Skip to content
MTTL, Mean Time To Learn

BusinessPractitioner13 min read

The state of the sovereign observability market

Who the observability leaders are and under which law they operate, the ongoing consolidation, the five families of offers, what each one guarantees in terms of sovereignty and what the market still lacks.

For: architects · team managers · finance, risk and compliance · executives and CIOsPrerequisites: Reading Observability and digital sovereignty first helps to place the families of offers.

Reading mode

The observability market is still dominated by vendors subject to US law. It is quickly concentrating in the hands of security groups and data platforms. Faced with the demand for sovereignty, these vendors mostly answer with European regions, meaning data residency (storing data in a given country) rather than a change in the applicable law.

Truly sovereign answers exist, though they are fragmented: observability services built into European clouds, a few European vendors and above all open source building blocks to assemble and operate yourself. What the strongest options have in common is OpenTelemetry, which makes the choice of backend reversible. The technical building blocks exist; what the market lacks is an integrated offer that is qualified and operated under European law from end to end.

Section titled “1. The market in figures and trends”

A size that is hard to measure, spending that rises fast

Section titled “A size that is hard to measure, spending that rises fast”

Size estimates vary by a factor of four depending on scope: about USD 2.9 billion in 2025 for Mordor Intelligence, while Gartner reportedly projects USD 14.3 billion in 2028. Both figures are reported by the trade press; I did not have access to the reports themselves. The most reliable signal comes from customer spending: 44% of Gartner clients now spend more than one million dollars a year on observability, up from 36%.

That budget weight matters for sovereignty: the more spending is concentrated with a single vendor, the more expensive leaving becomes and the more economic lock-in sets in.

The leaders according to Gartner

Section titled “The leaders according to Gartner”

The Magic Quadrant is the analyst firm Gartner’s annual ranking. It places each vendor on two axes, ability to execute and completeness of vision; the leaders are those placed best on both. The 2026 edition for Observability Platforms, published in July 2026, assessed 19 vendors. Seven vendors have announced their own placement among the leaders:

Vendor2026 placementOwnership
DatadogLeader for the sixth year, placed highest for ability to executeListed US company
DynatraceLeader for the sixteenth timeListed US company of Austrian origin
Grafana LabsLeader for the third year, placed furthest for vision for the second yearUnlisted US company
ElasticLeader for the third yearElastic N.V., a Dutch company listed in New York; the entity contracting for Elastic Cloud is to be checked
ChronosphereLeader for the third year, now renamed Cortex XCORSubsidiary of Palo Alto Networks (United States)
CoralogixNew leader, rated visionary in 2025Company of Israeli origin, structured as an Inc. (a US company form)
IBM (Instana)LeaderListed US company

Honeycomb is among the visionaries. For the other vendors, only the press reports a placement: according to Network World, New Relic would also be a leader, Splunk (Cisco) a challenger and ScienceLogic a niche player. These three placements are not confirmed by the vendors. Of the seven confirmed leaders, six belong to a non-European parent company; only Elastic is Dutch, though its exposure depends on the entity that operates the service and on its US subsidiaries.

Section titled “Four underlying trends”
  1. Volume control. According to the Magic Quadrant summary, market growth is driven more by managing the volumes collected than by adopting advanced AI features. Processing pipelines, which filter and route data before storage, are becoming a product in their own right.
  2. AI for investigation. All leaders highlight agents that analyze incidents autonomously. Gartner nevertheless notes growing attention to the actual return on investment of these features.
  3. Growing use of managed services. According to the Grafana Labs annual survey, half of organizations now use managed observability in some form, up from 43% in 2025. This trend runs against sovereignty when the managed service falls under foreign law.
  4. OpenTelemetry as the de facto standard. New entrants are built natively on OpenTelemetry and the historical players accept it as input. For reversibility, that is the most favorable development.

2. A consolidation that changes the picture

Section titled “2. A consolidation that changes the picture”

The market is reshaping fast. Independent players are absorbed by cybersecurity, networking or data platform groups whose priorities are not those of their observability customers.

