Hyperparam
HypStack
Own your AI data.
An open observability stack for the AI era.
Customer pitch. Every company already has a data stack, but it wasn't built for AI-era logs. Pitch: collect with OTel, store as Iceberg in your S3, analyze with Hyperparam locally.
/ 02 The landscape
You already have a data stack .
Datadog
Splunk
Snowflake
Databricks
BigQuery
Redshift
Elastic
New Relic
CloudWatch
Honeycomb
Kafka
dbt
Airflow
Looker
Tableau
…and none of it was designed for AI.
Datadog/Splunk for ops; Snowflake/Databricks for analytics. Designed for known-cardinality, predictable-schema, human-driven systems. AI breaks every one of those assumptions.
/ 03 The shift
The shape of data is changing.
A new class of applications
Codexclient-side
Claude Codeterminal
Cursordesktop IDE
Claude Desktopdesktop app
Copilotin-editor
your app + LLMbrowser / mobile
Compute moves toward the client.
…producing piles of text
14:23:01 user refactor the auth middleware to use jose
14:23:02 system retrieved 12 docs · 38 KB context
14:23:03 tool grep("jsonwebtoken", src/) → 7 hits
14:23:04 tool read_file(auth/middleware.ts)
14:23:05 tool read_file(auth/verify.ts)
14:23:06 tool edit(auth/middleware.ts) ✓
14:23:07 tool edit(auth/verify.ts) ✓
14:23:08 tool edit(package.json) ✓
14:23:09 tool run_tests() → 3 passed
14:23:10 tool typecheck() → clean
14:23:12 assistant Here's the refactor — I switched to jose…
14:23:14 user looks good. add a test for expired tokens
14:23:16 tool read_file(auth/middleware.test.ts)
14:23:18 tool edit(auth/middleware.test.ts) ✓
14:23:21 tool run_tests() → 4 passed
14:23:23 assistant Added an expired-token case. Ready for review.
14:23:23 usage in=28,140 · out=6,820 · ~118 KB session
Megabytes of text per session, not bytes per request.
A new shape of data. A new shape of stack.
The real shift isn't "more logs" — it's a different shape of data entirely. Two things are changing at once.
First: a whole new class of applications. Codex, Claude Code, Cursor, Claude Desktop, Copilot, plus every product team bolting an LLM into their own app. These run on the client — terminal, IDE, desktop, browser — not behind your load balancer.
Second: what they emit. Not "GET /users 200 23ms." A single agent turn is a 50 KB document — prompt, retrieved context, tool calls, tool responses, completion, token counts. A real session is hundreds of those. That's megabytes of structured text per user per hour.
Datadog wants 200-byte structured events. Snowflake wants normalized rows. Neither was designed for this shape.
/ 04 The squeeze
Two stacks. Neither one fits.
Observability vendors
billed per GB ingested
30-day retention by default
structured for metrics, not text
your data, their walled garden
Warehouses
great at SQL, bad at nested LLM payloads
compute is rented, not yours
governance lives in the vendor
painful to give to a notebook or agent
Two stacks, neither built for AI workloads —both billing you for the privilege.
Observability tools want small structured events with bounded retention. Warehouses want clean rows, not 32 KB JSON tool-call blobs. AI traces are the worst of both worlds for both products.
/ 05 Today's answer
Yet another vendor .
LLM-obs prompt traces
Eval SaaS scoring runs
Agent-trace tool calls
RAG analytics retrieval logs
Prompt mgmt version + diff
A new pane of glass for every new shape of log —each one a copy of your data, behind their API.
Five new vendors, five new contracts, five copies of sensitive prompts in someone else's bucket. The moment your AI surface area changes, you need a sixth.
/ 06 The reframe
What if you owned your data?
Open format. Your bucket. Any tool that speaks it.
Source AI Agents
OTel
Store Iceberg
Analyze Hyperparam
Collect with the open standard. Store in the open format. Analyze with the open client. No proprietary middle.
