Enterprise

Observability you own. End of clause.

CloudGrid is the OpenTelemetry-native platform you deploy inside your own perimeter. Telemetry stays in the environment you control, and procurement-grade questions have one-line answers here.

The review path for a self-hosted observability platform.

Enterprise adoption normally starts with the same concerns: data location, privacy, license fit, identity, blast radius, and cost control. CloudGrid is designed so those answers are direct and linked to product boundaries.

Security & Audit
“Where does telemetry physically live?”

On disks you operate. CloudGrid is self-hosted; SurrealDB (the v1 storage adapter) runs inside your VPC, on-prem, or in your regulated cloud. Your spans, logs, and metrics stay inside the deployment you control.

Self-hosted deployment. Storage adapter is swappable; the database lives where you run it.

Privacy & DPO
“What about PII inside spans, logs, datasets, or AI outputs?”

Redaction is owned by the OTel pipeline and dataset policies you control. CloudGrid stores what you send and keeps evaluation datasets, observed outputs, reasons, and source links inside your deployment boundary. Provider settings are stored as references; raw provider secrets stay server-side.

Telemetry, datasets, evaluation results, and provider settings stay project-scoped and self-hosted.

Legal & Procurement
“What is the license, and what are the IP & sub-processor risks?”

Apache 2.0 with Commons Clause. Internal company use and use inside your own products are permitted. Commercial SaaS, white-label, hosted resale, or managed-service offerings are available through a separate agreement. One source-available distribution, source review end-to-end, and zero CloudGrid sub-processors touching your telemetry.

Apache 2.0 + Commons Clause. Source-reviewable distribution. Zero telemetry sub-processors.

Identity & Access
“How do users sign in and how are sessions protected?”

Deployed mode uses GitHub, Google, or Microsoft Entra ID through a BFF-managed session: HttpOnly cookies, server-side OAuth exchange, and provider tokens kept out of browser storage. Project membership is enforced server-side at every query and live subscription.

OIDC/OAuth. BFF-managed sessions. Project membership enforced at read time.

Risk & Compliance
“What is the blast radius if something goes wrong?”

Bounded by a request/reply contract. Public services stay on the BFF and bridge side of the boundary. Storage services own query semantics and enforce authorization, so database access stays inside private services.

BFF uses bridge contracts. Storage clients stay inside private services.

Finance & FinOps
“Will observability costs grow with traffic the way our SaaS bills do?”

CloudGrid pricing is independent of telemetry volume. You pay for compute and storage in your cloud, on hardware you control. Costs scale with infrastructure capacity rather than span, host, or GB meters.

Self-priced. Volume scaling is a capacity-planning question.

Clear for operators. Flexible for partners.

CloudGrid's public license is designed for self-hosted adoption with one reviewable source-available distribution. Product companies can use it for their own systems. Service providers, white-label vendors, and hosted observability businesses can use a commercial license when CloudGrid itself becomes the product being offered.

The short version: use it to observe your products; use the commercial path when CloudGrid becomes your hosted, white-label, or managed-service offer.

Use CloudGrid in your own environment

Allowed by default

Run CloudGrid for your company, your teams, and your own products. You can study the source, modify it, deploy it internally, and use it to observe commercial systems you operate.

Offer CloudGrid as your own SaaS or white-label product

Commercial path

Hosted access, white-label packaging, managed hosting, embedded observability products, and commercial services built substantially around CloudGrid can be covered by a separate commercial license.

What leaves your perimeter is what you wire to leave.

CloudGrid runs inside your infrastructure and renders traces from services you operate. Outbound channels are the ones you configure — your SSO IdP for sign-in, and your model provider when an enabled evaluation or optimization target needs that provider.

  • Allowed by default: inbound OTLP from your senders, outbound SSO callbacks to your IdP.
  • Opt-in integrations: evaluation target → model provider, alert routing to Slack / PagerDuty, etc.
  • Telemetry stays local: CloudGrid runs inside your deployment boundary.
YOUR PERIMETER VPC · on-prem · regulated cloud Your OTLP senders SDKs · collectors · agents SSO IdP GitHub · Google · Entra LLM provider (optional) only when enabled otlp-collector Go · :4317/:4318 CloudGrid Core bridge · storage · query control-plane · live AI evaluation (optional) GraphQL BFF React · live subs SurrealDB (your disks) storage adapter v1 local boundary Everything stays inside your perimeter except what you explicitly wire to leave. SSO callbacks ↔ your IdP · LLM calls ↔ your provider · telemetry stays in your deployment.

Control map for security and operations.

A practical map of which controls CloudGrid enforces in code, which controls are operated in your environment, and which integration surfaces are still evolving.

Control Status Note
Data residency supported You choose the region.
Self-hosting supported Local, Compose, Kubernetes.
SSO (OIDC/OAuth) supported GitHub, Google, Microsoft Entra ID.
RBAC — company + project roles supported admin / user · viewer / editor / admin.
Project isolation supported API, message, persistence layers.
Structured logs (JSON + trace context) supported One JSON object per line, Kubernetes-ready.
Read authorization on every query and subscription supported Live subs respect the same auth as queries.
Audit log of admin actions your control Ship it via OTLP into the same CloudGrid.
Retention policy per project supported Configurable in control-plane.
PII redaction your control Done in your OTel pipeline before ingest.
Encryption at rest your control SurrealDB + your filesystem / volume encryption.
Encryption in transit your control TLS at the BFF / collector — your terminator of choice.
Backup / DR your control SurrealDB backups, your DR posture.
Alerting routing to PagerDuty / Opsgenie / Slack maturing Foundations shipped; integrations evolving.
Long-term cold storage offload on the roadmap Future storage adapter.

The procurement-grade summary.

Start here when security, legal, finance, or platform leadership needs a compact view of what CloudGrid is, where data lives, and which operational areas remain under your control.

License
Apache 2.0 + Commons Clause
Commercial SaaS / white-label
Available by separate license
Self-hostable
Yes — primary deployment model
Telemetry sub-processors
Zero CloudGrid-operated sub-processors
Telemetry egress from CloudGrid
Stays inside your deployment by default
Auth (deployed)
GitHub · Google · Microsoft Entra ID via OIDC/OAuth
Session model
BFF-managed HttpOnly cookies
Data residency
Wherever you deploy
Isolation primitive
Project (API, message, persistence)
OTLP ingest
HTTP :4318 + gRPC :4317 — traces, logs, metrics
AI evaluation
Project-scoped datasets, evaluations, comparisons, and optimization evidence
Backups & DR
Your control — SurrealDB tooling + your runbook
Cost model
Self-priced compute + storage

Bring it past the security review.

The Handbook has the operational detail — deployment topology, SSO setup, isolation model, scaling guidance. The compare page is for when you want to put CloudGrid against your current vendor on a single page.