BYOC is a trade, not a discount

Bring Your Own Cloud (BYOC) is not a fringe option for observability anymore. Datadog shipped BYOC Logs in October 2025, running its log engine inside your infrastructure and indexing into object storage you own. Grafana Labs launched a managed Grafana Cloud region inside customer AWS and GCP accounts that same month. Groundcover, a BYOC-focused observability vendor, just raised $100 million on this bet. So what is behind this approach and why are teams considering it?

The pitch is two promises: stop paying a vendor's per-GB markup, and keep your telemetry in your own account. Both are real. The savings can be large and the ownership is genuine, and anyone who tells you otherwise has not priced it out.

What the pitch leaves out is that BYOC does not remove the cost or the risk. It moves both onto you. That can be an excellent deal, and for some teams it is. But it is a trade, and the terms are not on anyone's pricing page.

What does “Bring Your Own Cloud” (BYOC) really mean?

First, let's define what falls into this BYOC category. Every observability tool splits in two. The control plane is the part you log into: the UI, query orchestration, authentication, configuration. The data plane is where telemetry lands and gets queried. BYOC moves some or all of the data plane into your environment while the vendor keeps the control plane. How much moves, and who operates it once it lands, is the entire decision. The acronym hides exactly that.

These are some of the most common configurations:

Your bucket, queried in place. Your data lands in object storage you own, in an open format, and the vendor queries it where it sits. Coralogix writes Parquet to your S3 and queries archive and live data together without rehydration. Cribl BYOS and Hydrolix also write to storage you provision. Least vendor software in your account, most compromise on query performance.

The vendor's data plane, running in your account. The software runs in your cloud account and the vendor operates it. ClickHouse Cloud BYOC runs the data plane in your VPC while ClickHouse orchestrates it over a Tailscale tunnel. Grafana BYOC, Datadog BYOC Logs and Groundcover's BYOC deployment sit here too; Groundcover's docs call theirs "the most hands-off setup in terms of installation and ongoing maintenance," which is fair.

Vendor software, your operations. You license the software and run it yourself. Hydrolix self-managed and Groundcover's onPrem and airGapped deployments sit here: provisioning, upgrades and capacity planning are yours. The operational burden is heaviest in this tier, and it is the one most often mistaken for the tier above.

Pure self-hosted open source. If you run the control plane too, you are self-hosting rather than doing BYOC, and the economics of that are a different argument.

The pattern to hold onto: the further down that list you go, the better the sovereignty story and the larger the operational bill. They move together, and that pairing is what the rest of this comes down to.

What the SaaS to BYOC trade genuinely buys

Let's take economics first, because they are better than the skeptics allow. Hydrolix publishes a worked example: 2 TB a day, twelve months of retention, 15x compression, $12,654 a month all in, which they put at an effective $0.20 per GB for data kept hot for a year. Nothing in traditional per-GB SaaS pricing comes close at that volume and that retention.

Some models break the link between price and data volume outright. Groundcover charges per node monitored, so an organization generating 10 TB a day pays the same license as one generating 100 GB a day at equal node count. At eBPF volumes, that is a serious answer to the per-GB license problem rather than a rounding error.

The ownership is real too, and vendors undersell it. In the bucket model, the data is portable: open Parquet, no proprietary schema, readable with standard tools. Replace the vendor and the archive is still queryable. If lock-in is what pushed you toward BYOC, that is properly answered for data at rest.

Two arguments in BYOC's favor then get underplayed even by the people selling it. If your company is under-consuming a cloud commitment it is already paying for, much of the infrastructure spend is close to zero marginal cost. And moving the data plane in-house removes the egress you pay today to ship telemetry to a vendor. That is a line on your bill every month.

What changes hands in the move to BYOC

Four things change hands when you move from a SaaS to BYOC model. Three move to your side of the line, and the fourth is something you give up.

Your cloud bill

In that Hydrolix example, $6,814 of the $12,654 is AWS spend, 54% of the total, and it is yours to carry, capacity-plan, and operate. ClickHouse BYOC is explicitly a two-bill model: your cloud provider bills you for infrastructure, and ClickHouse bills you separately for the service. Groundcover separates the per-node license from cloud provider fees, block storage, and object storage; all of which land on you.

Query-in-place adds line items with no fixed ceiling. Cribl Search bills S3 LIST and GET charges on every query you run over your own bucket, and transfer is free only when the bucket and the workspace sit in the same region.

The commit argument has a horizon on it too. Drawing down an under-consumed commitment is close to free this year, and it re-baselines what you commit to at renewal.

The total may well fall. What changed is that the predictable half of it shrank and the unpredictable half grew.

Your pager

"Managed" covers less than most buyers assume, and more than the critics do. In ClickHouse BYOC, the vendor provisions and operates the Kubernetes cluster, and handles database upgrades, scaling and backups. What remains yours is the cloud account, VPC and CIDR planning, cross-account IAM, the tunnel, VPC peering and firewall rules. You do not manage the database. You manage the account it lives in, the network it reaches through, and the permissions that connect them.

Datadog BYOC Logs runs in production on EKS, GKE or AKS only, with self-managed Kubernetes, OpenShift and OCI explicitly unsupported, and it needs a PostgreSQL metadata store of its own.

