RunReveal pricing in 2026: the storage-only model, from free tier to $150K Cloud
The independent RunReveal pricing reference. The storage-only meter explained (no ingest fees, no query limits), every published tier from the $0 Community edition to the $10K-$150K Cloud range, what happens to the bill when log volume doubles, and an honest account of what is and is not publicly listed. Built from RunReveal's published pricing and product pages. Updated July 2026.
All figures from runreveal.com/pricing, verified 28 July 2026. RunReveal publishes no per-terabyte rate card; the Cloud tier is listed as a range by stored volume, and this page does not extrapolate figures the vendor has not published.
What RunReveal is, and how storage-only pricing works
RunReveal is a SIEM built on ClickHouse, founded by Evan Johnson and Alan Braithwaite, who describe bringing their experience from Cloudflare and Segment to the product. The company announced a $2.5 million seed round led by Costanoa Ventures in May 2024 and a further $7 million seed round in July 2025, again Costanoa-led with participation from Runtime Ventures, Modern Technical Fund and Okta Ventures: $9.5 million in disclosed funding. The positioning is explicitly against legacy SIEM cost and complexity, and the pricing model is where that positioning is most concrete.
The meter is stored data, not ingested data. RunReveal's pricing page summarises it in one line: only pay for the data you store, with no ingest fees and no query limits. The pricing FAQ is equally direct about the ingest side: whether you send 10 GB per day or 10 TB per day, there is no extra charge at ingest. You filter, transform and route however you want, and the contract prices on what you retain. Among the vendors this site tracks, that makes RunReveal the clearest example of non-ingest pricing in the SIEM market: most alternatives to ingest metering swap in workload units, events per second or node counts, whereas RunReveal removes the ingest meter and replaces it with a single storage meter.
The published structure has two halves. The starter tiers are listed exactly: Community at $0 per month with 20 GB of monthly storage, 30-day retention and 5 data sources, and Teams at $200 per month with 100 GB of monthly storage, 90-day retention and 15 data sources. The enterprise tiers are listed as ranges: RunReveal Cloud (SaaS) at $10K-$150K per year depending on stored data volume, with unlimited ingest and 550-day retention by default; BYO-Cloud from $75K per year running inside your own AWS, GCP or Azure account with full data residency; and a Kubernetes distribution, priced custom based on configuration, for on-prem, air-gapped or cloud deployment, where you bring your own ClickHouse or use RunReveal's managed distribution.
What is not published matters as much. There is no per-terabyte rate card mapping stored volume to a point inside the $10K-$150K range, no compute or query meter, and no per-seat price. The pricing page says there are no query limits, and RunReveal's SIEM solution page states there are no ingestion fees or per-user costs, so the absence of those meters is deliberate rather than an omission. But it means the enterprise number still arrives through a quote conversation, sized on stored terabytes, and this page does not invent the rate that conversation would produce.
RunReveal tier reference
| Tier | Price | What is published |
|---|---|---|
| Community Edition | $0/month | 20 GB monthly storage, 30-day retention, 5 data sources, bring-your-own AI API keys. |
| Teams | $200/month | 100 GB monthly storage, 90-day retention, 15 data sources, custom integrations. |
| RunReveal Cloud (SaaS) | $10K-$150K/yr | Depends on stored data volume. Unlimited ingest, 550-day retention by default, 100+ first-party source integrations, detections as code. |
| BYO-Cloud | $75K+/yr | Runs in your own AWS, GCP or Azure account. Full data residency, custom integrations, enterprise SLAs. Price depends on stored volume. |
| RunReveal Kubernetes | Custom based on config | On-prem, air-gapped or cloud. Helm and GitOps deploy, enterprise SLAs. Bring your own ClickHouse or use RunReveal's managed distribution. |
Source: runreveal.com/pricing, verified 28 July 2026. The starter tiers (Community, Teams) publish exact prices and limits. The enterprise tiers publish a range ($10K-$150K by stored volume), a floor ($75K+ for BYO-Cloud) and a custom quote (Kubernetes). The 50-70 percent savings figure that appears in RunReveal's marketing (runreveal.com/solutions/siem) is the vendor's claim and is cited on this page as such, not adopted as ours.
The doubling test: what happens when a new service doubles your logs
The cleanest way to see what storage-only pricing changes is to run the same event through both meters: your platform team ships a new service and raw log volume doubles overnight.