DateDealWhat it changes
January 2026Palo Alto Networks completes the acquisition of Chronosphere for USD 3.35 billionAn observability leader becomes a building block of a security platform and changes name
January 2026Snowflake announces the acquisition of Observe, built on Apache Iceberg (an open table format for data) and OpenTelemetryObservability moves closer to data platforms; signals stay in the customer’s Snowflake account
March 2026ServiceNow Cloud Observability, formerly Lightstep, reaches end of life on 1 March, or at contract end if laterCustomers have to migrate: the risk of a product disappearing is real
January 2025Datadog acquires Quickwit, an open source log search engine founded by French engineersA technology designed for self-hosting joins a US SaaS vendor that highlights data residency
2024Cisco completes the acquisition of SplunkA historical log analytics player joins a network equipment maker

For a sovereignty approach, these moves illustrate the strategic dimension: the tool chosen today can change owner, name, license or roadmap within a few months. OpenTelemetry instrumentation and dashboards managed as code reduce the cost of these changes when you have to undergo them.

3. The five families of offers

Section titled “3. The five families of offers”

Family A: the leaders’ SaaS platforms

Section titled “Family A: the leaders’ SaaS platforms”

Datadog, Dynatrace, Grafana Cloud, Elastic Cloud, Splunk, New Relic, Chronosphere or Coralogix offer the most complete platforms. Their answer to the demand for sovereignty takes two forms.

  • European regions. Datadog has operated a European region in Germany since 2018. Grafana Cloud offers several European regions (including Germany, Ireland, Sweden, the Netherlands, Belgium and Switzerland) and puts its contracts under Irish law outside the Americas, the United Kingdom, Australia and New Zealand, while still being operated by a New York company. These regions bring data residency, not a change in the law that applies to the parent company.
  • Self-hosted versions. Elastic, Splunk, Dynatrace (with its Managed version) or Grafana Enterprise can be installed inside the customer’s perimeter. The data stays under control, though the license, updates and roadmap are still decided by the vendor.

Family B: vendors deployed on sovereign clouds

Section titled “Family B: vendors deployed on sovereign clouds”

Sovereign clouds attract vendors. The AWS European Sovereign Cloud has a marketplace in euros where partners offer their solutions inside the sovereign environment. S3NS uses Elastic Security as the SIEM (the central tool for analyzing security events; a testimonial published by Elastic) of its trusted offer and is considering an enriched Elastic offer for its customers. This model improves operations and location, though the technology is still that of a non-European vendor.

Family C: observability services from European clouds

Section titled “Family C: observability services from European clouds”

European clouds include managed observability services, almost all built on open source building blocks.

ServiceProviderComponentsPoint to check
CockpitScaleway (France)Grafana, Prometheus, Loki, traces; export to external toolsCoverage of services outside Scaleway, alerting features
Logs Data PlatformOVHcloud (France)OpenSearch, Graylog; managed GrafanaOVHcloud states that LDP does not offer the same qualification levels as its VMware offer (SecNumCloud, PCI-DSS for card payments, HDS for health data)
STACKIT ObservabilitySTACKIT (Germany)Grafana, Prometheus, Loki, Tempo, Thanos; OTLP (OpenTelemetry protocol) log ingestion since 2026 (according to a STACKIT partner)Operations limited to German data centers

European providers also offer managed stacks, such as ayedo in Germany (VictoriaMetrics, OpenTelemetry, Grafana) or Aiven in Finland for Grafana and OpenSearch.

Family D: European vendors

Section titled “Family D: European vendors”
VendorOriginPositioningPoint to check
CentreonFranceOn-premises or SaaS observability platform; OpenTelemetry-native log management; logs hosted by OutscaleFirst funding round raised from the US fund Sixth Street; the rest of the SaaS was hosted on AWS at the date of the article
Dash0Founded in Germany, now AmericanOpenTelemetry-native platform; USD 110 million raised in March 2026 at a one-billion valuation; more than 600 customersThe company is headquartered in New York while keeping its teams in Europe; according to its terms of use, the legal entity is Dash0 Inc., registered in Delaware. It therefore falls under US law, like the leaders

Dash0 illustrates a frequent case: European technology and teams with a US legal structure adopted to raise funds. For sovereignty, the latter is what counts. Historical infrastructure monitoring vendors such as Zabbix (Latvia) or Checkmk (Germany) complete the landscape, with a scope more focused on metrics and availability.

Family E: open source building blocks to self-host

Section titled “Family E: open source building blocks to self-host”

This is the family that offers the most control, provided you have the skills to operate it.

