Strix

Two observability markets are converging but no product sits at the intersection.

Traditional APM (Datadog, Dynatrace, New Relic, AppDynamics) is a $5.1B mature market — built for Java monoliths in the 2010s, later extended to microservices, now bolting on AI/ML features as an afterthought. AI observability (Langfuse, Helicone, Arize) is a $7.29B market growing at 40.5% CAGR but purpose-built only for LLM workloads — useless for the 99% of production infrastructure that isn't a prompt-completion call.

The result: engineering teams run two observability stacks. One for infrastructure (Datadog). One for LLMs (Langfuse). They don't talk. When an LLM-powered feature breaks, nobody knows whether it's the model, the RAG retrieval, the vector DB, the inference endpoint, the service calling it, the database behind it, or the infrastructure under all of it. Teams stitch context across two dashboards while customers wait.

There's a second structural gap: deployment flexibility. Most competitors force a single model. Datadog, Logz.io, Langfuse, Helicone, and Arize are SaaS-only — financial services, healthcare, government, and EU enterprises under data-residency constraints can't use them. AppDynamics and Splunk Enterprise are on-prem-only, forcing expensive, slow deployments even for customers who'd prefer managed SaaS. No observability platform lets customers choose their deployment model based on their regulatory, scale, and operational needs.

The opportunity: one platform that understands both infrastructure AND LLMs natively, auto-correlates across all signals, AND can be deployed as SaaS, in the customer's cloud, or fully on-prem — because container-based architecture plus multi-tenancy makes all three deployment modes viable from a single codebase.

Building Datadog-level infrastructure observability is already a multi-year engineering problem. Doing it AND inventing native LLM observability AND making it deployable on-prem is building three products at once.

APM Core — 20+ traditional observability modules: metrics with ML-based anomaly detection, distributed tracing with head-based AND tail-based sampling, logs with 11-type processing pipelines (Grok, JSON, Regex, GeoIP, Category, String, Arithmetic, URL, User-Agent, Remapper, Lookup) plus archive rehydration into temporary tables, RUM with Core Web Vitals and rrweb session replay, synthetic monitoring with HTTP/browser/DNS/TCP tests across 9 global locations, Kubernetes with Kubelet integration and deployment rollout tracking, network flows via eBPF, flame graphs rendered in Canvas, service topology with React Flow + dagre layout.

LLM Observability — No existing data model fits. 18 features no competitor offers: Prompt Registry with immutable versioning (v1, v2, v3) and LCS diff viewer for visualizing prompt changes; Prompt Playground for interactive multi-model side-by-side testing (GPT-4o vs Claude Sonnet vs Llama 3 simultaneously) with live cost/token metrics; custom evaluator VM sandbox executing user JavaScript safely; 6 built-in LLM scorers (Factuality, Relevance, Toxicity, PII Leakage with 8 patterns, Format Compliance, Prompt Injection with 18 patterns); annotation queues with Cohen's Kappa for inter-annotator agreement; dataset management with 5 source types and 5 export formats (CSV, JSONL, OpenAI, HuggingFace, Alpaca); RAG analytics with chunk analysis identifying low-relevance, missing, overlapping, stale chunks; agent run monitoring with loop detection, replay, and tool-call success tracking; model A/B comparison with shadow mode (run production traffic against alternative models) and weighted verdicts; guardrails with 4 actions (Block, Redact, Flag, Log); 67+ customizable LLM pricing models; conversation tracking by session/user/time-window; 4 privacy levels for LLM data.

Alerting sophistication — 9 detection methods: threshold (static + dynamic), ML-based anomaly with 3 algorithms (Agile, Robust, Adaptive), change detection, forecast-based with 3 algorithms (linear, seasonal, auto), composite (AND/OR aggregation), outlier (MAD or DBSCAN), log-based, trace-based, multi-window SLO burn rate.

