP tables and arguing about WireGuard versus VLANs like it's 2009. Even worse, you're opening tickets and sending emails and waiting weeks or months for servers to be racked and wires to be run.
Clearly, this is why developers love the VPC model, but it hits a wall at the public cloud property line. AWS VPCs are awesome, as long as you’re hanging out in AWS.
We designed Galactic VPC to bring that same experience anywhere. It’s a logical network (built using SRv6) that spans across, between, and beyond providers with the creature comforts you expect: programmability, policy, observability, and reproducible everything.
Land anything here
A Galactic VPC is more than a distributed network, it's an attachment point and a gathering place for connections. In other words, a virtual meet-me room in addition to a virtual backbone!
With gVPC, you can land a MASQUE tunnel, a WireGuard peer, a plain old VPN, a Layer 2 VLAN, a Layer 3 BGP session, or an NNI to a carrier. No matter how the connection arrives, our goal is to make it an implementation detail, just like the way a disk or a container is. Where's the network? Where are the gateways? Wrong question! You asked for connectivity; you got it.
Here's are some of the things Galactic VPC unlocks:
- Hand your AI agent a network of its own. As agents start reaching across providers (sorry Hugging Face!), data sources, and regions, each one can get a private, policy-bound backbone instead of a shared blast radius. Spin one up per agent. Isolation isn't a shared-VLAN promise slapped on top, it's the topology.
- Private by default. Bring traffic from a far-flung Docker container or a desktop application into the Datum network over the Datum Tunnel (our QUIC-based connector) land it on a Galactic VPC, and route it back out to AWS. Because Datum Tunnel is built on the iroh protocol, it routes by key, not by IP. The traffic finds its destination without ever being addressable on the public internet. No exposed ports, no overlay to babysit, just a connection that exists between your endpoints and nowhere else.
- Aggregate distributed infrastructure onto one network. Bare metal from one provider, VMs from another, GPUs from a third..all landed on the same virtual backbone. Instead of a mess of point-to-point tunnels and per-provider networking quirks, you get a single logical network where everything can reach everything according to how you wire it. The backbone is the constant; the providers underneath become interchangeable.
Where this is headed, the packet carries the rules
Here's the bit (byte?) that's exciting for an old network software guy like myself.
Traditionally, a network performs because every device along the path independently agrees to behave. Route, firewall, ACL, service chain, vendor quirk are all stitched together, integrated, and prayed over. The "policy" usually only exists as the sum of a hundred configs that one dude with a serious neck beard understands.
We built Galactic on SRv6 (segment routing over IPv6) because we love the elegance of policy traveling with the packet. Our vision is simple: from the moment traffic hits your Galactic VPC, it carries instructions about where each packet can go, what must inspect it, and what it must never touch. SRv6 gives us point-to-point control in the spirit of MPLS, but programmable, and without the point-to-point rigidity.
We're not shipping policy just yet (connectivity comes first). But the foundation is there, and it's what will make ideas like these come to life as YAML instead of a work around:
- "Never let this traffic leave Germany." Data residency as a network property, not a compliance spreadsheet.
- "Route to AWS, but never through China or Russia." Geopolitics expressed as a path constraint, not a map of undersea cables taped to your wall.
- "Inspect everything before it leaves my network." Service insertion as part of the intent, not something traffic might pass through if the routes happen to line up.
Every one of these is, today, a stitch-work of routing protocols, firewalls, and vendor features. Each one should be a single expressed requirement. That's the road we're on.
Why now
We believe data and intelligence are getting more distributed, more valuable, more regulated, and more attacked—all at once. Curating how and with whom you connect stops being a nicety and starts being the whole game.
Doing that the old way (with routers, telco protocols, colo cages, deep tribal expertise) leaves everyone but the giants with a lousy choice: expose everything on the open internet, or bury it with overlays and lose your visibility and velocity.
We'd rather you skip the choice.
So: meet me in the Galactic VPC. Bring a workload using Datum Compute. Bring an agent. Bring a rack you've been meaning to connect. We’re wired up and ready to go on the journey with you!