Your compliance boundary

In the bring-your-own-bucket model, your raw telemetry still routes through the vendor's ingestion and processing infrastructure on its way to your bucket. Coralogix parses and enriches inside Coralogix infrastructure and then writes to your S3. "Never leaves your account" is a statement about where data rests, not about what touched it on the way in.

None of this is vendors lying. Groundcover's own FAQ says the SaaS UI stores account information and Kubernetes metadata, with UI access tunneling into the customer environment on demand. ClickHouse's control plane never holds query data, but it does receive health signals and handle authentication and user metadata over the tunnel.

The question is not unique to BYOC either. Axiom has no BYOC option at all and still routes account management through central US infrastructure whichever region you pick. The same is true of ClickHouse's control plane, of Grafana's, and of ours.

The useful conclusion is a question to put to every vendor, us included: enumerate exactly what crosses the boundary. You are unlikely to find it written down anywhere. We couldn't.

Your instruments

ClickHouse BYOC does not support customer-managed encryption keys, SQL Console, autoscaling or the MySQL interface, all of which standard ClickHouse Cloud ships. SQL Console and autoscaling are on the roadmap; the encryption keys and the MySQL interface have no date. Its monitoring dashboard currently surfaces only memory allocation metrics, with more in progress. Cribl datasets on customer-owned buckets cannot be assigned to Lakehouses, so choosing BYOS means giving up the accelerated query tier.

Datadog BYOC Logs is the clearest case. Its own documentation lists SIEM, Watchdog, federated search, LiveTail, the log context view and query-time grok extraction among the features it does not support. BYOC gets pitched as an addition to the platform you already run. What arrives is a narrower version of it.

SQL Console and the monitoring dashboard are operational visibility. Autoscaling is operational resilience. Customer-managed keys are a sovereignty control, and missing them alone is disqualifying for some regulated buyers, who are the people BYOC gets sold to hardest. You take on the risk and give up the instruments for managing it.

Where the crossover into savings sits

How much can you expect to save by switching to BYOC? It really depends on the tool you choose and your infrastructure and telemetry volume.

For example, Groundcover's pricing calculator prices per Kubernetes node as well as per GB, which turns out to be the whole point.

Here's a table of BYOC all-in cost per GB at twelve-month retention:

Log volume100 nodes500 nodes1,000 nodes500 GB/day$0.28$1.14$2.182 TB/day$0.10$0.31$0.5810 TB/day$0.05$0.09$0.15

The figures in this table are from Groundcover's own calculator at twelve-month retention on the Pro rate. For comparison, published SaaS ingest rates run $0.10 per GB at Datadog and at Bronto, $0.40 at Grafana Cloud and New Relic, and $0.60 for New Relic Data Plus. These SaaS rates are ingest only; indexing and search are extra on all of them, ours included.

At 100 nodes, the crossover into savings sits at almost exactly 2 TB a day: $6,058 a month against $6,000 for a $0.10 per GB rate. Fifty-eight dollars apart on a six-thousand-dollar bill. That is the useful answer, because at the crossover the entire decision is the engineering time. Nobody publishes that number and everybody has to price it themselves. As Groundcover's own calculator notes, operational burden is not taken into account at all, whether it's absorbed by a SaaS vendor or taken up by the customer to self-manage.

When BYOC is the right call

You have a hard sovereignty or residency requirement. Regulated data that legally or contractually cannot sit in a third-party SaaS. The cleanest case, and it needs no cost argument.

You operate at a volume where per-GB pricing eclipses infrastructure plus salary. CDN logs, eBPF firehoses, petabyte retention. Above a certain scale the arithmetic stops being close.

You want cheap, long, full-fidelity retention and can live with slower cold queries. Compliance archives and forensic retrospectives are where bring-your-own-bucket is the right shape rather than a compromise.

You already run Kubernetes or ClickHouse as a core competency. If operating a stateful distributed store is something your team does anyway, the marginal burden is small and most of this post does not apply to you.

What buyers actually want

Look at which BYOC products vendors are building. Grafana Labs, whose ecosystem is entirely open source, launched a managed BYOC so customers do not have to run the stack. ClickHouse and Hydrolix sell managed-in-your-account tiers, and Groundcover's most hands-off deployment is the one they operate. Demand for customer-owned data planes is real and growing; appetite for operating them is not.

What people wanted was predictable cost and real ownership without becoming an infrastructure operator.

Our position at Bronto is that the storage economics are ours to solve rather than yours to operate. That is why we built our own custom observability datastore instead of passing the operating burden along with the bill.

We released predictable pricing based on just two levers, ingest and search, so customers know what to expect on their monthly bill. With 12-month always-hot retention by default, customers gain access to their data for much longer without needing to manage their own observability infrastructure.

For example, before Contentstack adopted Bronto, they were struggling with a 40 TB monthly cap on CDN log ingestion, a two-week retention window, and queries that timed out after 30 minutes. With Bronto they now ingest 60 TB a month at 12-month retention, a typical 635 GB query returns in 2.2 seconds, and their logging bill halved. All without needing to operate a data plane.

If you want to explore Bronto, you can try out the platform yourself with a 2 week free trial or schedule a demo to hear more.

Before you sign

To "own your data" is a means, not an end. The model you choose sets the terms of the trade, and the terms are the thing to negotiate over:

• Data sovereignty

• Total cost

• Search latency

• Who carries the pager

Consider exactly how important each of these factors are for your business, and then you'll know which side of the trade you are on. Get it wrong and you will find out from the invoice, or from the incident.