SIEM with data sovereignty: your logs stay in your jurisdiction, your costs stay predictable.
OrianaSIEM is a self-hosted Security Data Platform you run on-premises, in a hybrid topology or in a private cloud of your choice. No logs leave your jurisdiction, no ingest-based pricing, ready-made reporting for NIS2, DORA, GDPR, ISO 27001 and PCI DSS, and support directly from the vendor in English, German, French and Turkish.
Where your security logs live is a compliance decision, not a hosting detail.
Security logs contain personal data, network topology and incident evidence. Regulators, auditors and customers increasingly ask where that data is processed, who can access it and what happens when the vendor changes.
Jurisdiction and transfer rules
With a cloud SIEM, every log line becomes an international data transfer. Self-hosting keeps processing inside your own legal boundary, so GDPR transfer assessments, data-residency clauses and sector rules are met by design rather than by contract.
NIS2 and DORA timelines
NIS2 expects an early warning within 24 hours and a notification within 72 hours; DORA requires ICT incidents to be detected, classified and reported. Central visibility, correlation and ready reports shorten the path from detection to notification.
Supply chain independence
Acquisitions, divestitures and platform migrations in the SIEM market have left customers with uncertain roadmaps. An independent vendor with its own data engine, no dependency on a hyperscaler and no ecosystem lock-in keeps the decision in your hands.
Predictable total cost
Licensing follows platform scope and retention period, not gigabytes per day. Connecting a new source does not inflate the bill and there is no egress cost, so no log source is left outside the SIEM for budget reasons and detection coverage stays complete.
Vendor-direct support
No tiered reseller queues: requests reach the product team. SLA-backed resolution times, remote and on-site support, parsers for new sources built by the vendor, and an interface in English, German, French and Turkish for multinational teams.
Sovereign and air-gapped options
Fully offline deployment for classified or isolated networks, hybrid topologies with collectors in the cloud and the core on-premises, or a private cloud operated by you or your MSSP. Threat intelligence feeds can be mirrored for disconnected environments.
You choose where the platform runs.
All models run the same software with the same features; only the topology changes.
Your data center
Physical or virtual servers (VMware, Proxmox, KVM) on Ubuntu Server LTS with Docker; single server up to 5,000 EPS, Kubernetes cluster beyond that. No outbound data flow required.
Collectors out, core in
Collectors near cloud workloads, branch offices or OT networks; correlation, storage and reporting stay in your own environment. Useful when workloads are distributed but data must remain central.
Your cloud account
Deployed on customer-managed virtual machines or containers in the region you select. The platform does not depend on any hyperscaler service, so the account, region and keys remain yours.
Multi-tenant
Isolated data, rules, dashboards and reports per tenant; role-based access down to page and action level; per-customer licensing. One update applies to all tenants. See the partner program.
Self-hosted does not mean heavy.
The usual objection to self-hosting is hardware. OrianaSIEM's patented Minimize algorithm and a proprietary data engine that is not based on Elasticsearch or the JVM keep CPU, RAM and disk requirements low at high log volumes, so a sovereign deployment stays affordable over multi-year retention periods.
The figures below were measured in internal test scenarios; the ratio in your environment depends on log types and is measured together during the POC.
System Requirements- MITRE ATT&CK mapping and STIX/TAXII threat intelligence synchronization
- Sigma and YARA rule support; no proprietary query language to learn
- Microservice architecture; zero-downtime updates with Docker/Kubernetes
- Alerts forwarded to your SOC, SOAR and ticketing tools via Web API, e-mail and SMS
Three approaches, the same questions.
Based on vendor documentation and market knowledge; decision factors rather than brand-by-brand claims. For a definitive answer we recommend a comparative POC on the same data set and the same hardware.
| Decision factor | Cloud-native SIEM | Open-source stack | OrianaSIEM (self-hosted) |
|---|---|---|---|
| Data location | Vendor cloud; region limited to the vendor's footprint | On-premises | On-premises, hybrid or private cloud of your choice; data sovereignty by design |
| License model | GB/day or GB/month ingest; cost grows with retention | License is free; operations are not | Based on platform scope and retention; no volume-based penalty |
| Queries and rules | Proprietary query language and certified experts | Cluster management, tuning and rule development stay with your team | UI-driven; 3,500+ ready-made rules, Sigma/YARA; no language learning curve |
| Resource consumption | Invisible to the customer, reflected in the price | High RAM and disk for Elasticsearch/JVM clusters | Significantly lower CPU/RAM in internal tests; up to 60% less disk |
| Compliance reports | Global templates, often as paid content | Built by the customer | NIS2, DORA, GDPR, ISO 27001, PCI DSS, HIPAA, SOX reports included |
| Accountability in audits | Tiered support, shared responsibility model | No accountable vendor; community support | Direct vendor support with SLA |
| Time to value | Platform transformation; 6-12 months is common | Months of sizing and tuning | Installed in one day once the server is ready, a measured 1-2 week POC, live in days |
| UEBA | Usually a separately licensed module | Limited or a separate component | Profiling-based UEBA as standard; per user, IP, MAC, hostname |
| Vendor continuity | Risk of acquisitions, divestitures and roadmap changes | Upgrade risk sits with your team | Independent vendor with its own data engine; vendor-managed updates |
Honest positioning. Global platforms lead in application ecosystem breadth and machine-learning-heavy advanced analytics; we say so openly. If data sovereignty, predictable cost, regulatory reporting, resource consumption, UEBA and direct vendor support are your priorities, OrianaSIEM is the better fit. We can test this with your own data.
