How it works

Splyntra is a single OpenTelemetry-native pipeline. Your agent emits spans; one collector ingests them; security and evaluation services enrich them; and the results land in two stores that back every screen in the dashboard. Observability and security are not two products bolted together — they are the same spans, scored and viewed two ways.

The pipeline at a glance

                            ┌────────────────────────────────────┐
  Your agent                │            Splyntra                 │
  ┌──────────────┐          │                                     │
  │ Python SDK   │          │   ┌───────────┐    ┌────────────┐   │
  │ TypeScript   │  OTLP/   │   │ security  │    │ ClickHouse │   │
  │ SDK          │─ HTTP ──▶│──▶│ service   │──▶ │ traces /   │   │
  │ raw OTel     │  :4318   │   │ (8001)    │    │ logs /     │   │
  └──────────────┘          │   └───────────┘    │ metrics    │   │
                            │   ┌───────────┐    └────────────┘   │
                            │   │ collector │    ┌────────────┐   │
                            │   │ ingest +  │──▶ │ Postgres   │   │
                            │   │ query API │    │ metadata   │   │
                            │   └───────────┘    └────────────┘   │
                            │   ┌───────────┐         ▲           │
                            │   │evaluation │         │           │
                            │   │ (8002)    │    ┌────┴───────┐   │
                            │   └───────────┘    │ web / BFF  │   │
                            │        ▲           │ (3000)     │   │
                            │        │           └────────────┘   │
                            │   NATS · Valkey · MinIO             │
                            └────────────────────────────────────┘

The data flow, step by step

Your agent emits spans. The Python or TypeScript SDK auto-instruments your frameworks and providers, or you send raw OpenTelemetry. Everything is OTLP/HTTP over the same endpoint — http://localhost:4318 self-hosted, https://ingest.splyntra.com on Cloud.
The collector ingests. The collector accepts OTLP at /v1/traces and /v1/logs, authenticates the ingest key (Authorization: Bearer <key>), and normalizes the spans into the data model of runs, traces, and spans.
Redact by default. Secrets are stripped client-side before spans leave your process, and the collector runs a second redaction pass on ingest as defence in depth. This is on unless you opt out with redact_by_default=False.
Security scores the spans. The security service (port 8001) runs the detectors — secrets, PII, moderation, tool-guard, and prompt-injection — and folds their findings into a single 0–100 risk score mapped onto the exact spans where risk appeared.
Evaluation scores outputs. The evaluation service (port 8002) runs scorers against datasets, on demand or as a CI gate.
Results are stored and served. Traces, logs, and metrics land in ClickHouse; metadata lands in Postgres. The web app's BFF queries both and renders the dashboard on port 3000.

One endpoint, any source

Because Splyntra reads the OpenTelemetry GenAI semantic conventions (gen_ai.*) and OpenLLMetry's traceloop.entity.* alongside its own splyntra.* attributes, third-party OTel emitters and hyperscaler agent platforms ingest natively. See Ingest & OTLP.

The services and stores

Component	Port	Role
collector	4318	OTLP ingest, query API, guard, scorers proxy, integration webhooks
security	8001	Detectors → findings → unified risk score
evaluation	8002	Scorers, datasets, regression gates
web	3000	Dashboard + BFF
ClickHouse	—	Traces, logs, metrics (high-cardinality, time-series)
Postgres	—	Projects, agents, keys, and other metadata
NATS	—	JetStream messaging between services
Valkey	—	Cache and rate-limit state
MinIO	—	S3-compatible object store for evaluation datasets

One pipeline, redact by default

There is deliberately no separate SIEM and no separate security agent. The same spans that give you the trace waterfall are the spans the detectors read, so you can jump from "this run scored 82/100" straight to the tool call that leaked a key without any correlation guesswork. Redaction runs before storage, so raw secrets are never persisted.

The three editions, one core

Splyntra is built from a single source-available core into three editions using build-time registration seams — not if (cloud) branches:

Community — the core: collector, traces, logs, metrics, cost analytics, detection, evaluation, and dashboard. Self-hosted with docker compose up.
Enterprise — the core plus the ee/ modules (governance, agent identity, SSO/SCIM, advanced scorers), self-hosted on your infrastructure.
Cloud — the core plus ee/ plus cloud/ — multi-tenant orgs, managed billing, and per-plan gating.

The commercial /v1 endpoints simply 404 in Community because the core binary imports none of the ee/ modules. See Editions & licensing for the full matrix and how the seams work.

Next steps

Quickstart — first trace, risk score, and cost in minutes.
Data model — runs, traces, spans, logs, and metrics.
Self-hosting — run the whole stack locally.

The pipeline at a glance​

The data flow, step by step​

The services and stores​

One pipeline, redact by default​

The three editions, one core​

Next steps​