Pricing

One rate. Any window. Search included.

Sasquatch is priced per GB of raw telemetry ingested at the edge. Compression, retrieval, retention windows, and query compute are not separate line items. Below is what shifts on your invoice when Sasquatch lands in front of your existing SIEM.

~91% savings·12-year retention·zero query fees·BYO cloud
Get a demoSee cost breakdown
End-to-end cost · per GB
Before
$2.15
−91%
After Sasquatch
$0.19
18×
Logs
27×
Traces
30×
Metrics
What the bill does

Same data. Same compliance. ~91% less spend.

Before Sasquatch
$2.15
/ GB end-to-end

Every GB is charged 5 times, across 5 invoices.

  • Extended retention$0.16
  • Egress + NAT$0.14
  • Cloud storage$0.25
  • Indexing + retention$1.50
  • SIEM subscription$0.10
−91%
With Sasquatch
$0.19
/ GB end-to-end

Same data. Same compliance. ~91% less spend.

  • Retention (compressed)$0.07
  • Egress (compressed)$0.01
  • Cloud storage (compressed)$0.02
  • Indexing (hot only)$0.08
  • SIEM subscription (hot only)$0.01

Up to 94.5% with Sasquatch Relay. Hot-path events (errors, criticals) ship to your SIEM with standard gzip by default — already a major cut. Customers who route hot traffic through the optional Sasquatch Relay get the same lossless compression as cold storage, pushing total reduction to the cold-path ceiling with no loss of real-time alerting.

The cost you didn't see coming

In most SIEMs, querying your data costs more than storing it.

Search is priced per compute-unit — Splunk SVCs, Datadog scanned-bytes, New Relic query-hours. The more your team actually uses the product, the more the bill grows. That's the opposite of what a query engine should do.

Typical enterprise SIEM
  • Search / query compute~55%
  • Ingestion~35%
  • Storage~10%
Sasquatch
  • Query compute~4%
  • Ingestion~12%
  • Cold storage~84%

Sasquatch queries run against your own cold storage. The marginal cost per query is cloud egress plus a sliver of compute, not a licensed search unit.

Retention shouldn't be a pricing tier

Pick any window. Pay your cloud's storage rate. Done.

Enterprise SIEMs make you pick a retention window and charge per tier. Extend from 5 days to 30 and the bill jumps ~4×. Extend to 90 and it's often an order of magnitude.

Typical SIEM retention tiers
Published enterprise rate multipliers
3-day retention
1.0×
5-day retention
1.3×
15-day retention
2.1×
30-day retention
4.2×
90-day retention
~12×

Teams settle for 5-day windows because longer retention multiplies the bill. Compliance asks for 365.

Sasquatch retention
One rate, any window
3 days
1.0×
30 days
1.0×
90 days
1.0×
12 months
1.0×
12 years
1.0×

Retention is a storage-class decision. S3 / GCS / Azure economics apply — the product cost doesn’t change.

The alternatives

The three options teams settle for — and why each costs you something.

CHOICE A
$$$$$
Pay the full bill
Data: Intact
  • •Unsustainable at scale
  • •CFO pushback every budget cycle
  • •Every new service compounds the line
CHOICE B
$$$$$
Drop logs at the source
Data: Compromised
  • •Compliance gap (SOC 2 · HIPAA · PCI)
  • •Blind during incidents
  • •Audit-hold orders you can’t fulfill
CHOICE C
$$$$$
Filter · dedupe · summarize
Data: Compromised
  • •Auditors reject "1,247 similar events suppressed"
  • •Forensic investigations stall
  • •Tool fees eat most of the savings

None of these are the answer. Sasquatch is the fourth option — keep every byte, pay a fraction of the bill.