One platform, the logging controls auditors ask for.
Ready-made report templates, time stamping and integrity protection, long retention kept affordable by deduplication. Sector-specific templates can be adapted by the vendor.
| Regulation | Scope | Logging requirement | OrianaSIEM approach |
|---|---|---|---|
| GDPR | EU · personal data | Access records, monitoring of processing, breach notification within 72 hours (Art. 33) | Access log correlation, breach detection scenarios, anomalous access via UEBA, reporting |
| NIS2 | EU · essential and important entities | Incident detection, 24 h early warning and 72 h notification, logging and monitoring duties, supply chain security | Central monitoring, incident records, time-stamped retention, alert forwarding to CSIRT workflows |
| DORA | EU · financial sector | Detection, classification and reporting of ICT incidents; log integrity and retention; threat-led testing | Central monitoring of ICT sources, integrity and retention reports, incident records |
| ISO/IEC 27001:2022 | Global | A.8.15 Logging, A.8.16 Monitoring activities, A.8.17 Clock synchronization | Central log management, monitoring and alerting, NTP and time-stamp reports |
| PCI DSS v4.0 | Global · card payments | Requirement 10: log all access, daily review, 12-month retention (3 months online) | Central logging of the cardholder data environment, daily review reports |
| NIST SP 800-53 / CSF 2.0 | US public sector and general framework | AU (Audit and Accountability) controls; Detect function | Central log management, review reports, integrity protection |
| SOX | US · listed companies | Auditability of access and changes to financial systems (ITGC) | Correlation of access and change logs, audit reports |
| HIPAA | US · healthcare | Monitoring of ePHI access logs, audit controls 164.312(b), 6-year documentation retention | Access correlation for health systems, long-term retention |
| SOC 2 | Service providers / MSSP | Monitoring and incident evidence for security, availability and confidentiality criteria | Multi-tenant monitoring, per-tenant reports and evidence |
| BSI IT-Grundschutz / KRITIS | Germany | Logging and detection requirements (OPS.1.1.5, DER.1); attack detection systems mandatory for critical infrastructure | Central detection, correlation and UEBA; German-language interface |
Turkish regulations (Law 5651, KVKK, Cybersecurity Law 7545, BDDK) are covered on the Regulatory Compliance page.
8 questions to ask before choosing a SIEM.
Ask these of every SIEM vendor you evaluate, including us. The answers become clear in a POC on your own data, not in a brochure.
Plan a Comparative POC- Three-year total cost calculated? License, hardware, storage, consulting and staff together.
- Sources left unconnected because of cost? Does adding a source grow the license?
- Where are logs processed and stored? Which jurisdiction, which region, who holds the keys?
- Proprietary query language required? How many experts do you have to write it?
- NIS2, DORA and GDPR reports ready out of the box? How many person-days does audit prep take?
- When the EPS or ingest limit is exceeded, what happens? Are events dropped or billed?
- Who will own the product in five years? Is there a written roadmap and support commitment?
- A POC on the same data measuring resource consumption, query time and deduplication ratio?
Run in parallel, measure, then switch.
No big-bang cut-over. Installation takes a day once the server is ready; the POC takes 1-2 weeks and produces a board-ready report.
Discovery
Source list, daily log volume (GB/day, EPS), retention period, applicable regulations and success criteria are agreed together.
Installation
Installation is completed once the server or VM is ready; firewall, Active Directory, Linux, cloud and application sources are connected and parsers are validated.
Parallel measurement
Brute force, lateral movement, data exfiltration and privilege escalation scenarios; compliance reports; the same queries compared against your current product.
Phased migration
Sources are redirected in stages, historical records are imported and critical rules are rewritten with vendor support. Your cloud subscription is wound down only after the measurements are in.
About self-hosted SIEM and data sovereignty.
See the FAQ page for more, or write to us.
It means security logs are collected, processed and stored inside a jurisdiction and infrastructure you control, under your encryption keys and access policies, without depending on a foreign cloud provider or vendor-hosted service. For a SIEM this matters because logs contain personal data, network topology and incident evidence.
Yes. The platform has no mandatory outbound dependency. Threat intelligence feeds and rule updates can be transferred manually or mirrored for isolated networks, and licensing works with an offline activation file.
Central visibility, correlation and ready-made reports shorten the path from detection to notification. Alerts enriched with GeoIP, threat intelligence and MITRE ATT&CK context are forwarded to your incident workflow via Web API, e-mail and SMS, and time-stamped records support the evidence requirements. Notification itself remains your process; the platform supplies the detection and the records.
English, German, French and Turkish. Support is available in English and Turkish; documentation and training materials are provided in English.
By platform scope, retention period and use case, without volume-based penalties; EPS is used only for capacity planning. Monthly, annual and three-year subscription options are available for on-premises, hybrid and MSSP deployments. Contact us for a quote.
OrianaSIEM holds the A-Level Conformity Certificate from SIEM testing by TRTEST (Türkiye), an independent assessment of technical maturity and enterprise readiness, and is in production at more than 700 organizations. For international procurements we recommend a comparative POC on your own data as the primary evidence.
We recommend running in parallel. Sources are first dual-sent to OrianaSIEM, historical records are imported, critical rules are rewritten with vendor support and the migration decision is made on comparative measurements. Installation takes a day once the server is ready; the POC takes 1-2 weeks.
Keep your logs where your obligations are.
Let us plan a 1-2 week comparative POC with your own log sources; installation takes one day.