Telemetry as a Service
Visibility into what your network is actually doing — traffic behaviour, protocol detail, anomalies — without handing your logs to a third party or opening a hole in your perimeter to get them out.
What sits on your network
A small, low-power appliance on the segments that matter, running its services as hardened Podman containers. It inspects traffic locally from a mirror port. It accepts nothing from the internet and needs no route back in; from your network it accepts only the syslog, traps and agent traffic your devices send it.
Signal, not volume
The useful part of telemetry is knowing what to look at first. Alerting does that today; model-assisted summarisation is coming, and where the model runs matters more than which one it is.
Alerts, not raw volume
Nobody reads a million log lines. High-severity intrusion and host alerts, a node gone quiet, a disk filling: each becomes a notification, with the underlying events one query away in Grafana.
Open models, on hardware we run
Model-assisted triage is in development. It will run open models on GPU hardware we operate, never a hosted model API, so there is no question about what a vendor might retain or train on.
A switch you control
When it ships, model analysis is opt-in per engagement and can be turned off entirely — useful when an auditor asks what processes your data, and you want the answer to be "nothing does."
Where your data lands
Vector ships the compressed stream over the node's WireGuard tunnel into Loki for logs and Mimir for metrics, stored in Cloudflare R2 and read through Grafana. Your data is kept apart from every other client's by the tunnel it arrives on. If your compliance position calls for dedicated infrastructure rather than logical separation, raise it on the call — it changes how we build the deployment.
We notice when the node goes quiet
A node that stops reporting raises an alert within fifteen minutes, and so does a disk filling or a collection service failing. Meanwhile the node buffers to disk, so what it saw during the outage arrives when it reconnects rather than being lost.
Not sure your network is ready for a node?
Four questions decide it — mirror port capacity, outbound policy, management segmentation, and flow export. The checklist walks through each one.