SigNoz

Scope caveat, stated up front: SigNoz is an observability platform, not a SIEM. It is filed under siem-soc because that category is “Enterprise Logging / SIEM / SOC” and SigNoz is a serious answer to the enterprise logging half — the same slot elastic occupies when teams self-host ELK for log retention. It ships no detection content: no rule packs, no ATT&CK mappings, no case management, no SOAR. Do not put it in a SIEM bake-off against microsoft-sentinel or splunk without that caveat. See open taxonomy questions below.

One-liner — Open-source, OpenTelemetry-native observability on ClickHouse: logs, metrics, traces, APM and dashboards in one self-hostable tool, sold as the Datadog alternative whose bill does not scale with hosts or users.

Categories — siem-soc, llm-observability

What it does

SigNoz collects application and infrastructure telemetry over OpenTelemetry — its only ingestion story, deliberately — and stores it in ClickHouse, a columnar database, giving you one queryable backend for the three signals instead of a log tool plus a metrics tool plus a tracing tool. On top of that sit APM (latency/error/throughput per service), distributed tracing with flamegraphs, log management, infrastructure monitoring, exceptions, dashboards and alerting.

Querying is deliberately multi-level: a point-and-click builder, PromQL for metrics, and raw ClickHouse SQL when you need it. Telemetry pipelines are configurable in-product via OpAmp, so you can drop or transform data at the collector without redeploying agents. The site claims 50+ data-source integrations.

Two 2026-era additions matter for this wiki:

• LLM/AI observability — tracing for AI applications built on OpenTelemetry’s GenAI semantic conventions, which is why the page is cross-listed to llm-observability. It is the generalist’s version of that category: traces, spans and cost/latency for model calls, not prompt management, evals or scoring the way langfuse or braintrust do it.
• “Agent Native Observability” — a SigNoz MCP server that lets coding agents (Claude Code, Cursor) query your observability data directly, plus an AI assistant called Noz in SigNoz Cloud. Useful and also worth a threat-model note: an MCP server that exposes production telemetry to an agent is a sensitive-data source, and should be gated like one — see mcp-gateway.

Where it sits in the stack

Foundation layer, siem-soc, on the logging side of that category rather than the detection side. Its role is detective and out-of-band: it is where telemetry lands so you can ask what happened. For AI specifically it is a plausible sink for ai-gateway traces — bifrost, litellm and portkey all emit OpenTelemetry, which SigNoz ingests natively with no adapter.

What it is not: it does not correlate security events, score user behaviour, run playbooks, or hold the case record. If SigNoz is your log store, your detection and response still live in a real SIEM or with an MDR provider. The realistic pattern for a fund is SigNoz for engineering telemetry alongside microsoft-sentinel or equivalent for security — two systems, not one.

Deployment & architecture

• Community Edition — free, self-hosted, MIT-licensed core (see the licence gotcha below). Runs on your own infrastructure; nothing leaves your tenancy.
• SigNoz Cloud (Teams) — managed, with a choice of US, EU or India data region. Data does leave your tenancy here.
• Enterprise — dedicated cloud environment, bring-your-own-cloud managed by SigNoz, or self-hosted with a support contract. The BYOC and supported self-hosted options are the ones that matter to a regulated firm.
• data_leaves_tenancy: partial because it is entirely a function of which of those you pick.
• Retention is a purchased parameter, not a fixed policy: logs and traces at 15 / 30 / 90 / 180 days or 1 year; metrics at 1 / 3 / 6 or 13 months. For anything with a records-retention obligation, note that a year is the published ceiling on the log/trace side.

