Patent-pending compression. Operator-friendly architecture.
Edge agent compresses losslessly inside your cluster, severity-routes hot events to your real-time SIEM, and drops cold chunks straight into your bucket. Five components, two paths, one number on your invoice.
What runs where, and what it sees.
The control plane never receives your raw event data. Compressed chunks live in your bucket, encrypted with your KMS key. Tap Out and Snowman queries decompress on demand.
Tails logs, receives OTLP, classifies severity, compresses every event losslessly into your bucket, and additionally mirrors errors and criticals to your real-time SIEM.
Tenant configuration, model calibration, routing rules, telemetry rollups. Never sees your raw event data.
Compressed chunks land in your bucket with your KMS key. Your data, your egress, your retention rules.
Decompresses on demand for Tap Out audits and ad-hoc rehydration. Streams responses, never buffers.
Snowman engine speaks LogQL, SPL, TraceQL, PromQL. Queries run against your cold storage — egress + a sliver of compute.
Every event goes cold. Critical ones also fire hot.
The cold path is the foundation — every event your stack emits flows through the lossless compression pipeline and lands in your bucket. The hot path is an overlay: ERROR and CRITICAL events are additionally mirrored to your real-time SIEM uncompressed, so alerts fire instantly without sacrificing the complete cold-storage record.
Three principles do the work.
The internal pipeline is patent-pending and the specifics live in the filings. What you can verify from the outside is the outcome — lossless ratios on the corpora published in our benchmarks page, reproducible against your own data.
Calibrated to your environment.
The compression model adapts to the shape of your telemetry, not a generic baseline. That calibration is what makes 15–30× ratios real instead of theoretical.
Several strategies, layered.
Each pass addresses a different kind of redundancy that exists in modern Kubernetes and OTLP traffic. None of them depend on dropping data — every byte survives.
SHA-256 chain on every chunk.
Lossless isn't a marketing claim. The integrity manifest on each chunk is the proof — round-trip the bytes, the hash matches, full stop.