Gravwell
Gravwell provides a Security Data Platform with structure-on-read architecture for ingesting and analyzing raw logs, metrics, and security telemetry at scale. It targets enterprise security teams replacing legacy SIEMs, offering indexer-based pricing, AI-assisted Logbot analysis, and bundled expert support.
- Company typePrivate
- Founded2017
- HeadquartersCoeur D'alene, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Gravwell does
Gravwell, Inc. is a privately held US-based software vendor founded in 2017 that provides a Security Data Platform (SDP) for centralized log, metrics, and security analytics. Its core technology is a structure-on-read data lake that ingests raw data in its native format and applies structure only at query time, accessed through a proprietary Unix-style pipeline query language. The platform supports on-premises, cloud, and hybrid deployments, handles hundreds of terabytes of logs per day using roughly 40% less compute than competitors, and is priced per indexer rather than per gigabyte. A native ingester catalog covers sources including Kafka, Kinesis, S3, Azure Event Hubs, Microsoft Graph, Okta, Mimecast, Office 365, PCAP, NetFlow, SNMP, and Windows Events, and the company ships a Splunk migration utility to lower switching friction from legacy SIEMs.
The company monetizes through annual subscriptions across three paid editions - Pro ($35k+), Enterprise ($70k+), and a managed Cloud Edition - alongside a free Community Edition (13.9GB/day) and Community Advanced (50GB/day) that functions as a product-led growth funnel. A dedicated Mission Support expert is bundled with every paid license, and built-in SOAR functionality and Logbot AI are integrated into the platform. Customer segments span enterprise security teams replacing legacy SIEMs, IT/OT organizations with high-volume machine data, and enterprises deploying LLMs and AI agents that need visibility and audit trails. Gravwell employs 11-50 people and is led by founders Corey Thuen (CEO) and Kris Watts (CTO).
The go-to-market combines a freemium self-serve channel with enterprise field sales targeted at organizations seeking SIEM replacements, supported by content marketing, a Discord developer community, GitHub open-source tooling, and a dedicated documentation portal. In October 2025 the company closed a $15.4 million Series A led by Two Bear Capital with participation from Gula Tech Adventures and Next Frontier Capital, citing over 100% year-over-year growth driven by international demand and enterprise adoption.
Gravwell firmographics
Firmographics- Name
- Gravwell
- Legal name
- Gravwell, Inc.
- Website
- https://gravwell.io
- Company type
- Private
- Founded year
- 2017
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Gravwell provides a Security Data Platform with structure-on-read architecture for ingesting and analyzing raw logs, metrics, and security telemetry at scale. It targets enterprise security teams replacing legacy SIEMs, offering indexer-based pricing, AI-assisted Logbot analysis, and bundled expert support.
- Ownership category
- akta.pro rank
Where Gravwell is headquartered
LocationHeadquarters
- HQ city
- Coeur D'alene
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Gravwell business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- Self-Hosted Enterprise Licenses: Self-hosted deployment model priced based on number of indexers in the cluster. Organizations purchase indexer licenses with unlimited ingest capacity per indexer. Pro Edition starts at $35k+ and Enterprise Edition starts at $70k+. Includes Mission Support partnership.
- Cloud Edition: Cloud-hosted deployment where Gravwell manages hosting and maintenance of the Gravwell Cluster. Customers pay for convenience of outsourced infrastructure management.
- Community Edition (Freemium): Free tier for personal and small commercial projects with ingest limits (13.9GB/day standard, 50GB/day advanced). Serves as product-led growth funnel to convert users to paid tiers.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Others | Free tier for small commercial projects and personal use with basic ingest limits |
| Subscription | Annual | Entry-level paid tier for organizations with single business units |
| Subscription | Annual | Full-featured enterprise tier for critical environments and enterprise SOCs |
| Subscription | Annual | Cloud-hosted deployment option with outsourced infrastructure management |
Go-to-market motion2 records
Distribution channels4 records
Marketing channels9 records
Gravwell product offering
Product offeringCore offering
Gravwell sells a Security Data Platform (SDP) that ingests any raw data source (logs, metrics, PCAP) into an on-disk data lake using a structure-on-read model and exposes it through a pipeline-style query language for security, IT, and OT analytics. The offering is sold as self-hosted subscriptions priced by indexer count (Pro from $35k, Enterprise from $70k), a managed Cloud Edition, and a free Community Edition, with an optional Logbot AI add-on for AI-driven threat investigation and built-in SOAR functionality.
Product overview
Gravwell is a Security Data Platform (SDP) offering a unified solution for logs, metrics, and security analytics. The core platform uses a structure-on-read data lake architecture that ingests raw data without pre-processing. The portfolio includes the Security Data Platform (core product), Logbot AI for AI-powered threat detection and investigation, Mission Support for dedicated expert assistance, and multiple edition tiers (Community, Pro, Enterprise, Cloud). Community Edition provides free access with 13.9GB/day ingest, while Pro ($35k+) and Enterprise ($70k+) tiers offer scalable enterprise capabilities. The Cloud Edition provides fully managed deployment. A Splunk Migration Tool enables data migration from legacy SIEMs, and the Gravwell REST API enables programmatic control and third-party integration.