Positioning & differentiators

• OpenTelemetry-native by conviction, not by adapter. SigNoz’s core argument against datadog, New Relic and Dynatrace is that those absorbed OTel into proprietary agents and pricing, while SigNoz stores OTel semantics end-to-end — so your instrumentation is portable out of SigNoz too. That is a real lock-in argument and the most credible thing it says.
• Pricing shape, not just level. No per-host and no per-user charge, and no custom-metric surcharge — the two line items that make Datadog bills unpredictable. You pay per GB ingested and per million metric samples.
• Self-hostable at full function, which is the differentiator versus every SaaS observability vendor and the reason it shows up in regulated shops.
• vs elastic — the closest comparison in this category. Both are open-source-rooted and self-hostable. Elastic brings a real security product (Elastic Security, detection rules, SIEM positioning) and a much larger ecosystem; SigNoz brings a far simpler operational story (ClickHouse, one backend, no cluster-tuning folklore) and OTel-first design. If you want SIEM, Elastic. If you want engineering telemetry without operating Elasticsearch, SigNoz.
• Very large OSS footprint for its funding — 31.8k stars, 2.4k forks, weekly releases. Community traction substantially outruns the ~$6.5M raised.

Ownership, funding & M&A

Independent, VC-backed, open-core. Founded by Pranay Prateek and Ankit Nayan; Y Combinator alum; US and Bengaluru presence. Repo dates to 2021-01-03, company activity from 2020.

Funding is ~$6.5M total: ~$1.1M post-YC in 2021 (SignalFire plus angels), then $5.4M announced 2023-09-28 led by SignalFire, with Uncorrelated Ventures, Alumni Ventures, and angels including GitHub co-founder Tom Preston-Werner. As of 2026-08-16, searches found no Series B and no acquisition.

The honest read: the last raise was nearly three years ago against a project with 31k stars and a weekly release cadence. Either cloud revenue is carrying the company or another round is due; there is no public evidence either way. That is the main viability question, and the mitigant is the same one as always for open-core — the MIT-licensed core self-hosts, so a bad outcome for SigNoz Inc. does not immediately strand your telemetry.

Who should choose them / anti-fit

• Good fit: an engineering-led firm that wants unified logs/metrics/traces, refuses to send telemetry to a US SaaS or needs a specific data region, is already instrumenting with OpenTelemetry, and is tired of per-host observability bills. Also a reasonable sink for AI-gateway traces without buying a dedicated LLM-observability tool.
• Anti-fit: anyone shopping for a SIEM. If the requirement is security detection, correlation, case management, compliance reporting or a SOC workflow, this is the wrong category of product entirely — see microsoft-sentinel, splunk, google-secops. Also an anti-fit for a small team with no appetite to run ClickHouse, and for anyone who needs the enterprise controls (SSO/SAML) at a small footprint, since those start at $4,000/mo.

Known weaknesses / gotchas

• “Open source” is open core, and the split lands exactly where an enterprise cares. The root LICENSE puts everything outside ee/ and cmd/enterprise/ under MIT, and everything inside ee/ under a separate SigNoz enterprise licence. The ee/ tree includes authn, authz, auditor, anomaly, gateway, licensing and querier — i.e. authentication, authorization, audit logging and anomaly detection are the paid side. GitHub reports the repo licence as “NOASSERTION” for this reason. Budget for Enterprise if you need SSO/SAML and audit trails.
• Not a SIEM — restated because it is the most likely way to misuse this page. No detection rules, no correlation content, no case management, no SOAR, no UEBA.
• Still pre-1.0 at v0.137.1 (2026-08-14), with ~1,500 open issues. Release cadence is weekly, which is a strength and a churn risk.
• SSO/SAML is gated behind the $4,000/mo Enterprise minimum, a steep step from the $49/mo Teams tier for what most regulated firms consider a baseline control.
• Certifications are claimed on the website, not evidenced. SOC 2 Type II and HIPAA are asserted; no report period, auditor or trust-centre artefact was retrieved. Verify before relying on them.
• You own the ClickHouse. Self-hosting means operating and scaling a columnar database under high-cardinality telemetry — simpler than Elasticsearch, not free.

Compliance & FS traction

Website claims SOC 2 Type II and HIPAA, with SSO/SAML, query API keys and US/EU/India data residency. No FedRAMP, no ISO 27001 found. No named financial-services customers and no FS case studies located — fs_traction: unverified. Nothing about the product assumes enterprise scale in the negative sense: a mid-size firm can run it.