Enterprise scope — RBAC with resource-level permissions, SAML 2.0 SSO, LDAP/Active Directory, SCIM provisioning, comprehensive audit trails, compliance frameworks (CIS, HIPAA, SOC2, PCI-DSS, ISO 27001) with vulnerability scanning and CVSS scoring, on-call scheduling with escalation policies, incident management with war rooms and automated post-mortems, collaborative TipTap notebooks for runbooks.

Deployment-agnostic infrastructure — Container-based across every layer (API, frontend, workers, agent, databases), making three deployment modes viable from a single codebase: (1) Strix-hosted multi-tenant SaaS for mainstream customers; (2) customer cloud / private cloud deployment to AWS, Azure, or GCP VPC for data-control needs; (3) fully on-prem via Docker Compose (single-node) or Kubernetes Helm (multi-node with distributed ClickHouse cluster + Redis Sentinel + horizontal API pod scaling) for regulated or air-gapped environments. Multi-tenant isolation at the data layer (sipHash64(org_id) partitioning in ClickHouse, row-level org scoping in PostgreSQL) supports both SaaS and per-customer-cloud models.

Unusual target personas — Traditional APMs target DevOps/SREs. Strix explicitly unifies platform engineers, SREs, DevOps, AI/ML engineers, product managers (via business transactions), and security teams in one tool. This means the UI must work for incident responders staring at flame graphs AND ML engineers debugging RAG retrievals, without either feeling they're in the wrong product.

Five personas, one platform — 234,834 lines of TypeScript across 1,146 files, 39 backend modules, 77 Prisma data models, 100+ API endpoints, 4 SDKs, 4 different databases chosen for different query patterns, 95+ integrations, 24-section in-product user guide with context-sensitive help throughout the UI.

Four-layer architecture: Collection → Streaming Ingestion → Hybrid Storage → Query/Presentation. Each layer designed for independent horizontal scalability.

Collection Layer — Four SDKs targeting different workloads. Node.js SDK (`@strix-apm/sdk`) with OpenTelemetry-compliant auto-instrumentation for 12+ libraries (Express, Fastify, TypeORM, Sequelize, Redis, Postgres, MongoDB, MySQL, http, https, gRPC, GraphQL) and W3C Trace Context distributed tracing. Python SDK (`strixllm`) with LLM-specific auto-instrumentation for OpenAI, Anthropic, Amazon Bedrock, Google Vertex AI, Ollama, vLLM plus LangChain, LlamaIndex, LiteLLM, ChromaDB, Pinecone, Weaviate, and Hugging Face Transformers. Browser SDK with Core Web Vitals (LCP, INP, CLS, FCP, TTFB), session replay via rrweb, JS error capture, geographic tagging, network waterfall, source map support. Go host agent with eBPF-powered network flow monitoring, <1% CPU and <100MB RAM footprint, local disk WAL buffering for offline resilience, gzip-compressed transit.

Streaming Ingestion Layer — NestJS + Fastify at 45K+ RPS with OTLP/HTTP2/Protobuf receiver, Prometheus scrape targets, StatsD support, gzip decompression, head-based sampling at collector edge. Redis Streams as event bus across six streams (metrics, traces, logs, events, alerts + DLQs). Piscina worker thread pools handle validation, enrichment, transformation, and tail-based sampling.

Hybrid Storage Layer — Four databases chosen for distinct query patterns. TimescaleDB for metrics (hypertables partitioned by day, compressed after 7 days, raw 10s samples rolled up into 1m/5m/1h/1d aggregations). ClickHouse for traces/logs/profiles/RUM (distributed tables partitioned by day with multi-tenant isolation via sipHash64(org_id), tuned for OLAP analytical queries). PostgreSQL via Prisma with 77 data models (transactional configuration — users, organizations, dashboards, alerts, incidents, SLOs, integrations, prompt templates, datasets). Redis for real-time pub/sub, rate limit counters, alert state, query cache, session storage.