The ingest-side arithmetic uses Microsoft Sentinel's published $4.30 per GB PAYG rate from our Sentinel pricing page; commitment tiers soften the doubling (to $2.96 effective at 100 GB/day) but the bill still scales with ingested volume. The storage-side column is deliberately qualitative: RunReveal publishes the range and the meter but not a per-TB rate, so the honest statement is directional, not a dollar figure. A second, fully published data point: the Teams tier at $200/month for up to 100 GB of monthly storage works out to $2,400/yr, or $2 per GB of monthly storage at full utilisation. That unit figure is our arithmetic on the listed tier, not a listed rate, and enterprise contracts will not necessarily scale linearly from it.
Storage meter vs ingest meter, across this site's references
| Platform | What is metered | Published anchor | Raw volume doubles |
|---|---|---|---|
| RunReveal | Stored data volume | $10K-$150K/yr by stored volume; Teams $200/mo at 100 GB monthly storage | Ingest is unmetered; the bill moves only if retained data grows |
| Splunk Cloudfigures: /splunk-pricing | Ingested GB/day (or SVC workload units) | Roughly $665 to $1,620 per GB/day per year depending on commit volume | Metered volume doubles; the ingest bill roughly doubles |
| Microsoft Sentinelfigures: /sentinel-pricing | Ingested GB (per-GB meter) | $4.30 per GB PAYG, $2.96 effective at the 100 GB/day commitment tier | Metered volume doubles; commitment tiers soften but do not remove it |
| Pantherfigures: /panther-pricing | Ingested TB/month | $50,000/yr per 1 TB/month on the AWS Marketplace listing | Metered volume doubles; the volume meter roughly doubles |
Comparison rates are the ones already documented on this site's vendor pages, linked per row, each verified against the vendor's published pricing on the date shown on that page. The structural point is meter placement, not a like-for-like quote: an ingest meter prices every gigabyte that arrives, a storage meter prices what you keep. Which lands cheaper for you depends on your retain-to-ingest ratio, retention requirements and negotiated terms.
The compute question
Every SIEM bill has a compute component somewhere; the pricing models differ mainly in whether you can see it. Ingest-priced platforms fold search and detection compute into the per-GB rate. Workload-priced models (Splunk's SVC units, for example) meter compute directly. Data-lake architectures often pass compute through as your own warehouse bill.
RunReveal takes a third route: compute is not metered at all. The pricing page lists no query limits and no compute line, so search, detection and analytics compute is absorbed into the storage-based tiers rather than surfaced as its own meter. That is an abstraction choice, and it cuts both ways. In its favour, there is exactly one number to forecast (stored volume), and a heavy investigation month does not produce a surprise compute bill. Against it, a buyer cannot see the compute component priced into the storage tiers, so there is no way to verify how much of the contract is storage economics and how much is compute headroom. On this site's usual transparency framing, the storage-only model is highly transparent about the meter and deliberately opaque about what sits inside it. Neither ingest bundling nor storage bundling is wrong; they are different places to hide the same cost, and the practical question for a buyer is which single number they would rather forecast.
Who the storage-only model fits, and who it does not
- + High ingest, disciplined retention: you collect broadly but store selectively
- + Compliance-length retention matters: 550-day default on Cloud beats typical 90-day ingest-tier defaults
- + Small teams starting out: the $0 Community tier (20 GB stored, 30 days) is usable, not a timed trial
- + Budget predictability: one meter (stored TB), no per-user costs claimed, no query limits
- + Data residency or on-prem requirements: BYO-Cloud and Kubernetes tiers exist for exactly this
- - You retain nearly everything you ingest: the storage meter then tracks ingest anyway
- - You need a rate card before talking to sales: no published per-TB rate inside the $10K-$150K range
- - Procurement requires itemised compute or seat pricing: neither is published or metered
- - Mature analyst workflows are built on an incumbent: migration cost, not pricing model, is the binding constraint
- - You want a long vendor track record: the company disclosed its first funding in May 2024
Verify before you buy
As with every vendor page on this site: the figures above were verified against RunReveal's published pages on 28 July 2026 and SIEM pricing changes frequently. Before signing anything, confirm the current tiers at runreveal.com/pricing, get the stored-volume assumptions behind your quote in writing, and ask directly how the contract behaves if stored volume grows mid-term, how retention beyond the defaults is priced, and how BYO-Cloud infrastructure costs in your own AWS, GCP or Azure account interact with the RunReveal licence. Our methodology page explains how figures on this site are sourced and what verification means.