Keep regulated data out of
your telemetry vendor.
Health records, personal data, card data: telemetry picks it up whether anyone means it to or not. Ultraviolet keeps all of it inside your environment — and collects less of it in the first place.
The problem
Observability data is full of things nobody decided to collect: a patient ID in a log line, a card number in a failed query, an email address in a form a session replay recorded, a customer's question in a prompt sent to a language model. Nobody wrote code to send it anywhere — it came along with the telemetry.
Send that telemetry to a cloud vendor and your compliance boundary now includes them: another processor to assess, another agreement to sign, another place your regulated data lives, and another place it can leak from. Teams end up choosing between seeing their systems clearly and keeping their data where it belongs.
Ultraviolet removes that choice. It runs entirely inside your environment, so telemetry never leaves it — and it's careful about what it collects to begin with.
Collected with care
Database values scrubbed
Captured SQL keeps its shape and loses its values: string and number literals become ?, and so do values echoed back in database errors. On by default.
No request bodies or query strings
Traffic is recorded as method, path, status and timing. Query strings are stripped and request and response bodies are never recorded.
Browser sessions masked
Real user monitoring masks text and form input by default. Session replay is off until you turn it on, and you can mask or block any element.
AI conversations not kept
If your apps call language models, prompts and responses are removed as they arrive. Only the metadata stays: model, tokens, timing, errors.
Investigations stay inside
AI investigation uses a model you host, or none at all. If you choose a model outside your network, log lines can be left out of what it sees.
Logs shaped before they are kept
Pipeline rules drop logs that match, sample noisy ones, and delete fields — tested first with a dry run that counts what a rule would affect.
The controls your auditors ask about
- Single sign-on and roles
- Your identity provider, with groups mapped to viewer, editor and admin.
- Audit trail
- Who signed in, what changed and what was denied — searchable, and built to forward into your SIEM.
- Retention you set
- How long traces, logs and metrics are kept, per type, on your own storage.
- Backups in your environment
- Scheduled or on demand, restored only with confirmation.
Questions teams ask
- Does any of our telemetry reach Ultraviolet?
- No. Everything runs in your environment. The optional connected mode, for automatic license renewal, sends license usage metadata only — license, customer, node counts — and air-gapped installs don't use it at all.
- Can sensitive data still end up in what's collected?
- Yes, if an application puts it there: URL paths and cache keys are recorded as they are, so an email address in a path is kept; and logs contain whatever your applications write. Pipeline rules can drop or trim logs; the rest stays inside your environment, under your access controls and retention.
- Does this make us compliant with HIPAA, PCI DSS or GDPR?
- Compliance belongs to your environment and your processes, and your compliance team decides it. What Ultraviolet changes is the scope: your telemetry stays inside the boundary you already secure and audit, instead of extending it to an observability vendor.
- Who at our company can see what?
- Everyone signs in through your identity provider and gets a role. Viewers read, editors change alerts, dashboards and pipeline rules, admins control access, retention and upgrades — and every change is in the audit trail.
See it for yourself
The live demo runs the whole product on a real cluster, no sales call needed. Or talk to us about running an evaluation on your own infrastructure, where no data leaves your environment during the trial either.
Run it in your own cluster this week.
A 30-minute call, then an evaluation core on your infrastructure. You will see your own services, traces and logs — from your own traffic — before you decide anything.
- No data leaves your environment, including during the trial
- Helm install, works fully air-gapped
- You talk to the engineers who built it