What is BYOC observability? A buyer’s guide

What BYOC observability actually means

Every observability platform has two halves.

The data plane is where the work happens. It takes in your telemetry, stores it and answers your queries. The control plane is how the platform gets installed, upgraded and kept healthy.

In a SaaS tool, both halves live in the vendor’s cloud. You send everything to them.

In BYOC, the data plane runs in your cloud account, next to the systems it watches. The vendor still runs the control plane, so you don’t have to become an expert in operating the platform yourself.

A simple way to test any offer: where does the data live, where do the queries run, and who is on call?

Three different things get called “BYOC”

This is where most buyers get confused. The same label covers three very different setups.

1. Your bucket, their compute. Your data is stored in your own object storage, but ingestion and queries run in the vendor’s cloud. Your data still travels to the vendor every time it’s processed or searched.
2. Managed data plane in your account. The whole data plane, including ingestion, storage and queries, runs in your account. The vendor operates it through a control plane. This is what most people mean when they say BYOC.
3. Self-hosted. You run everything yourself, with the vendor providing software and support.

The difference between the first two matters most. If queries run in the vendor’s cloud, your data still leaves your environment, even if it’s stored in your bucket.

BYOC vs SaaS vs self-hosted

When BYOC is the right choice, and when it isn’t

BYOC makes the most sense when:

• Your data is regulated. Health, payments and government workloads often can’t send telemetry to a third party. Logs carry more customer data than most teams realize.
• Where your data lives matters. Sovereignty rules are getting stricter. Gartner’s February 2026 forecast puts worldwide spending on sovereign cloud IaaS (cloud infrastructure) at $80 billion in 2026, up 35.6%.
• You send a lot of data. At high volumes, paying a vendor to move and store every log line gets expensive.
• Security reviews keep stalling SaaS tools. When the telemetry never leaves your account, there is far less to review.

It’s not always the best fit. If your team is small, your data volumes are modest and nothing is regulated, SaaS is simpler. Kloudfuse, like many BYOC platforms, runs on a Kubernetes cluster in your account, and that’s real overhead for a small setup.

Eight questions to ask any BYOC vendor

These are the questions that separate a real BYOC offer from a marketing label. Here’s how we answer each one for Kloudfuse, which runs as Self-SaaS, our managed BYOC model.

1. Where does my telemetry live? In your cloud account. The Kloudfuse data plane runs inside your VPC and stores telemetry in your own storage, such as an S3, GCS or Azure Blob bucket in your account.

2. Where do queries run? Also in your account. Ingestion, storage and queries all happen in the data plane, inside your environment.

3. What, if anything, leaves my account? Only operational metadata: version state, upgrade status, health signals and entitlement. Logs, metrics, traces, events, RUM, profiles and LLM telemetry stay in your data plane. Remote health monitoring only happens if you turn it on.

4. Which side opens the connection? Your side. We don’t connect into your account. If you turn on health monitoring, the Kloudfuse platform in your cluster sends its own performance data out to our monitoring, where we have alerts set up to catch problems early.

5. Who is on call, and for what? It depends on how hands-on you want us to be. Most teams run the platform in their own cluster with our help: we share a configuration sized to their expected data volume, walk their team through the install on a call, and do the same for upgrades and fixes. We watch the platform’s health from our side, and high-priority support tickets page our on-call team around the clock. In a fully managed setup, we take care of everything related to Kloudfuse, including infrastructure, performance and deployment. Your team focuses on using it.

6. How do upgrades work? For managed deployments, you approve the window and we run it. For self-operated deployments, your team upgrades with standard tooling, and we join a call to guide it.

7. What access does the vendor need, and how is emergency access handled? In a self-operated deployment, we don’t keep access to your environment. Installs, upgrades and fixes happen with your team, on a call with a named contact on your side, so your people make every change. In a fully managed deployment, access is agreed with you up front. Data in transit is encrypted with TLS, and data at rest sits in storage in your own account, under your own keys. Sign-ins and changes to users, groups and policies are recorded in an audit log.

8. What happens if I leave? Your data is already stored in your own account, on your persistent volumes and in your object storage, so nothing has to be pulled back from a vendor. Uninstalling the platform doesn’t delete what’s in your storage. Your instrumentation stays the same, because we accept data from the OpenTelemetry Collector, the Datadog Agent and Fluent Bit.

If a vendor can’t answer all eight plainly, that tells you something.

What does BYOC observability cost?

BYOC comes with two bills.

• The vendor licence. Kloudfuse prices on one axis, terabytes ingested per day, with no per-host or per-user fees.
• Your own cloud bill for the compute and storage the platform uses. Telemetry doesn’t have to cross the internet to a vendor, and long retention becomes a storage decision in your own bucket.

There’s no single size-per-terabyte rule, because it depends on your mix of logs, metrics and traces. Tell us your expected daily volume, and we’ll share a configuration sized for it before you commit.

When you compare against SaaS, add both bills together, and read our five strategies for cutting the observability bill for what else moves the total. Then compare that total with the SaaS quote at the volume you’ll have next year, not this year.

BYOC at scale

BYOC isn’t only for small, careful deployments. Zscaler runs Kloudfuse at more than 300 TB a day, across 78 engineering teams.

Frequently Asked Questions

Is BYOC the same as self-hosted?

No. In both, the software runs in your environment. With BYOC, the vendor operates it for you. With self-hosted, your team does.

Is BYOC the same as single-tenant SaaS?

No. Single-tenant SaaS gives you a dedicated instance, but it still runs in the vendor’s cloud. BYOC runs in yours.

Does BYOC observability send any data to the vendor?

It depends on the vendor, so ask. With Kloudfuse, only operational metadata such as version, upgrade status and health signals is shared. Your telemetry stays in your account.

Is BYOC more expensive than SaaS?

Not necessarily. You pay a licence plus your own cloud costs. At high data volumes, keeping data in your own storage is often cheaper than paying a vendor to store it.

Does BYOC help with compliance?

It can make audits simpler, because telemetry never leaves your environment. Kloudfuse supports FIPS 140-3, HIPAA and PCI DSS requirements.

Can I switch from SaaS to BYOC later?

Yes, especially if you use open standards. Data from the OpenTelemetry Collector, the Datadog Agent and Fluent Bit can be pointed at a new destination without re-instrumenting your services.

What do I need to run BYOC observability?

A cloud account, and usually a Kubernetes cluster for the platform to run in. Kloudfuse needs at least 16 vCPUs and 128 GB of memory across the cluster. How much the vendor handles after that depends on the operating model you choose.