From your code to the answer, in four steps.
Sentinel is a short path from OpenTelemetry to columnar storage to one console. Here is what happens along the way.
- 1
Ingest
OpenTelemetry over OTLP
Collectors and SDKs send traces, logs, and metrics over gRPC (4317) or HTTP (4318). Each request carries a write-only ingestion key.
- 2
Gateway
Validate, mask, batch
The gateway checks the key, masks tags you mark as sensitive, and batches records before writing so bursts do not become backpressure.
- 3
Store
Columnar storage
Signals land in ClickHouse tables partitioned by time and tenant. Because logs are scanned rather than indexed, there is no separate indexing step to pay for.
- 4
Explore
One query language
Logs, spans, and monitors share the same facet grammar, so a filter you wrote for logs works on traces and in alerts.
Access is designed in, not added on.
How keys, roles, and records work. You can try each of these in organization settings.
Open organization settings- Ingestion keys can only write
- A leaked collector key cannot read your data. Reading takes an application key, which can never do more than its owner.
- Sensitive permissions are separate
- Billing, keys, SSO, and audit export sit in their own tier, so a role can have full operational access without them.
- Every change is recorded
- Keys, roles, monitors, and settings write to an append-only audit trail you can filter and export.
- Your region, your data
- Choose where telemetry is stored. Enterprise plans can run the storage layer in your own cloud account.
Planning a large rollout?
Tell us your scale and constraints and we will reply with a sizing and a migration plan.