Your data never leaves your cloud
Traditional observability platforms require you to ship terabytes of sensitive telemetry data to third-party infrastructure. Sampleless deploys entirely within your cloud account, eliminating data exfiltration risk at the architecture level.
The hidden risk of SaaS observability
Every SaaS observability vendor requires you to send your telemetry data to their infrastructure. This means your logs, traces, and metrics, potentially containing PII, API keys, session tokens, and business-critical information, flow continuously to systems outside your control.
Even with contractual protections, this creates real risk:
- ×Data breaches at your vendor expose your sensitive telemetry
- ×Vendor employees may have access to your raw data
- ×Your data traverses networks you do not control
- ×Compliance auditors must now evaluate your vendor as well
- ×Data residency requirements become your vendor's problem to solve
BYOC eliminates these risks entirely. When your observability platform runs in your cloud, your data never crosses trust boundaries you do not control.
How BYOC protects your data
Security through architecture, not just policy.
Deployed in your account
Sampleless components run as containers in your AWS, GCP, or Azure account. You provision the infrastructure. You control the network.
Data processed locally
All telemetry ingestion, storage, and analysis happens inside your cloud. Logs, traces, and metrics never leave your environment.
Results only, not raw data
When you query the dashboard, only aggregated results (kilobytes) traverse the connection. We never see your raw telemetry.
Your encryption, your keys
Data at rest uses your KMS keys. Data in transit uses TLS 1.3. You control key rotation and access policies.
Designed for regulated environments
Sampleless is architected to support organizations operating under a range of regulatory frameworks. Our dual-write pipeline (queryable analytics alongside immutable archival storage) gives compliance teams both real-time access to telemetry and tamper-proof long-term retention.
Because your data never leaves your cloud, you retain full custody. Your existing cloud provider agreements, IAM policies, encryption configurations, and network controls remain the foundation of your compliance posture. Sampleless extends your observability capabilities without expanding your data exposure.
Regulatory Framework Support
Our architecture supports SEC 17a-4, FINRA 4511, CFTC 1.31, PCI DSS, HIPAA, and SOX requirements through WORM-compliant immutable storage and configurable retention policies. See our detailed compliance documentation for how Sampleless maps to specific regulatory requirements.
Security built into every layer
Encryption everywhere
- TLS 1.3 for all data in transit
- AES-256 encryption at rest
- Your KMS keys, your control
- Automatic key rotation support
Access control
- SAML and OIDC integration
- Role-based access control
- Attribute-based policies
- Complete audit logging
Network isolation
- Deploys in your VPC
- No inbound connections required
- Private endpoints available
- Your firewall rules apply
Data residency
- Deploy in any region
- Multi-region supported
- Data never crosses borders
- Full sovereignty control
SaaS vs BYOC security
See the architectural difference in data protection.
| Security aspect | SaaS vendors | BYOC (Sampleless) |
|---|---|---|
| Raw telemetry location | Vendor infrastructure | Your cloud account |
| Data encryption keys | Vendor-managed | Your KMS |
| Network path | Public internet or VPN | Never leaves your VPC |
| Vendor data access | Full access to raw data | Query results only |
| Compliance scope | Extended to vendor | Your existing boundary |
| Data residency | Vendor regions | Any region you choose |
| Breach exposure | Your data at risk | No data to breach |
Security questions
- Does Sampleless ever see my telemetry data?
- No. All telemetry data is processed and stored entirely within your cloud account. Sampleless receives only aggregated query results (kilobytes, not terabytes) when you use the unified dashboard. Your raw logs, traces, and metrics never leave your environment.
- How does BYOC change the security equation?
- With BYOC, your observability data stays inside your existing cloud environment. Your current infrastructure security controls (encryption, access management, network isolation) apply to your telemetry data automatically. This is security through architecture, not just policy.
- Does Sampleless offer a Business Associate Agreement?
- Yes. For customers in regulated healthcare environments, Sampleless will execute a BAA scoped to our role as a no-view business associate. Because your data never leaves your environment, our BAA reflects a narrow scope. See our compliance page for details.
- How does Sampleless handle encryption?
- Sampleless uses your existing cloud encryption infrastructure. Data at rest is encrypted using your KMS keys. Data in transit uses TLS 1.3. You maintain full control over key rotation, access policies, and audit logging.
- What access does Sampleless have to my cloud account?
- Sampleless requires limited IAM permissions to deploy and manage the observability stack. We follow the principle of least privilege. All permissions are documented, and you can audit them at any time. We never have access to your application data or business systems.
- How do I control who can access observability data?
- Sampleless integrates with your existing identity provider via SAML or OIDC. You can apply your standard IAM policies, role-based access controls, and audit requirements. All access is logged and auditable.
Ready for a security review?
Talk to our team about your security requirements. We can walk through the architecture, answer compliance questions, and discuss your specific needs.