Overview
Every serious engineering team eventually runs into the same three problems with their log platform: storage is too expensive to keep logs at volume, PII keeps ending up in logs and creating compliance exposure, and authentication and identity events are invisible — buried in raw strings, never first-class signals.
qeet-logs was built to solve all three, without asking teams to choose between cost, compliance, and observability. It is a structured log management platform designed specifically for multi-tenant SaaS — built on ClickHouse for columnar compression at a fraction of the cost of Elasticsearch, with privacy and multi-tenancy treated as architecture decisions rather than features bolted on afterward.
What makes it different
Three things that no existing log platform does well:
- Identity-aware by default — qeet-logs integrates natively with Qeet ID. Every login, token issuance, MFA challenge, and anomalous auth event is published as a structured, typed log record — not a raw string. Auth anomaly detection understands auth semantics: credential stuffing, impossible travel, unusual geography, burst failures. Your security team gets signal, not noise.
- Privacy-native architecture — PII detection runs at ingestion, before anything is written to storage. Email addresses, IP addresses, session tokens, and national identifiers are masked, hashed, or dropped at the gate based on configurable policy. GDPR Article 17 erasure is supported with pseudonymous user linkage keys and deletion receipts — not a manual process.
- Tenant-scoped by construction —
tenant_idis a required field on every log record, not an optional label. Every query, dashboard, alert, and billing report is naturally tenant-scoped. No cross-tenant data leakage. Per-tenant volume dashboards and budget alerts come out of the box.
On the roadmap
Phase 1 — MVP (Q3–Q4 2026)
The foundation: ingest, store, query, alert.
- OTLP/HTTP endpoint (OpenTelemetry native) and HTTP JSON/NDJSON ingest
- Go SDK with structured logging; Vector and Fluent Bit endpoints
- ClickHouse columnar backend with time-based partitioning and full-text indexing
- Web UI with search bar, filter chips, and live tail with sub-500 ms latency
- LogQL++ query language — SQL-familiar, log-aware
- Basic threshold and absence alerts over email and webhook
- Multi-tenancy with row-level tenant isolation
- Docker Compose and Helm charts for self-hosted deployment
Phase 2 — Privacy and integrations (Q1–Q2 2027)
- Full PII detection pipeline: masking, hashing, field-level and record-level drop
- GDPR Article 17 erasure with deletion receipts and data-residency controls (EU/US)
- Qeet ID auth event stream — structured identity events as first-class log records
- Log correlation via distributed trace IDs
- SDKs for TypeScript/Node.js and Python; adapters for logrus, zap, Winston, Pino
- Loki-compatible ingestion for teams migrating from Grafana stacks
- RBAC via Qeet ID:
logs:read,logs:query,logs:admin,logs:export - Slack and PagerDuty alert integrations
Phase 3 — AI and enterprise (Q3–Q4 2027)
- AI anomaly detection with time-of-day seasonality awareness — unsupervised baselines, no threshold tuning required
- Auth anomaly detection integrated with Qeet ID: credential stuffing patterns, impossible travel, geographic outliers
- Natural-language query powered by Claude — describe what you're looking for, get LogQL++
- Log clustering and root-cause assist
- HIPAA BAA, PCI-DSS log segregation, 99.9% SLA
- Self-hosted and private cloud deployment with dedicated ClickHouse clusters
Who it serves
Platform and SRE engineers at multi-tenant SaaS companies who are either overpaying for logs at volume or flying blind on identity events. Security and compliance engineers at companies handling user data — identity platforms, fintech, healthcare, and B2B SaaS — where PII in logs is not a hypothetical risk but a recurring incident.
The platform is built for teams who want observability that respects their tenants and their compliance obligations, without a custom integration project to get there.
Status
Coming soon. qeet-logs is currently in the requirements and design phase, with Phase 1 development targeting Q3–Q4 2026 alongside five design partners. If you are a platform engineer or CTO at a multi-tenant SaaS company who wants to be involved in the design-partner programme, reach out at partnerships@qeet.in.