Stop renting copies of your data. The pieces are now production-grade and open. OTel for collection, Iceberg for storage, object storage for cheap. The missing piece was an analysis layer that doesn't need a cluster.
/ 07 The loop
Close the loop on your agents .
Company data shapes your AI → AI emits logs →
Collectivus centralizes →
Iceberg on your S3 stores →
Hyperparam finds what works → updates flow back into company data .
The whole thing is a feedback loop. Sources on the left — agents, copilots, workforce machines, production services — emit logs. Collectivus, our OTel-based collector, ships to every machine via your existing MDM and aggregates everything into a single Iceberg table on your own S3 bucket.
Hyperparam reads that Iceberg table directly using hyparquet, icebird, squirreling, and parquetindex (full-text search). What it surfaces: where your agents are working well, where they're struggling, which prompts get retried, which tools fail.
The output isn't a dashboard — it's an update to your knowledge base. The CLAUDE.md, prompts, tool definitions, standards, and style guides your team already maintains as markdown. Hyperparam tells you what to change. The change goes back to the agents. The agents get better. The cycle repeats.
That's the pitch: not "buy another logging tool." It's "close the loop between your agents and your knowledge."
/ 08 · Layer 01 Collection
Collect from every surface.
Capture every developer, system, user, and agent — without writing a custom SDK for each one.
Collectivus — our OTel collector, deployable across your fleet via MDM
OpenTelemetry under the hood — open standard for traces, metrics, logs
Workforce coverage — laptops, dev tools, agents, production services
Agent & LLM instrumentation — prompts, tools, retrieval, evals
Schema-on-write — structured payloads, not blob dumps
We help you instrument. The data is already yours.
Collectivus is our OTel-based collector. It's open source (github.com/hyparam/collectivus) and designed to be pushed to every machine in your workforce via your existing MDM — Jamf, Kandji, Intune. The result: you capture logs from developer laptops, IDE plugins, agent runs, and production services through a single pipeline. Underneath it's pure OTel, so anything that already speaks OTLP just works.
You install Collectivus, not a Hyperparam SDK. The data flows into your S3.
/ 09 · Layer 02 Storage
Store in your bucket.
Your account. Open format. Read by anything that speaks Iceberg.
Apache Iceberg on S3 — the format every warehouse is converging on
Cheap durable storage — pennies per GB, infinite retention
Schema evolution & time travel — built into the format
Compaction & partitioning — managed for you, not by you
Catalog of your choice — Polaris, Lakekeeper, Glue, Nessie
Snowflake reads it. Databricks reads it. So does Hyperparam.
Iceberg is the consensus winner. If a customer wants to point Snowflake at their agent traces tomorrow, they can — same day, no export job. The data lives in their S3, under their IAM.
/ 10 · Layer 03 Analysis
Analyze from anywhere.
A browser-native debugger for chat logs, agent traces, and evals — no cluster, no SQL endpoint, no ingestion.
Pure-JS Iceberg + Parquet client — millions of traces in a tab
Joins across sources — Iceberg, GitHub, S3, existing warehouses
SQL, search, geospatial, ML — hyparquet, icebird, squirreling, parquetindex
Read-only, local-first — credentials stay in the browser
Embeddable — VS Code, Claude Desktop, agents themselves
One client. Every source you already have.
A pure-JS Iceberg + Parquet client. The differentiator: it doesn't just read your log table — it joins it with GitHub (PRs, issues, code), other S3 buckets, other Iceberg tables, even existing warehouse exports. Agent traces become useful when you can join them with the code the agent was editing or the issue it was assigned.
And because it's a JS client, not a query engine: HTTP range requests pull only the bytes needed, credentials never leave the browser, and an agent can query its own traces with no SQL endpoint or auth proxy in between.
/ 11 The workflow
Explore . Surface . Improve .
Not another dashboard for a metric you already track. A debugger for the new shape of AI data.