  • Collection and transport: OpenTelemetry (CNCF, the Cloud Native Computing Foundation, a neutral foundation that hosts the project), the de facto neutral standard.
  • Metrics: Prometheus (CNCF), VictoriaMetrics, Mimir.
  • Logs: OpenSearch (Linux Foundation), Elasticsearch (with an AGPL license option since 2024, a free software license that requires publishing your changes, including for an online service), Loki, Quickwit, ClickHouse.
  • Traces: Jaeger (CNCF), Tempo.
  • Visualization: Grafana, under the AGPLv3 license since 2021, OpenSearch Dashboards, Kibana.

The license is not enough: you also have to look at who governs each project. Projects hosted by a neutral foundation offer a better guarantee of continuity than those controlled by a single vendor, which can change its license or strategy.

4. A sovereignty reading: what each family guarantees

Section titled “4. A sovereignty reading: what each family guarantees”

The table crosses the families with the four questions that matter most for an observability chain. It is a general reading: each offer has to be assessed case by case, contract and scope in hand.

FamilyApplicable lawOperationsTechnologyReversibility
A. Leaders’ SaaS, European regionNon-European, through the parent companyVendor and its international supportProprietaryLow, except with OpenTelemetry instrumentation
A. Self-hosted version of a leaderData under the customer’s control; software subject to the vendor’s choicesCustomerProprietary or source-available depending on the caseMedium
B. Vendor deployed on a sovereign cloudDepends on the cloud operator and on the vendor’s statusEuropean operator, vendor in supportNon-EuropeanMedium
C. Service from a European cloudEuropeanEuropean operatorOpen source building blocksGood if the formats are standard
D. European vendorEuropean, subject to the location of the headquarters and to the shareholdingVendorIn-house, often OpenTelemetry compatibleMedium to good
E. Self-hosted open sourceThe customer’s ownCustomer or its providerOpenHigh

Three findings stand out:

  1. Applicable law and functional richness move in opposite directions. The most complete offers fall under non-European law; the offers under European law are more modular and require more integration.
  2. Self-hosting moves the problem to skills. It settles the legal and operational questions, though it assumes a team able to operate, size and evolve the stack.
  3. OpenTelemetry is the only factor that improves every family. Instrumenting with OpenTelemetry does not make an offer sovereign, though it always keeps moving from one family to another possible.

5. What the market lacks and what it implies

Section titled “5. What the market lacks and what it implies”

Five gaps

Section titled “Five gaps”
  1. No integrated offer equivalent to the leaders under European law. Among the sources consulted, no offer combines the functional richness of the leading platforms (APM, meaning application performance monitoring, logs, traces, profiling, AI for investigation), operations under European law and a SecNumCloud-type qualification.
  2. Qualifications that do not always cover observability. A qualified provider may offer an observability service that is not qualified, as OVHcloud states for Logs Data Platform. The scope has to be checked service by service.
  3. A shortage of operational skills. The most sovereign families (C and E) assume you know how to assemble, size and operate an open source stack. That is currently the main obstacle to their adoption.
  4. AI for investigation is rarely sovereign. The leaders’ assisted analysis features rely on models hosted by the vendor or its partners. Alternatives exist on the infrastructure side, with models deployed on qualified infrastructure, though few observability offers integrate them.
  5. Captured pipelines and control planes. Control planes are the tools that drive collector configuration. Processing pipelines, now strategic for controlling volumes, are often built into proprietary platforms: the Chronosphere pipeline now belongs to Palo Alto Networks. Neutral building blocks exist (the OpenTelemetry Collector, OpAMP, the OpenTelemetry fleet management protocol), though products that industrialize them remain rare.

What this implies

Section titled “What this implies”
  • For buyers, the realistic choice is rarely a single offer. It is rather a hybrid architecture: neutral collection with OpenTelemetry, a sovereign backend for sensitive signals, a richer tool for the rest, with a gateway that decides what leaves.
  • For integrators and managed service providers, the demand is for assembly, operations and proof of sovereignty more than for a tool license. The Cloud Sovereignty Framework, the upcoming CADA (Cloud and AI Development Act) and the removal of switching charges on 12 January 2027 open a window favorable to migrations.
  • For European vendors, the challenge is to close the functional gap without reproducing the dependencies they claim to avoid: headquarters, shareholding, SaaS hosting and the origin of AI models will be scrutinized by buyers.

Sources

Section titled “Sources”