Secure Observability Without Centralizing Risk

Both provide complete isolation, but Netdata achieves it architecturally - data stays on your infrastructure - while traditional solutions centralize all data first, then isolate via separate accounts. Netdata’s approach delivers 90% cost savings with inherent data sovereignty. You pay fixed per-node pricing regardless of tenant count; other vendors multiply infrastructure costs per organization.

Yes. Users can be members of multiple Spaces with different roles in each. This is perfect for MSPs where staff need to access multiple customer environments, or enterprises where admins oversee multiple business units. Each Space maintains complete isolation - users simply switch between Spaces in the UI.

Configure Netdata as a SCIM application in your IdP (Okta, Azure AD, etc.). Map AD groups to Netdata roles (e.g., ‘sre-team’ → Troubleshooter role, Production Room). When users join/leave groups in AD, SCIM automatically adds/removes them from Netdata with appropriate roles. Zero manual provisioning required.

Spaces provide physical isolation - separate infrastructure, users, billing, and rooms per customer or business unit. Perfect for MSPs or enterprises requiring complete data segregation. Rooms provide logical segmentation within Spaces - organize by environment, compliance scope, or purpose. The same node can appear in multiple Rooms, enabling flexible collaboration without security compromise.

The five roles (Administrator, Troubleshooter, Manager, Observer, Billing) cover typical enterprise use cases. For edge cases, use Rooms to provide granular access - same role, different Room membership. For example, create separate ‘Production-Application’ and ‘Production-Database’ Rooms instead of custom roles. If you have genuinely unique requirements, contact Netdata support.

All user actions, data access, and administrative changes are logged in Netdata Cloud. Logs include user identity, timestamp, action type, affected resources, and IP address. Retention is configurable for compliance with HIPAA, PCI-DSS, and GDPR. Logs are searchable in the UI and exportable for external SIEM systems.

Room membership grants access to all data from nodes in that Room. For finer granularity, create separate Rooms. For example, instead of a single ‘Production’ Room, create ‘Production-Application’ and ‘Production-Database’ Rooms with different user memberships. This provides precise control without complex permission matrices.

Data remains on Agents/Parents (never deleted) - the user simply loses query access. Previously viewed data is not retroactively removed from their browser cache, but they cannot make new queries. This satisfies ‘right to be forgotten’ requirements since data stays on infrastructure you control. Audit logs record the access revocation event.

Netdata provides SOC 2 Type 2 certification, architectural data sovereignty (metrics never leave your infrastructure), comprehensive audit logging, and on-premises deployment options. For specific requirements (HIPAA, PCI-DSS, FedRAMP), the architecture is compliance-ready - your ISSO/auditor can verify that data never leaves your control. Many regulated organizations use Netdata’s on-premises Cloud deployment for complete air-gapped operation.

Netdata uses RBAC (role-based) rather than ABAC (attribute-based) for simplicity and maintainability. However, Rooms provide attribute-like flexibility - you can create Rooms based on any criteria (environment, compliance scope, customer, project, incident) and assign users accordingly. This delivers many practical benefits of ABAC without the administrative complexity.

Yes - Netdata is ideal for MSPs. Create one Space per customer for complete isolation with independent billing. MSP staff can be members of multiple customer Spaces with appropriate roles. Each customer sees only their infrastructure; you get unified management across all customers. Cost: same per-node pricing regardless of customer count - 90% cost reduction compared to multi-org solutions from traditional vendors.

Netdata integrates with enterprise SSO providers (Okta, Azure AD, Google, GitHub, any OIDC) for authentication. Audit logs are exportable to external SIEM systems (Splunk, Elastic, etc.) for centralized security monitoring. Certificate-based authentication secures Agent-to-Cloud communication. For air-gapped environments, deploy Netdata Cloud on-premises with no external dependencies.

SOC 2 Type 2 certification means an independent auditor examined Netdata’s security controls and tested their operating effectiveness over an extended period. This covers Trust Service Criteria including Security, Availability, Processing Integrity, Confidentiality, and Privacy. The certification reduces your vendor risk management burden and satisfies most security questionnaires.

Yes. Netdata Cloud On-Premises provides the full control plane within your datacenter with no external dependencies. Agents and Parents operate completely offline, storing all observability data locally. This is ideal for regulated industries, government, defense, or any organization requiring complete network isolation. Contact Netdata for on-premises deployment details.

Netdata charges per-node pricing (with volume discounts) regardless of how many Spaces or Rooms you create. Adding tenants doesn’t increase per-node pricing - you pay for infrastructure monitored, not organizational complexity. For MSPs: each customer Space can have independent billing for chargeback. Compare to traditional vendors where multi-org accounts multiply infrastructure costs linearly.