Security
What you can verify, and what we don't have yet.
Sondar runs inside your network and never receives your telemetry. That changes which assurances are meaningful, so this page states the status of each one plainly and with a date.
Sondar never calls home.
Licenses are signed keys your instance verifies offline against a
public key compiled into the binary. There is no activation server to
reach and no telemetry endpoint to block. Community needs no key at
all — docker run just works.
The consequence, stated because you'd work it out anyway: we cannot measure Community deployments. We use download counts and we are not going to quietly instrument it instead.
Expiry and overage warn. They never stop ingest.
A monitoring tool that halts over a licensing edge case will do it mid-incident. Sondar warns in-product and keeps ingesting through license expiry and through node overage.
A full disk is decided per index. When a node's disk passes the high watermark, Sondar deletes the oldest data of indexes set to age out (the default) and keeps ingesting. An index set to stop and alert, as the audit index is by default, keeps every record: if only such data is left, the server first logs a warning naming it, and at the last watermark writes to that node stop rather than delete anything.
Artifacts
Status, with dates.
SBOM with every release
ShippingCycloneDX, attached to each release artifact. More important without published source, not less — it is the visibility a reviewer actually gets.
Signed release manifest
ShippingEvery release lists every file it ships and signs the list; the server checks it at boot and refuses to start if a file has been changed. That is tamper detection inside your network, not yet a signature you can check with public tooling.
Sigstore signatures
PlannedSigstore / cosign signatures you can verify yourself with public tooling. Not shipping yet, so we do not claim it. We do not claim reproducible builds either: nothing builds twice and compares yet.
Vulnerability disclosure policy
ShippingPublished, with a response SLA. security@sondar.dev, and a real human reads it.
Dependency scanning, web front end
ShippingEvery build checks the production dependencies of the browser application against the npm advisory database, and fails on any new critical or high advisory until it is fixed or accepted with a written reason.
Container and server-dependency scanning
ShippingEvery push scans the server image's base -- its operating-system packages -- and the server's Java dependencies, and fails on any new critical or high vulnerability. Each one already known is listed with the version that fixes it -- or, where no fix exists, why it cannot reach the product -- and tracked until it is gone.
SOC 2 Type II
Not scheduledRevisited if we run a hosted service or a customer needs it. Until then we complete your security questionnaire on request — see below for why SOC 2 is the wrong control set for software you install.
FIPS-validated crypto build
Not plannedOnly relevant to government and defense, which we have deliberately excluded as a segment. We would rather say so than imply a roadmap.
The certification question
Why SOC 2 is the wrong question here — and HIPAA too.
SOC 2 audits how a vendor handles your data. We never receive your data. Your telemetry is written to your disks and your object storage by software running on your machines, inside your network boundary. A SOC 2 report about our office access controls and our laptop fleet tells you almost nothing about the thing you actually installed.
For the same reason, we are generally not a HIPAA Business Associate and no BAA is required — the PHI never leaves your environment. That is a selling point rather than a gap, and we would rather explain it than let a questionnaire turn it into one.
We are not chasing FedRAMP either. FedRAMP authorizes cloud services, not software you install inside a boundary that is already authorized.
So we have not scheduled SOC 2. If your vendor-risk process needs answers, we complete your security questionnaire. We will revisit SOC 2 if we run a hosted service, or if a customer genuinely needs the report -- and we will say so here when we do, not before.
The artifacts that should: an SBOM you can diff, a signed manifest the server checks at every boot, and a product that sends nothing home, which you can confirm with an egress rule. All three ship today; what is planned is listed above, and what is not promised is not listed.
Reporting a vulnerability
Mail security@sondar.dev. We acknowledge within one business day and give you a triage decision within five. We will not threaten you, and we will credit you unless you ask us not to.
Where the software comes from
Built in Mountain View, California. The whole team is in the Bay Area — founder, engineering and support. We are small and we are new, and the substantive answer to what that means for your risk is architectural rather than reassuring: nothing you collect leaves your network, and there is no endpoint for it to leave through.
Sondar's storage layer began as a fork of Elasticsearch
6.8, which is Apache 2.0 licensed. What we built on top of it is
the part that differentiates: SonQL, schema-on-read at three points,
and object-storage tiering you can query in place. Attribution and
our statement of modification ship in the NOTICE
file with every release.