Query & Presentation Layer — React 18 + Vite + Zustand + TailwindCSS. Dashboard builder (react-grid-layout + uPlot + ECharts with 8 widget types). Trace waterfall (Canvas flame graphs for 10K+ span traces). Log explorer (Monaco editor for queries + React Virtuoso for virtualized scrolling). Service map (React Flow 12 + dagre force-directed layout). Session replay (sandboxed rrweb-player iframe). Notebooks (TipTap collaborative markdown). Metric explorer (visual query builder + live charts).

Auto-correlation engine — When a user drills into a dashboard metric spike, Strix cross-references timestamp + service tag + host to retrieve traces with status=error in the same window, fetches log lines tagged with matching traceId, pulls host metrics showing CPU/memory pressure, surfaces deployment events on the timeline, and suggests root cause from correlated signals. One click from symptom to cause.

LLM Observability Stack — 18-attribute span model capturing every LLM call with provider, model, request type, token counts, cost, TTFT/total latency, temperature, top_p, stream flag, prompt content (with privacy levels), completion content, template ID/version, finish reason, error type. Conversation aggregation by session/user/time-window. RAG pipeline tracing with embed → retrieve → rerank → assemble → LLM span hierarchy. Agent execution trees with loop detection and replay. Secure VM sandbox for custom evaluators. Shadow mode for A/B testing models against production traffic without impacting users.

Alert engine — 9 detection methods running as independent evaluator workers. Notification routing across Slack, email, PagerDuty, OpsGenie, Microsoft Teams, custom webhooks with template variables.

Enterprise security — JWT, @node-saml for SAML 2.0 SSO, ldapts for LDAP/Active Directory, SCIM provisioning, bcryptjs for passwords. RBAC at resource level. Comprehensive audit trails. Compliance scanning for 5 frameworks with CVSS-scored vulnerability findings.

Deployment — Three deployment modes from one codebase. SaaS: Strix-hosted multi-tenant with per-org data isolation via sipHash64(org_id) in ClickHouse and row-level scoping in PostgreSQL. Customer Cloud / Private Cloud: Kubernetes Helm charts deploy into customer AWS/Azure/GCP VPC with distributed ClickHouse cluster, Redis Sentinel for HA, horizontal API pod scaling. On-prem / Air-gapped: Phase 1 single-node Docker Compose (PostgreSQL + TimescaleDB + ClickHouse + Redis + API + Frontend); Phase 4 Kubernetes Helm multi-node with the same distributed topology. No external managed services required at any tier.

In-product documentation — 24-section embedded user guide in the React app. Every feature has positioning, workflows, examples, and troubleshooting. Context-sensitive help throughout the UI. Glossary of 30+ observability terms.

Strix sits in an unusual market position — not competing with Datadog on integration count (they have 700+, Strix has 95+), not competing with Langfuse on LLM-only depth (Strix is broader), but occupying the intersection: a unified observability platform that understands both infrastructure AND LLMs, deployable on-prem.

Feature scoring vs incumbents — Internal 21-category competitive comparison scored Strix at 199/210 vs Datadog 190/210, AppDynamics 95/210, Logz.io 86/210. Strix wins on LLM Observability (10/10 vs Datadog 6/10, AppDynamics and Logz.io both 0/10), Network Monitoring, Composite SLOs, Business Transactions, Carbon/Sustainability tracking, and on-premise deployment.

18 unique features no competitor offers: Prompt Registry with LCS diff viewer, Prompt Playground, annotation queues with Cohen's Kappa, dataset management with 5 export formats, custom evaluator VM sandbox, 6 built-in LLM scorers, RAG chunk analysis, agent loop detection, model A/B with shadow mode, fine-tuning data export, 67+ customizable LLM pricing models, cohort retention heatmap + LTV analytics, carbon/sustainability cost tracking, capacity forecasting, composite SLOs with AND/OR aggregation, RUM performance budgets per-vital, Alibaba + Huawei cloud native support, on-premise first via Docker Compose + Kubernetes Helm.