Differentiator
Problem solved
Functional benefit
Brands
- Security Data Platform (SDP): A platform designed to replace legacy SIEMs, enabling enterprises to ingest and retain full-fidelity data, query anything, and scale without per-GB pricing surprises.
- Logbot AI
- Mission Support
Products and services
- Security Data Platform (SDP) The core Gravwell platform that ingests any raw data source (logs, metrics, PCAP) into an on-disk data lake using a structure-on-read model and exposes pipeline-style search and analytics for security, IT, and OT teams. Targeted at enterprise security operations and IT organizations replacing legacy SIEMs.
- Logbot AI (AI Detect & Assist) AI log analysis add-on that enables natural language querying, automated anomaly detection, and autonomous multi-step threat investigations across full-fidelity logs and telemetry, with OpenAI-compatible API and MCP client support. Aimed at SOC analysts and security teams seeking AI-assisted threat hunting.
- Mission Support Dedicated Gravwell expert service included with paid editions, providing onboarding, tuning, and ongoing assistance to enterprise customers deploying the platform.
- Community Edition Free downloadable edition of Gravwell with a 13.9 GB/day ingest limit, providing full search and automation capabilities for individuals and small commercial projects, and serving as a product-led growth funnel to paid editions.
- Pro Edition Paid self-hosted subscription edition priced from $35k, designed for organizations with a single business unit that need event collection, search, automation, and included Mission Support.
- Enterprise Edition Premium self-hosted subscription edition priced from $70k, optimized for critical environments and enterprise security operations centers, with advanced features including SSO, replication, region-aware redundancy, and CBAC permission controls.
- Cloud Edition Cloud-hosted subscription edition (from $70k) where Gravwell manages hosting and maintenance of the cluster, allowing customers to concentrate on data analysis.
- Gravwell REST API REST API providing programmatic control over Gravwell features including direct search queries, automation, and integration with external systems, with documented endpoints and OpenAI-compatible AI endpoints.
- Splunk Migration Tool Tool for migrating data from Splunk indexes and flat files into Gravwell, supporting Splunk authentication tokens and index-to-tag mapping, aimed at organizations replacing Splunk.
Quantifiable outcome
- Handle hundreds of terabytes of logs each day using 40% less compute than competitors
- +2 more outcomes
Companies that use Gravwell
Customer profileSegments3 records
Ideal customer profiles3 records
Gravwell technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration18 records
AI capability5 records
Feature7 records
Gravwell partnerships and signals
Strategic signalScale indicators3 records
Recent moves5 records
Expansion highlights4 records
Gravwell competitors and assessment
Company assessmentMarket position
Competitive moat5 records
Key highlights7 records
Customer concentration
Gravwell social profiles
Digital presenceGravwell financial estimates
Financial estimateRevenue estimate
Valuation estimate
Gravwell leadership team
Management profileNumber of profiles
Profiles2 records
Gravwell funding detail
Funding detailFunding overview
Funding rounds3 records
Investors5 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Gravwell M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Gravwell
What does Gravwell do?
Gravwell sells a Security Data Platform (SDP) that ingests any raw data source (logs, metrics, PCAP) into an on-disk data lake using a structure-on-read model and exposes it through a pipeline-style query language for security, IT, and OT analytics. The offering is sold as self-hosted subscriptions priced by indexer count (Pro from $35k, Enterprise from $70k), a managed Cloud Edition, and a free Community Edition, with an optional Logbot AI add-on for AI-driven threat investigation and built-in SOAR functionality.
Is Gravwell a public or private company?
Gravwell is a private company. It is classified as venture growth investor backed and is currently operating.
When was Gravwell founded?
Gravwell was founded in 2017. It employs 11 to 50 people.
Where is Gravwell based?
Gravwell is headquartered in Coeur D'alene, United States, in the North America region.
How does Gravwell make money?
Three revenue lines are on record. Self-Hosted Enterprise Licenses are the primary driver. The others are cloud Edition and community Edition (Freemium).
Does Gravwell have an API?
Yes. Gravwell uses a REST API which can control essentially every feature in the system. The direct search API is particularly useful as it lets external systems query data from Gravwell in a single HTTP request. Gravwell also has the capability to interact with the APIs of various other applications within its automation systems. The AI configuration supports OpenAI-compatible API endpoints for Logbot AI chat completions, and MCP (Model Context Protocol) client configuration is available for connecting external MCP servers to Gravwell's Logbot agent. Developer documentation is at docs.gravwell.io/api/api.html.