01 Explore
Browse millions of rows in a tab — JSONL, Parquet, Iceberg, no ingest
AI-assisted search across prompts, tools, retrievals, completions
Join with code — repos, PRs, issues, your warehouse
02 Surface
AI-generated labels classify failure modes at scale
Find the 1% that's broken — filter, cluster, slice
Token-burn hotspots , retry loops, tool failures
03 Improve
Validate prompt + tool changes against real traces
Update the knowledge base — CLAUDE.md, prompts, skills
Ship — close the loop back to your agents
Ground every change in real trace data — not speculation.
This is the actual workflow inside Hyperparam — what you do once the data is in Iceberg.
Explore: open a 2.3M-trace dataset in a browser tab in under a minute. AI-assisted search lets you find the conversation, retry, or tool call you're looking for without writing SQL. Join with GitHub means correlating an agent's actions with the code it was editing.
Surface: this is the part teams underinvest in. Hyperparam generates label columns at scale ("did this conversation succeed?" "was the tool call necessary?") so you can filter, cluster, and slice millions of rows down to the 1% that's actually broken — token-burn hotspots, retry loops, tool failures.
Improve: a prompt change isn't a vibe — it's a hypothesis you validate against the traces you already have. The change goes back into the knowledge base — CLAUDE.md, prompts, skills — and from there, back to the agents. Loop closed.
/ 12 How a query flows
Six steps. Zero servers in between.
step where it runs
01 Agent / copilot / dashboard issues a query client
02 Iceberg catalog: resolve table your catalog
03 Read manifest list, prune partitions client
04 Read manifests, prune data files by stats client
05 Fetch only the Parquet byte ranges needed your S3
06 Decode, filter, render client
Zero servers between the user and their data.
The catalog is the only piece that's not in their browser. Every prune happens client-side; only the bytes that survive both prunes are fetched from S3. No service to scale, page, or bill you.
/ 13 Outcomes
What this enables .
Full-fidelity AI observability — prompts, tools, retrieval, evals, all queryable
Infinite retention at object-storage prices, not Datadog prices
Agents that read their own traces direct from S3, no SQL endpoint
Notebook-grade analysis for ML engineers without warehouse credits
One copy of the data — shared across ops, analytics, ML, product
Compliance that doesn't fight you — your IAM, your VPC, your region
Same logs. Same format. No vendor in the middle.
Six concrete wins; each maps to a line item on a contract a customer is already paying for.
/ 14 Engagement
Where we come in .
You bring
your apps, agents, and services
your S3 / GCS / Azure account
your existing warehouse (optional)
your security & compliance posture
We bring
OTel + MDM instrumentation patterns
opinionated schemas for AI workloads
collector & Iceberg deployment
Hyperparam analysis client + support
Weeks to first value. No data leaves your account.
Customer brings apps and cloud account. We bring instrumentation patterns, schemas, collector config, analysis client. Few weeks from kickoff to first traces in Iceberg, queried from a notebook or desktop AI app.
/ 15 Takeaway
The AI era doesn't need a new vendor . It needs a stack you can own .
Open collection. Open storage. Open analysis. Every layer MIT or Apache 2.0. Every layer replaceable — including us .
Next time someone offers a dashboard for your AI logs, ask whether you can just own the data instead.
The pitch in three lines. When the next AI-obs SaaS shows up at $300K and a copy of your prompts, the question is no longer "which one" — it's "do I really need them in the middle of my data?"
Hyperparam
HypStack
Own your AI data.
Open observability for the AI era.
MIT / Apache 2.0 throughout. Happy to walk through any layer or sketch a deployment in your environment.
Cost shape
Datadog logs: ~$0.10–$2.50 per GB ingested, 15–30 day retention default
Splunk: ~$0.50–$5 per GB ingested, premium for retention
S3 standard: ~$0.023 per GB-month, infinite retention
S3 Glacier IA: ~$0.004 per GB-month for cold AI traces
Two orders of magnitude on storage. Compute moves to the client.
Who owns what
asset traditional HypStack
raw logs vendor cloud your S3
schema vendor-defined open Iceberg
query engine vendor JS client / your warehouse
retention policy vendor pricing tier S3 lifecycle
access control vendor IAM your IAM