One codebase, two operating postures: On-Premise Sovereign or Dedicated-Cell SaaS.
EventLake ships as two self-contained Go binaries — EventLake Core (the analytical, storage, and execution server) and EventLake Sensor (the host and network agent) — with zero external database, broker, or JVM runtime dependencies. You choose whether those binaries run on your own hardware or in a cell we operate for you.
1 · The two deployment postures
Both postures run the exact same engine, schema, and 9 product lines. Neither posture phones home with your security events.
On-Premise Sovereign & Air-Gapped
You deploy EventLake Core on bare metal or virtual machines inside your own data centre, sovereign cloud, or air-gapped enclave. Your events are written to your disks, in your jurisdiction, under keys you hold.
- Zero outbound telemetry: No call-home beacon is required to run. Licence files and threat-intelligence bundles can be imported across an air gap and verified offline by Ed25519 signature.
- Commercial metering: Priced by sustained terabytes per day (TB/day) with a 95th-percentile burst allowance (Pricing).
- Graceful licence expiry: If a licence lapses, detection, blocking, approval gates, privacy/DPDP erasure, and read-only evidence access continue uninterrupted; only forward authoring and feed updates pause.
- Hardware sizing: Compute your exact vCPU, RAM, NVMe hot-tier, and object-tier footprint from your own event rates on Sizing your estate.
Dedicated-Cell SaaS
We provision and operate EventLake Core for your organisation, while your hosts and collectors ship telemetry over mTLS on port 443 to the dataplane endpoint.
- Cryptographic tenant boundary: Tenancy derives from the authenticated API/Sensor key and in-process RBAC, never from a shared unauthenticated URL parameter.
- Commercial metering: Priced by gigabytes per day (GB/day) across the same 9 product lines and bundle tiers (Pricing).
- Identifier minimisation on ingest: Device serial numbers, phone numbers, SIM identifiers, and MAC addresses from MDM telemetry are dropped at ingest rather than stored (Trust).
- Customer-agreement residency: Region, backup topology, and support-access controls are bound in your customer agreement.
2 · Reference network & trust topology
Whether hosted by you or by us, the network surface separates the sensor/agent dataplane from the operator console over standard TLS 1.3 (`:443`), so sensors inside restricted segments need no non-standard firewall ports.
3 · Side-by-side responsibility matrix
What changes between On-Premise and SaaS — and what remains identical by construction.
| Dimension | On-Premise Sovereign / Air-Gapped | Dedicated-Cell SaaS |
|---|---|---|
| Data residency & disk custody | Your servers, your disks, your jurisdiction. EventLake has zero network path to your storage. | Infrastructure operated by EventLake in the region specified in your customer agreement. |
| Per-subject encryption root (DPDP / GDPR) | Generated on your node or imported by you with a recomputable fingerprint. | Scoped per tenant; rotatable and revocable with four-eye approval (Trust). |
| Internet connectivity requirement | None required. Operates inside fully air-gapped networks (`--posture self-managed`). | Outbound HTTPS (`:443`) from Sensors and log forwarders to the dataplane endpoint. |
| Binary & release verification | Verify SHA-256 digests and detached signatures before installing (Platform support). | Managed upgrades by EventLake; active release and schema lineage visible in Console. |
| Backups & disaster recovery | Customer-managed via the durable-mode runbook (Getting started). | Managed by EventLake under your customer agreement’s RPO/RTO commitments. |
| Evidence pack portability | Identical: self-contained, Merkle-fingerprinted export readable without a Console licence. | Identical: self-contained, Merkle-fingerprinted export readable without a Console licence. |