Security
What you can verify, and what we don't have yet.
Sondar runs inside your network and never receives your telemetry. That changes which assurances are meaningful, so this page states the status of each one plainly and with a date.
Sondar never calls home.
Licenses are signed keys your instance verifies offline against a
public key compiled into the binary. There is no activation server to
reach and no telemetry endpoint to block. Community needs no key at
all — docker run just works.
The consequence, stated because you'd work it out anyway: we cannot measure Community deployments. We use download counts and we are not going to quietly instrument it instead.
Expiry and overage warn. They never stop ingest.
A monitoring tool that halts over a licensing edge case will do it mid-incident. Sondar warns in-product and keeps ingesting — through license expiry, through node overage, and through disk pressure, where it ages out the oldest data rather than refusing the newest.
Regulated teams who need the opposite can set
stop-ingest-and-alert. Availability is
the default; compliance is the option.
Artifacts
Status, with dates.
Independent source code audit
Commissioned · Q4 2026A named US firm of the Trail of Bits / Cure53 / Doyensec class reads the source, explicitly scoped to confirm no backdoors and no undisclosed telemetry. Published in full — a summary letter is what vendors publish when they have something to hide.
Third-party penetration test
Commissioned · Q4 2026A full test of the running system, not a scan. Report published in full, findings and all.
SBOM with every release
ShippingCycloneDX, attached to each release artifact. More important without published source, not less — it is the visibility a reviewer actually gets.
Signed, reproducible builds
ShippingSigstore / cosign signatures, and a build you can reproduce to confirm the binary is the one we built.
Vulnerability disclosure policy
ShippingPublished, with a response SLA. security@sondar.dev, and a real human reads it.
Dependency and container scanning
ShippingIn CI on every build, with results in the release notes.
SOC 2 Type II
Observation window opens Jan 2027 · report expected Q3 2027Not because it is the right control set for software you install — see below — but because vendor questionnaires ask regardless.
FIPS-validated crypto build
Not plannedOnly relevant to government and defense, which we have deliberately excluded as a segment. We would rather say so than imply a roadmap.
The certification question
Why SOC 2 is the wrong question here — and HIPAA too.
SOC 2 audits how a vendor handles your data. We never receive your data. Your telemetry is written to your disks and your object storage by software running on your machines, inside your network boundary. A SOC 2 report about our office access controls and our laptop fleet tells you almost nothing about the thing you actually installed.
For the same reason, we are generally not a HIPAA Business Associate and no BAA is required — the PHI never leaves your environment. That is a selling point rather than a gap, and we would rather explain it than let a questionnaire turn it into one.
We are not chasing FedRAMP either. FedRAMP authorises cloud services, not software you install inside a boundary that is already authorised.
We are still doing SOC 2, because vendor-risk questionnaires ask regardless and "in progress, report expected Q3 2027" clears most of them. We just want to be clear that it is not the artifact that should convince you.
The artifacts that should: an independent firm reading the source, an independent firm attacking the running system, an SBOM you can diff, and a build you can reproduce.
Reporting a vulnerability
Mail security@sondar.dev. We acknowledge within one business day and give you a triage decision within five. We will not threaten you, and we will credit you unless you ask us not to.
PGP key and the full policy are in the docs.
Where the software comes from
Built in Mountain View, California. The whole team is in the Bay Area — founder, engineering and support. We are small and we are new, and the substantive answer to what that means for your risk is architectural rather than reassuring: nothing you collect leaves your network, and there is no endpoint for it to leave through.
Sondar's storage layer began as a fork of Elasticsearch
6.8, which is Apache 2.0 licensed. What we built on top of it is
the part that differentiates: SonQL, schema-on-read at three points,
and object-storage tiering you can query in place. Attribution and
our statement of modification ship in the NOTICE
file with every release.