🚀 Enterprise Features
- Audit Logs: Immutable tracking (who/what/when/context), before/after state tracking, time/project filtering, UI exports. Locked in separate cloud account.
- SSO: OIDC-based (Okta, Azure AD, GitHub, Authentik, Keycloak). Self-service DNS domain verification. SCIM provisioning/deprovisioning.
- Compliance: SOC 2 Type II, ISO 27001, HIPAA, GDPR compliant.
🔧 Configuration & Management
- Retention: Project-level policies (3 days minimum to unlimited). Nightly automated purges.
- Long-term Storage: Configure Blob Storage Exports (S3, GCS, Azure) for retention bypass.
- RBAC: Audit logs restricted to OWNER/ADMIN via
auditLogs:read.
- API Security: Basic Auth via hashed, rotatable public/secret key pairs.
💡 Best Practices (Patterns)
- SSO Enforcement: Mandate IdP routing to eliminate local authentication risks.
- Automated Provisioning: Implement SCIM to automate user onboarding/offboarding workflows.
- Data Lifecycle: Define strict project-level retention windows and sync critical telemetry to external Blob Storage (S3/GCS) pre-purge.
- Least Privilege: Restrict
auditLogs:read to minimal essential administrative personnel.
🚨 Gotchas & Warnings (Anti-patterns)
- Rate Limits: Mass data deletion (large trace volumes) is resource-intensive and triggers API rate limiting.
- Cascading Deletions: Trace deletion automatically cascades across all storage, permanently wiping associated scores and observations.
- Log Access: Open-source versions collect audit data but lack the UI viewer/export tools (requires Enterprise Edition).
- Nightly Purge Delay: Retention purges run nightly; data outside the window remains queryable until the batch job executes.
🔍 References