commercial pricing · per deployment, not per GB

Pay for the deployment.
Not for every gigabyte you happen to ingest.

Three editions, two pricing axes (edition + capacity band), no surprise true-ups from a noisy Tuesday. Paid POC that credits to year one, and a displacement credit if you are leaving Splunk. That is the whole model.

Three editions. One axis you actually move.

STANDARDCloud
$24K – $56K
/ deployment / year

Mid-market replacing a legacy SIEM.

caver core: SPL engine, /ui web UI, splunkd-compatible REST peer, caver-scheduler with Slack / Teams / Telegram / webhook actions.

  • ✓up to 750 hosts monitored
  • ✓up to 75 data sources connected (HEC, S2S, OTel, syslog, files, JSON, custom)
  • ✓single tenant · OIDC SSO
  • ✓1-year audit log retention
  • ✓business-hours support · 24-hr Sev-1 response
  • ✓self-serve onboarding + 4 hours of guided setup
  • ✓scheduler-driven alerting included (cron jobs, channel actions, no-op-on-empty)
Talk to sales →
★ most picked
ENTERPRISECloud or on-prem
Contact sales
per deployment / year

Replaces Enterprise + ES + ITSI + UBA + SOAR.

Everything in Standard, plus CAVERN (ES), ECHO (ITSI), UBA, SLAM (SOAR).

  • ✓up to 5,000 hosts monitored
  • ✓unlimited data sources
  • ✓multi-tenant · OIDC + SAML + SCIM
  • ✓7-year audit log retention
  • ✓24×7 support · 1-hr Sev-1 · named TAM
  • ✓white-glove 60-day onboarding included
Book discovery call →
MSSPCloud or on-prem
Partner pricing
enterprise base + per-tenant

For MSSPs and MDR resellers.

Enterprise modules with multi-tenant isolation and white-label.

  • ✓white-label UI, custom domain, branded email
  • ✓hard tenant boundaries · per-tenant keys
  • ✓partner-tier reseller margin
  • ✓dedicated partner TAM
  • ✓co-marketing on accepted joint deals
  • ✓channel-friendly EULA + MSP addendum
Become a partner →

One deployment = one production cluster, dev and staging environments included for the same customer entity. Multi-deployment discount kicks in at the second cluster.

Capacity bands are hosts and sources, not gigabytes.

Splunk charges by the gigabyte you ingest. A bad firewall day costs you money. A new logging source costs you a procurement cycle. We refuse to recreate that dynamic. Caver capacity is measured in two units a customer can actually control:

HOSTS MONITORED
Distinct asset IDs

Servers, endpoints, network devices, cloud accounts, OT assets — anything that shows up in your data with an identifier. Count grows with your infrastructure, not with your luck.

DATA SOURCES CONNECTED
Active integrations

Each integration sending data into caver counts once, no matter how chatty it is. Add a new SaaS audit log? +1 source, predictable line item, not a budget event.

Over-capacitySoftUI banner + audit-log alert. No hard lockouts.
True-upAt renewalPay the next-band-up if usage ran high.
Audit cadenceOnce / term30-day notice. Reciprocal capacity inspection.

Two ways to de-risk moving off Splunk.

PAID POC

60-day pilot. Credit-back.

$25K to $75K to stand up caver against your real data in a non-production environment for 60 days. If you convert, the full POC fee credits 100% toward your year-one license. If you do not, you walk with the deployment plan, sizing data, and a clean exit. Free POCs filter for tire-kickers; paid POCs filter for buyers.

  • ✓Joint success criteria documented before kickoff
  • ✓Customer-supplied data sources, non-production scope
  • ✓One 30-day extension available on mutual agreement
  • ✓Conversion target: signed order form within 30 days of POC end
SPLUNK-DISPLACEMENT CREDIT

Up to 50% off year one.

Bring written proof of a terminated Splunk contract and we take a meaningful slice off year one. The bigger the Splunk bill you are killing, the bigger the credit. This is the cleanest signal we can give that we exist to replace Splunk, not to coexist with it.

  • ✓25% off year one if Splunk spend was under $250K
  • ✓35% off year one if Splunk spend was $250K to $1M
  • ✓50% off year one if Splunk spend exceeded $1M
  • ✓Non-stackable with other promotional credits · year one only

Pricing FAQ. Probably what you came to ask.

Per-GB is the Splunk pain we exist to solve. A bad firewall day, a new logging source, a noisy DNS resolver — under per-GB, all of those create budget events. Per-deployment lets you ingest what you need to ingest. Capacity bands measure what you actually control: hosts monitored and data sources connected. Both scale predictably with your infrastructure.

One production caver cluster, plus the development and staging environments that pair with it for the same customer entity. Multi-region failover under the same customer counts as one deployment. A second business unit or a second legal entity with its own data isolation counts as a second deployment, with multi-deployment discounting.

Nothing breaks. caver surfaces a UI banner and writes an entry to the audit log when usage exceeds the band, on both the customer side and our side. There are no hard lockouts. At renewal, we true up: you pay the next-band-up that matches your actual usage during the prior term. We collect what we are owed at renewal, not by bricking your SOC in production.

Not for the commercial product. The fastest way in is the paid 60-day POC, which credits 100% toward year one if you convert. Free POCs filter for tire-kickers; paid POCs filter for buyers, and the credit removes the cost objection.

Show us written proof of an active Splunk contract you are terminating in order to land on caver (redacted order form is fine). Based on the Splunk annual spend, you get 25%, 35%, or 50% off year one of caver. The credit is year-one only and non-stackable with other promotional credits. Every accepted credit becomes a published displacement case study, with your approval.

Both. Caver runs on your hardware (your servers, your S3-compatible storage, your network) or on caver-hosted infrastructure. Same license model in both cases. Enterprise SLA differs slightly: 99.9% uptime when caver-hosted, mutually agreed when self-hosted (because you control the operating environment).

Caver MSSP is built for that. Enterprise modules with multi-tenant isolation, white-label UI, branded customer-facing emails, partner-channel support, reseller margin tiered by volume. Per-tenant pricing on top of an Enterprise base. Become a partner via the link in the MSSP card above.

caver is closed-source proprietary software. The current product is delivered as binaries plus a commercial license, in the same shape as every other commercial SIEM in this market. Contact [email protected] for evaluation access and license terms.

Caver ships with a standard EULA that handles the bulk of the relationship. Larger enterprise customers typically prefer an MSA with caver-specific order forms attached. We work with either. Tennessee is the default governing law; we have negotiated alternative law/venue for larger deals.

ready when you are

Sales call, paid POC, or both.

Email [email protected] with the rough size of your Splunk bill, your renewal window, and the modules you most want to displace. We will come back within a business day with a sizing estimate and a POC plan.

[email protected] →MIT → commercial: full story →