Stop deciding
what not to log.

No. Sondar is commercial software and we don't publish the engine's source — we'd rather say that plainly than blur it. What we do publish: an independent source code audit by a US security firm, a full third-party penetration test, an SBOM with every release, signed reproducible builds, our source-escrow terms, and a written cap on renewal pricing. And your data stays in your own object storage in open formats, so nothing you've collected depends on us.

They're good, and if you're happy with them you should stay. The difference is the analytics layer and the operating burden. SigNoz means you now run and scale ClickHouse and Kafka; Grafana's LGTM stack is four systems to operate. Sondar is one engine with one store for logs, metrics and traces, and a Splunk-class query language — stats, join, transaction, timechart — rather than a filter syntax. On raw storage efficiency, OpenObserve and VictoriaLogs publish bigger numbers than ours. We're not claiming to beat them there.

No. SonQL is Splunk-inspired, not Splunk-compatible — your existing Splunk searches will not run unmodified, and we're telling you that here rather than letting you find out on day one. What does transfer is everything you know about how to search machine data. Most Splunk users are productive in SonQL in an afternoon. There's a command-by-command translation table in the docs and a converter you can paste a query into.

One server with 16 vCPU and 32 GB of RAM handles about 50 GB/day. Retention is bounded by your disk and your object storage, not by us. Above that, Sondar clusters — the architecture runs past 50 TB/day. The full sizing table is in the docs, including agents per node and the marginal cost of each one.

Up to 16 vCPU. A bigger machine counts as more nodes — a 64-vCPU box is four. That's the only dimension: we don't count RAM, gigabytes, events, or hosts. The effective rate works out the same whether you run four small boxes or one large one, so the model neither rewards nor punishes how you pack them.

Yes, in steps — if you outgrow your nodes you add nodes. What won't happen is a bill that moves because you ingested more, kept data longer, added tags, or stopped sampling. Nothing you do inside the product generates a line item.

Yes, genuinely. Licenses are signed keys your instance verifies offline against a public key baked into the binary — there is no activation server to reach, so Sondar never calls home. Offline update bundles are available on every tier including Community; patching a disconnected install is not a paid feature. Enterprise adds tooling around those bundles — signed pipelines, staged rollout, rollback orchestration.

It's already on your infrastructure — we never had it. Cold-tier data sits in your object storage in a format you can read without us, your instrumentation is OpenTelemetry so it repoints anywhere, and our escrow agreement releases source on insolvency or discontinuation. The terms are published, not just referenced.

Correct, and worth being explicit about since we sell a single-node production tier. Two things make it less bad than it sounds. Most of your data already lives in your own object storage — the hot window on local disk is the only part at risk, and it's days, not months. And we continuously snapshot that window plus config and metadata to your bucket, so recovery is: start a new node, point it at the same bucket. RPO under 5 minutes, RTO under 15. We run a restore in CI on every release. If you need genuine HA, that's three nodes — physics, not a sales floor.

Because paywalling SAML is a tax on security, and we're not going to charge you to log in safely. Basic SSO is in Community. What's on Team is the administration layer around it — SCIM provisioning, fine-grained RBAC, audit logging, data masking — which is genuinely what larger deployments need and genuinely what costs us to build and support.

Not yet on SOC 2 — our observation window opens January 2027, with a Type II report expected Q3 2027. Worth noting what SOC 2 does and doesn't cover here: it audits how a vendor handles your data, and we never receive your data. For the same reason we're generally not a HIPAA Business Associate and no BAA is required — the PHI never leaves your environment. What we have today: a third-party penetration test, an independent source code audit, an SBOM with every release, signed reproducible builds, and a published vulnerability disclosure policy.

Sondar is built in Mountain View, California. The whole team is in the Bay Area — founder, engineering and support — and I answer the tickets myself. The more useful half of that answer is what it means for your risk: Sondar runs entirely inside your network and we never receive your data, so there is no vendor to breach that holds your telemetry. For the binary itself we publish an independent source code audit scoped to backdoors and undisclosed telemetry, a full penetration test, an SBOM with every release, and signed reproducible builds. We're small and new, and we'd rather hand you those than ask you to take our word for it.