Stop deciding
what not to log.

No. Sondar is commercial software and we don't publish the engine's source — we'd rather say that plainly than blur it. What we publish today: an SBOM with every release, a signed release manifest, and a written cap on renewal pricing. We don't offer source escrow, and a source code audit or penetration test is not a standing commitment — we'd rather say that than date one. What does stand: any index can be archived to your own object storage as gzipped JSON, so nothing you've collected has to depend on us.

They're good, and if you're happy with them you should stay. The difference is the analytics layer and the operating burden. SigNoz means you now run and scale ClickHouse and Kafka; Grafana's LGTM stack is four systems to operate. Sondar is one engine with one store for logs, metrics and traces, and a Splunk-class query language — stats, join, transaction, timechart — rather than a filter syntax. On raw storage efficiency, OpenObserve and VictoriaLogs publish bigger numbers than ours. We're not claiming to beat them there.

No. SonQL is Splunk-inspired, not Splunk-compatible — your existing Splunk searches will not run unmodified, and we're telling you that here rather than letting you find out on day one. What does transfer is everything you know about how to search machine data. Most Splunk users are productive in SonQL in an afternoon. There's a command-by-command translation table in the docs and a converter you can paste a query into.

Plan on about 500 GB/day for one server with 16 vCPU and 32 GB of RAM, with 16 people searching at once. Retention is bounded by your disk and your object storage, not by us. Above that, Sondar clusters. That figure keeps headroom for peaks: on such a server, ingest alone measured about 2.6 TB/day, and about 730 GB/day of syslog lines and 800 GB/day of JSON logs held steady while 16 searches ran at once -- at the default 4 GB heap, with 20 alert rules running and with a replica, three or more runs each. The measurements, with their hardware, are on the docs' sizing page.

vCPU, and nothing else. Every vCPU allocated to a Sondar server node counts, in every environment — in a container, its CPU limit, or the host's vCPUs if none is set. We don't count RAM, gigabytes, events, hosts, agents or users. Community is free up to 16 vCPU in total; Pro is $9,600 a year including 16 vCPU, then $500 a year for each vCPU beyond that. The price is the same whether you run four small boxes or one large one, so the model neither rewards nor punishes how you pack them.

Yes, without asking us. Every new installation runs Pro for its first 30 days, within 16 vCPU — no key, no sign-up, and the product sends nothing to us. The clock starts at the first start and a restart does not reset it. When it ends the installation simply continues as Community: nothing is switched off and no data is touched, and any Pro configuration you made — custom roles, masking rules, cold storage tiers, SCIM — keeps running and can be reduced or removed, just not created or expanded until you add a Pro key.

Yes, with capacity — if you add vCPU you license them. What won't happen is a bill that moves because you ingested more, kept data longer, added tags, or stopped sampling. Nothing you do inside the product generates a line item.

Yes, genuinely. Licenses are signed keys your instance verifies offline against a public key baked into the binary — there is no activation server to reach, so Sondar never calls home. An update is the new image, carried in the way the first one was and started on the same data volume, on every tier including Community — patching a disconnected install is not a paid feature.

It's already on your infrastructure — we never had it. Anything you archive to your own object storage is gzipped JSON you can read without us, and your instrumentation is OpenTelemetry so it repoints anywhere. We don't offer source escrow; open formats in your own storage are the answer we can stand behind.

Correct, and worth being explicit about since Community runs one master-eligible node. What sits on the node is the hot window, the configuration and the metadata. Data you tier or archive to your own object storage survives the node, and an archive is gzipped JSON you can read without us. What we do not do yet is snapshot the hot window and the metadata continuously, so we publish no recovery-point or recovery-time figure rather than one we have not measured. If losing the hot window is not acceptable, run three nodes — that is genuine HA, and it is physics, not a sales floor.

Yes, in Community: OpenID Connect and SAML 2.0 single sign-on, alongside LDAP and CAS. We don't charge to log in safely. Pro adds SCIM provisioning, so your identity provider creates, deactivates and deletes Sondar accounts; if Pro ever lapses, it can still deactivate and delete, just not add. We have tested sign-in end to end against Keycloak and SCIM with the requests Okta and Entra ID send. An audit log is not offered yet.

No, and we have not scheduled one. SOC 2 audits how a vendor handles your data, and we never receive your data: Sondar runs on your machines and sends nothing to us. For the same reason we're generally not a HIPAA Business Associate and no BAA is required — the PHI never leaves your environment. What we have today: an SBOM with every release, a signed release manifest the server checks at boot, a published vulnerability disclosure address with a response SLA, and a completed security questionnaire on request. We'll revisit SOC 2 if we run a hosted service or a customer needs it.

Each minor release is supported for 12 months from its release, and fixes, including security fixes, are provided in the latest minor release — you take them by upgrading. Upgrades are an image swap on the same volume: schema migrations run at boot, and the built-in apps update their code without touching your edits. Copy the volume first and rolling back is restoring that copy. The upgrade guide in the handbook has every step. Versioned releases haven't started yet; until the first one, there is one line and every image moves forward.

Sondar is built in Mountain View, California. The whole team is in the Bay Area — founder, engineering and support — and I answer the tickets myself. The more useful half of that answer is what it means for your risk: Sondar runs entirely inside your network and we never receive your data, so there is no vendor to breach that holds your telemetry. For the binary itself we publish an SBOM with every release and sign a manifest of every file we ship, and the product sends nothing to us, so a firewall rule can prove it. We're small and new, and we'd rather hand you things you can check than ask you to take our word for it.