Observability you own. End of clause.
CloudGrid is the OpenTelemetry-native platform you deploy inside your own perimeter. Telemetry stays in the environment you control, and procurement-grade questions have one-line answers here.
The review path for a self-hosted observability platform.
Enterprise adoption normally starts with the same concerns: data location, privacy, license fit, identity, blast radius, and cost control. CloudGrid is designed so those answers are direct and linked to product boundaries.
On disks you operate. CloudGrid is self-hosted; SurrealDB (the v1 storage adapter) runs inside your VPC, on-prem, or in your regulated cloud. Your spans, logs, and metrics stay inside the deployment you control.
Self-hosted deployment. Storage adapter is swappable; the database lives where you run it.
Redaction is owned by the OTel pipeline and dataset policies you control. CloudGrid stores what you send and keeps evaluation datasets, observed outputs, reasons, and source links inside your deployment boundary. Provider settings are stored as references; raw provider secrets stay server-side.
Telemetry, datasets, evaluation results, and provider settings stay project-scoped and self-hosted.
Apache 2.0 with Commons Clause. Internal company use and use inside your own products are permitted. Commercial SaaS, white-label, hosted resale, or managed-service offerings are available through a separate agreement. One source-available distribution, source review end-to-end, and zero CloudGrid sub-processors touching your telemetry.
Apache 2.0 + Commons Clause. Source-reviewable distribution. Zero telemetry sub-processors.
Deployed mode uses GitHub, Google, or Microsoft Entra ID through a BFF-managed session: HttpOnly cookies, server-side OAuth exchange, and provider tokens kept out of browser storage. Project membership is enforced server-side at every query and live subscription.
OIDC/OAuth. BFF-managed sessions. Project membership enforced at read time.
Bounded by a request/reply contract. Public services stay on the BFF and bridge side of the boundary. Storage services own query semantics and enforce authorization, so database access stays inside private services.
BFF uses bridge contracts. Storage clients stay inside private services.
CloudGrid pricing is independent of telemetry volume. You pay for compute and storage in your cloud, on hardware you control. Costs scale with infrastructure capacity rather than span, host, or GB meters.
Self-priced. Volume scaling is a capacity-planning question.
Clear for operators. Flexible for partners.
CloudGrid's public license is designed for self-hosted adoption with one reviewable source-available distribution. Product companies can use it for their own systems. Service providers, white-label vendors, and hosted observability businesses can use a commercial license when CloudGrid itself becomes the product being offered.
The short version: use it to observe your products; use the commercial path when CloudGrid becomes your hosted, white-label, or managed-service offer.
Use CloudGrid in your own environment
Allowed by defaultRun CloudGrid for your company, your teams, and your own products. You can study the source, modify it, deploy it internally, and use it to observe commercial systems you operate.
Offer CloudGrid as your own SaaS or white-label product
Commercial pathHosted access, white-label packaging, managed hosting, embedded observability products, and commercial services built substantially around CloudGrid can be covered by a separate commercial license.
What leaves your perimeter is what you wire to leave.
CloudGrid runs inside your infrastructure and renders traces from services you operate. Outbound channels are the ones you configure — your SSO IdP for sign-in, and your model provider when an enabled evaluation or optimization target needs that provider.
- Allowed by default: inbound OTLP from your senders, outbound SSO callbacks to your IdP.
- Opt-in integrations: evaluation target → model provider, alert routing to Slack / PagerDuty, etc.
- Telemetry stays local: CloudGrid runs inside your deployment boundary.
Control map for security and operations.
A practical map of which controls CloudGrid enforces in code, which controls are operated in your environment, and which integration surfaces are still evolving.
| Control | Status | Note |
|---|---|---|
| Data residency | supported | You choose the region. |
| Self-hosting | supported | Local, Compose, Kubernetes. |
| SSO (OIDC/OAuth) | supported | GitHub, Google, Microsoft Entra ID. |
| RBAC — company + project roles | supported | admin / user · viewer / editor / admin. |
| Project isolation | supported | API, message, persistence layers. |
| Structured logs (JSON + trace context) | supported | One JSON object per line, Kubernetes-ready. |
| Read authorization on every query and subscription | supported | Live subs respect the same auth as queries. |
| Audit log of admin actions | your control | Ship it via OTLP into the same CloudGrid. |
| Retention policy per project | supported | Configurable in control-plane. |
| PII redaction | your control | Done in your OTel pipeline before ingest. |
| Encryption at rest | your control | SurrealDB + your filesystem / volume encryption. |
| Encryption in transit | your control | TLS at the BFF / collector — your terminator of choice. |
| Backup / DR | your control | SurrealDB backups, your DR posture. |
| Alerting routing to PagerDuty / Opsgenie / Slack | maturing | Foundations shipped; integrations evolving. |
| Long-term cold storage offload | on the roadmap | Future storage adapter. |
The procurement-grade summary.
Start here when security, legal, finance, or platform leadership needs a compact view of what CloudGrid is, where data lives, and which operational areas remain under your control.
- License
- Apache 2.0 + Commons Clause
- Commercial SaaS / white-label
- Available by separate license
- Self-hostable
- Yes — primary deployment model
- Telemetry sub-processors
- Zero CloudGrid-operated sub-processors
- Telemetry egress from CloudGrid
- Stays inside your deployment by default
- Auth (deployed)
- GitHub · Google · Microsoft Entra ID via OIDC/OAuth
- Session model
- BFF-managed HttpOnly cookies
- Data residency
- Wherever you deploy
- Isolation primitive
- Project (API, message, persistence)
- OTLP ingest
- HTTP :4318 + gRPC :4317 — traces, logs, metrics
- AI evaluation
- Project-scoped datasets, evaluations, comparisons, and optimization evidence
- Backups & DR
- Your control — SurrealDB tooling + your runbook
- Cost model
- Self-priced compute + storage
Bring it past the security review.
The Handbook has the operational detail — deployment topology, SSO setup, isolation model, scaling guidance. The compare page is for when you want to put CloudGrid against your current vendor on a single page.