Open Source
What's open. What's commercial.
SocTalk is open source first. The platform you would actually run to deliver SOC services to customers is Apache 2.0 and lives at github.com/gbrigandi/soctalk. SocTalk Cloud is the commercial layer on top, covering managed control plane, support, and partner-program features. Cloud is optional, not required.
In the open source distribution
The Wazuh powered SIEM foundation, the multi-tenant base with per-tenant isolation, the AI assisted SOC workflows, the open control catalog, the basic evidence snapshots, the standard integrations, and the self-hosted deployment path. That is enough to run an MSP or MSSP SOC operation end to end without ever talking to Atricore.
Multi-tenancy is in the FOSS specifically because it is essential to the MSP and MSSP use case. We don't gate it behind a commercial license, because doing that would make the open source unusable for the audience the platform is built for.
Source at github.com/gbrigandi/soctalk. Apache 2.0, no contributor license assignment, no Atricore-only branch.
In SocTalk Cloud
SocTalk Cloud handles the managed control plane experience, the maintenance and upgrade pipeline, the support relationship, and the partner-program features that scale a growing MSP or MSSP delivery business. Specifically:
A hosted control plane that handles tenant lifecycle (onboard, suspend, decommission). White-label tenant portals for partner branding. Premium reporting and evidence workflows. Advanced RBAC and audit trails for regulated customers. Fleet management for providers running tenants across many environments. Enterprise integrations and custom mappings. Specific SLAs and feature scope are shaped per customer during the founding-customer phase.
What SocTalk Cloud does not do: host your SOC data plane unless you ask us to, take over your customer relationships, replace your analysts, or sell SOC analyst capacity as a service. The provider keeps the customer relationship and the delivery model.
When self-host fits, when cloud fits
Self-host
You run the platform. Right when you have strong k8s and postgres operations, when data residency or air-gap requirements rule out hosted infrastructure, when you are still working out unit economics on smaller customers, or when you simply prefer to operate everything in-house. The FOSS distribution gives you the full platform with no missing pieces.
SocTalk Cloud
We run the control plane. Right when you are growing past the point where platform operations is a distraction from SOC delivery, when you want partner-program features (white-label, RFC seat, channel), when compliance posture matters out of the gate, or when your engineering bandwidth is better spent on customer-facing work than on platform plumbing.
Migrate either direction
The same code runs in both modes. Migrating from Cloud to self-host is a postgres dump and a chart install. Migrating from self-host to Cloud is the same in reverse. You earn the right not to be locked in by being able to leave at any time.