Technical depth: 234,834 lines of production TypeScript across 1,146 files. 39 backend modules, 77 Prisma data models, 100+ API endpoints. 4 SDKs (Node/Python/Browser/Go with eBPF). 4 storage engines tuned for distinct query patterns. 95+ integrations covering 5 major cloud providers (AWS 13 services, Azure 7, GCP 9, plus Alibaba and Huawei with HMAC signing). 24-section in-product user guide embedded in the React app with searchable context-sensitive help.

Enterprise readiness: RBAC at resource level, SAML 2.0 SSO, LDAP/Active Directory, SCIM provisioning, comprehensive audit trails. Compliance scanning for CIS, HIPAA, SOC2, PCI-DSS, ISO 27001. Three deployment modes: SaaS (multi-tenant hosted), Customer Cloud (Helm into their VPC), On-Prem (Docker Compose single-node or Kubernetes Helm multi-node, air-gapped supported).

Target market unlock: Deployment flexibility opens three distinct segments most competitors can't serve at once. Mainstream SaaS customers get a Datadog-style hosted experience with better LLM observability. Mid-market and enterprise customers with cloud-control needs get private-cloud deployment into their own VPC. Regulated enterprises (financial services, healthcare, government, EU under GDPR/data-residency) get fully on-prem deployment — previously they had to choose between "no AI observability" and "ship customer data to SaaS." Strix makes unified APM + LLM observability viable across all three.

Deployment-agnostic architecture unlocks three markets from one codebase. Container-based components plus multi-tenant data isolation means the same codebase runs as SaaS, in a customer's VPC, or fully on-prem. The architectural discipline required to ship on-prem (no managed services dependencies, every component self-contained, Docker Compose must work on a laptop) also makes SaaS and customer-cloud deployments easier — not harder. Competitors force a single deployment model because their architecture made that choice for them; Strix treated deployment model as a product feature from day one.

LLM observability is a wide-open space because incumbents are bolting it on as an afterthought. Datadog's LLM score is 6/10 because they're retrofitting prompt tracking into a span format designed for HTTP requests. Building LLM-native data models from day one (18-attribute spans, conversation aggregation, RAG pipeline tracing, agent execution trees) produces fundamentally better primitives than retrofitting.

Hybrid storage is non-negotiable. Metrics want time-series compression with rollups — TimescaleDB. Traces and logs want OLAP analytical queries over partitioned columnar data — ClickHouse. Configuration wants transactional consistency with foreign keys — PostgreSQL. Real-time state wants in-memory pub/sub — Redis. Forcing all four workloads into one database produces a platform that's mediocre at everything.

Auto-correlation is the feature that justifies unified observability. Users don't benefit from having metrics + traces + logs + RUM in one place if they still have to manually pivot between them. The engineering effort to link a dashboard spike to its traces to its logs to its host metrics to its deployment timeline is the actual product — the data pipeline is the precondition.

The 18 unique features are a structural moat, not a feature list. Incumbents can ship LLM dashboards quickly. They can't ship prompt registry with LCS diff + custom evaluator VM sandbox + annotation queues with inter-annotator agreement + dataset management with fine-tuning export + agent loop detection without reengineering their core platform. The moat is that adding these requires them to break their existing customers.

Targeting platform engineers + SREs + DevOps + AI/ML teams + product managers + security teams in one tool requires UI discipline most observability platforms lack. The flame graph SREs need must coexist with the prompt playground ML engineers need and the conversion funnel product managers need — without any persona feeling they're in the wrong product. This is a design problem, not an engineering one.

Deployment choice is a structural advantage in enterprise sales. Customers don't want to be told where to run their observability platform — they want to choose based on their regulatory environment, cloud strategy, and operational maturity. Offering SaaS + customer-cloud + on-prem from one product removes the biggest objection in enterprise deals ("we can't send our data to your cloud") while still serving mainstream customers who want managed SaaS. This is how you compete simultaneously with Datadog (SaaS), Dynatrace Managed (customer cloud), and Splunk Enterprise (on-prem) with one product.