Commercial

Community Edition free (MIT core). Teams Cloud from $49/mo (site notes a cut from $199), usage-based: $0.30/GB ingested for logs, $0.30/GB for traces, $0.10 per million metric samples; the $49 includes roughly 163 GB of logs/traces or ~490M metric samples. Enterprise from $4,000/mo minimum, adding SSO/SAML, dedicated support, volume discounts, BAAs, migration assistance and an SLA. Startups under three years old with <30 staff and <$6M raised get 50% off.

Competitors / alternatives

elastic (closest, and the one with an actual security product), splunk, sumo-logic, crowdstrike-logscale, microsoft-sentinel, google-secops in siem-soc; datadog, langfuse, helicone, arize-phoenix in llm-observability. Grafana/Loki/Tempo is the other obvious OSS alternative and has no page here.

Open questions / to verify

• Category fit. SigNoz stretches siem-soc toward pure observability. Either the category is genuinely “enterprise logging or SIEM” (in which case datadog and Grafana arguably belong too), or SigNoz should move. Raised in taxonomy-gaps.md; flagged for the human.
• SOC 2 Type II report period and auditor; HIPAA attestation basis. Claimed on the site, not evidenced.
• Whether any funding has closed since 2023-09 — nothing public, and the gap is large enough to matter for vendor-risk assessment.
• Headcount and cloud-revenue signal; no reliable figure found.
• Which specific capabilities moved into ee/ over time — the split is documented by directory, not by a feature-comparison table.
• Real-world ingest ceilings for self-hosted ClickHouse at, say, 1 TB/day; no independent scaling write-up found.
• Whether the SigNoz MCP server supports scoped/read-only credentials, given it exposes production telemetry to an agent.
• Any financial-services references at all.

Sources

• SigNoz/signoz (GitHub repo, LICENSE, ee/ tree via API) — fetched 2026-08-16 — supports: created 2021-01-03, 31,847 stars / 2,426 forks / 1,509 open issues, v0.137.1 (2026-08-14), MIT-core-plus-ee/ licence split and the contents of ee/; confidence: high (primary, machine-read).
• SigNoz pricing — fetched 2026-08-16 — supports: $0.30/GB logs and traces, $0.10/M metric samples, $49/mo Teams, $4,000/mo Enterprise minimum, retention options, SSO/SAML tiering, BYOC/self-hosted-with-support, startup discount; confidence: high (vendor’s own price list).
• SigNoz homepage — fetched 2026-08-16 — supports: OpenTelemetry-native positioning, ClickHouse backend, APM/logs/traces/infra scope, PromQL/ClickHouse querying, OpAmp pipelines, LLM observability, MCP server and “Noz”, SOC 2 / HIPAA claims, US/EU/India regions, competitive framing vs Datadog/New Relic/Grafana/Dynatrace; confidence: medium (vendor marketing).
• We’ve raised $6.5M to build the future of open source observability (SigNoz blog) — fetched 2026-08-16 — supports: $6.5M total, $5.4M round, SignalFire lead, YC lineage, founders; confidence: high (primary).
• SigNoz raises $5.4 Mn in a new round (Entrackr, 2023-09) — fetched 2026-08-16 — supports: independent corroboration of the 2023-09-28 round, investor list including Tom Preston-Werner; confidence: medium (press).

History

• [2026-08-16] Page created and researched in one pass (user-requested addition, not a seed/CSV row). Filed siem-soc as requested with an explicit scope caveat — SigNoz is observability/enterprise logging, not a SIEM (no detection content, no case management, no SOAR); cross-listed to llm-observability on the strength of its OTel GenAI tracing. Established: independent open-core, ~$6.5M raised, last round 2023-09-28 (SignalFire), no M&A; MIT core with ee/ (authn/authz/auditor/anomaly) under a separate enterprise licence; SSO/SAML behind a $4,000/mo minimum. Category-fit question raised in taxonomy-gaps.md. 1 source cached.