RunReveal pricing in 2026: the storage-only model, and the tiers withdrawn after the ClickHouse acquisition
The RunReveal pricing reference. ClickHouse acquired RunReveal on 1 September 2026 and the public price list came down. This page keeps the storage-only meter explained (no ingest fees, no query limits), the tiers in the last archived copy of RunReveal's price list (18 April 2026: $0 Community, $200/month Teams, Enterprise from $2,000/month for 1 TB stored), what happens to the bill when log volume doubles, and an honest account of what is and is not public now. Updated October 2026.
Page updated 26 October 2026/First published 28 July 2026
What RunReveal is, and how storage-only pricing works
RunReveal is a SIEM built on ClickHouse, founded by Evan Johnson and Alan Braithwaite, who describe bringing their experience from Cloudflare and Segment to the product. The company announced a $2.5 million fundraise led by Costanoa Ventures in May 2024 and a further $7 million in seed funding in July 2025, again Costanoa-led with participation from Runtime Ventures, Modern Technical Fund and Okta Ventures: $9.5 million in disclosed funding. On 1 September 2026 ClickHouse acquired the company, terms undisclosed. The positioning was explicitly against legacy SIEM cost and complexity, and the pricing model is where that positioning was most concrete.
The meter is stored data, not ingested data. RunReveal's pricing page summarises it in one line: only pay for the data you store, with no ingest fees and no query limits. The pricing FAQ is equally direct about the ingest side: whether you send 10 GB per day or 10 TB per day, there is no extra charge at ingest. You filter, transform and route however you want, and the contract prices on what you retain. Among the vendors this site tracks, that makes RunReveal the clearest example of non-ingest pricing in the SIEM market: most alternatives to ingest metering swap in workload units, events per second or node counts, whereas RunReveal removes the ingest meter and replaces it with a single storage meter.
The last archived price list (18 April 2026) had three tiers. Community at $0 per month with 20 GB of monthly storage, 30-day retention and 5 data sources. Teams at $200 per month with 100 GB of monthly storage, 90-day retention and 15 data sources. Enterprise starting at $2,000 per month for 1 TB of monthly storage, with unlimited data sources, a 550-day default retention and a choice of on-premise, BYO-cloud or single-tenant SaaS deployment. The storage wording was new that spring: captures from January to March 2026 list the same three prices per GB of monthly ingest.
What was not published matters as much. There was no rate card above the 1 TB Enterprise floor, no compute or query meter, and no per-seat price. The pricing page said there are no query limits, and RunReveal's SIEM solution page states there are no ingestion fees or per-user costs, so the absence of those meters is deliberate rather than an omission. But it means the enterprise number still arrives through a quote conversation, sized on stored terabytes, and this page does not invent the rate that conversation would produce.
RunReveal tier reference, as archived on 18 April 2026
These tiers no longer appear on runreveal.com. They are kept here, dated, because they are the last public record of how the storage-only model was priced; the current offer is by enquiry.
| Tier | Price | What is published |
|---|---|---|
| Community Edition | $0/month | 20 GB monthly storage, 30-day retention, 5 data sources, bring-your-own AI API keys. |
| Teams | $200/month | 100 GB monthly storage, 90-day retention, 15 data sources, priority support, custom integrations. |
| Enterprise | From $2,000/month | For 1 TB of monthly storage. Unlimited data sources, custom retention (550-day default), SLA and dedicated support, on-premise, BYO-cloud or single-tenant SaaS deployment. Above 1 TB, by quote. |
Source: runreveal.com/pricing as archived 18 April 2026, read 26 October 2026; the live page has carried no prices since the ClickHouse acquisition. Community and Teams were published with exact prices and limits; Enterprise as a floor ($2,000/month for 1 TB stored), with larger volumes by quote. The 50-70 percent savings figure that appears in RunReveal's marketing (runreveal.com/solutions/siem) is the vendor's claim and is cited on this page as such, not adopted as ours.
The doubling test: what happens when a new service doubles your logs
The cleanest way to see what storage-only pricing changes is to run the same event through both meters: your platform team ships a new service and raw log volume doubles overnight.
The ingest-side arithmetic uses Microsoft Sentinel's published $4.30 per GB PAYG rate from our Sentinel pricing page; commitment tiers soften the doubling (to $2.96 effective at 100 GB/day) but the bill still scales with ingested volume. The storage-side column is mostly qualitative: RunReveal published the meter and a 1 TB floor but no rate above it, so the honest statement is directional, not a dollar figure. The two published paid tiers do share one unit rate: Teams at $200/month for 100 GB ($2,400/yr) and the Enterprise floor at $2,000/month for 1 TB ($24,000/yr) both work out to $2 per GB of monthly storage at full utilisation. That unit figure is our arithmetic on the archived tiers, not a listed rate, and contracts above 1 TB will not necessarily scale linearly from it.
Storage meter vs ingest meter, across this site's references
| Platform | What is metered | Published anchor | Raw volume doubles |
|---|---|---|---|
| RunReveal | Stored data volume | Teams $200/mo for 100 GB stored; Enterprise from $2,000/mo for 1 TB stored (archived 18 Apr 2026; withdrawn after the ClickHouse acquisition) | Ingest is unmetered; the bill moves only if retained data grows |
| Splunk Cloudfigures: /splunk-pricing | Ingested GB/day (or SVC workload units) | $765 to $2,049 per GB/day per year depending on commit volume ($1,265 at 50 GB/day), filed list | Metered volume doubles; the ingest bill rises about 1.6x to 2x as the per-GB band tapers |
| Microsoft Sentinelfigures: /sentinel-pricing | Ingested GB (per-GB meter) | $4.30 per GB PAYG, $2.96 effective at the 100 GB/day commitment tier | Metered volume doubles; commitment tiers soften but do not remove it |
| Pantherfigures: /panther-pricing | Ingested TB/month | $50,000/yr per 1 TB/month on the AWS Marketplace listing | Metered volume doubles; the volume meter roughly doubles |
Comparison rates are the ones already documented on this site's vendor pages, linked per row, each verified against the vendor's published pricing on the date shown on that page. The structural point is meter placement, not a like-for-like quote: an ingest meter prices every gigabyte that arrives, a storage meter prices what you keep. Which lands cheaper for you depends on your retain-to-ingest ratio, retention requirements and negotiated terms.
The compute question
Every SIEM bill has a compute component somewhere; the pricing models differ mainly in whether you can see it. Ingest-priced platforms fold search and detection compute into the per-GB rate. Workload-priced models (Splunk's SVC units, for example) meter compute directly. Data-lake architectures often pass compute through as your own warehouse bill.
RunReveal takes a third route: compute is not metered at all. The pricing page lists no query limits and no compute line, so search, detection and analytics compute is absorbed into the storage-based tiers rather than surfaced as its own meter. That is an abstraction choice, and it cuts both ways. In its favour, there is exactly one number to forecast (stored volume), and a heavy investigation month does not produce a surprise compute bill. Against it, a buyer cannot see the compute component priced into the storage tiers, so there is no way to verify how much of the contract is storage economics and how much is compute headroom. On this site's usual transparency framing, the storage-only model is highly transparent about the meter and deliberately opaque about what sits inside it. Neither ingest bundling nor storage bundling is wrong; they are different places to hide the same cost, and the practical question for a buyer is which single number they would rather forecast.
Who the storage-only model fits, and who it does not
- + High ingest, disciplined retention: you collect broadly but store selectively
- + Compliance-length retention matters: the Enterprise tier listed a 550-day default
- + Small teams starting out: the $0 Community tier (20 GB stored, 30 days) is usable, not a timed trial
- + Budget predictability: one meter (stored TB), no per-user costs claimed, no query limits
- + Data residency or on-prem requirements: Enterprise listed on-premise and BYO-cloud deployment, and ClickHouse says the bring-your-own-database model continues
- - You retain nearly everything you ingest: the storage meter then tracks ingest anyway
- - You need a rate card before talking to sales: nothing is published now, and nothing above 1 TB stored ever was
- - Procurement requires itemised compute or seat pricing: neither is published or metered
- - Mature analyst workflows are built on an incumbent: migration cost, not pricing model, is the binding constraint
- - You want a long vendor track record: the company disclosed its first funding in May 2024
Verify before you buy
The tier figures above come from RunReveal's pricing page as archived on 18 April 2026, and the live page now carries no prices, so the only current number is the one in your quote. Get the stored-volume assumptions behind it in writing, and ask directly how the contract behaves if stored volume grows mid-term, how retention beyond the defaults is priced, how the joint ClickHouse offering will change existing terms, and how BYO-cloud infrastructure costs in your own AWS, GCP or Azure account interact with the RunReveal licence. Our methodology page explains how figures on this site are sourced and what verification means.