guided pilot open · hosted scoring + OTLP managed replay + labelled evaluation →

Find unusual field
combinations before
the logs land.

Engrammatic scores structured CDN, auth and operations events as they arrive. It supplies a combinatorial-novelty signal beside Hydrolix, Splunk, Datadog or your data lake—then reports alert burden, held-out quality, latency and cost so you can decide whether a source-specific profile is safe to pilot.

▶ 60-sec quickstartread the production boundaries →
decision first
quality + alert load + cost
$1.00 /M
developer · qualified contracts from $0.30
source-specific
versioned encoder profiles
engrammatic.detect() · sample stream popcount · xor
1auth/login200ok
2auth/login401anomaly
3api/v1/charge200ok
4cdn/asset.js200ok
5api/v1/charge500anomaly
6queue/dequeue200ok
signal
0.87 novelty
profile
cdn-pilot-v1
policy
review
// illustrative signal — verified run metrics live in reports ↓
// works alongside these platform categories · no partnership implied Hydrolix·Splunk·Datadog·your OLAP / SIEM platform vendor? talk OEM →
[01] the problem

Post-ingest detection rereads stored data by design.

Many detection stacks analyze events only after collection, indexing and storage. That is the right path for search and investigation; it is a different path from assigning one bounded novelty score while the event is already in motion.

Repeated scans

Query-based detection re-scans and decompresses the same events for every rule and lookback window.

Always-on hot clusters

Low-latency query detection often keeps both data and compute warm. The utilization and cost trade-off should be measured on your workload.

Unknown unit economics

Platform bills rarely isolate one detector's true cost, queue delay and analyst burden. A pilot should measure all three.

[ vs ] what you'd do without us

The alternatives, honestly.

Most teams approximate ingest-time novelty detection with blunter tools. Here's what you'd otherwise reach for — and the gap each one leaves.

thresholds & dashboards

Prometheus, CloudWatch, CDN analytics. Cheap — but per-metric. A brand-new field combination that's individually normal sails straight through, and you live in threshold-maintenance.

scheduled SQL on a hot cluster

Splunk, Elastic, Datadog, Hydrolix. Flexible — but repeated scans and lookbacks are a different cost and latency path from scoring once at ingest.

vector DB + kNN

FAISS, Milvus, Pinecone. Rich embeddings and approximate-neighbour indexes can work well, with a different inference, index and operations envelope. Compare both on the same stream.

in-house streaming

Flink + RRCF / River. It works — but now you build and operate a detection platform. We're the kernel (XOR + popcount), not a platform you run.

engrammatic

Encode each event once at ingest and score combinatorial novelty with XOR + popcount. Developer scoring is $1/M events; committed volume tiers reach $0.30/M. Hosted and managed processing use the same plan-priced balance. It sits alongside your stack: your dashboards still graph and your store still queries.

//

Use the right tool. A 5xx spike → a threshold. A single numeric outlier → a z-score (it'll beat us, and we'll say so). A known attack → a WAF. Use Engrammatic for the never-seen-before combination none of those catch.

//

You could build this. The bit operations are simple; the product work is encoder design, memory policy, drift monitoring, idempotent ingestion and false-alert control. A guided pilot exists to determine whether that maintained system is worth buying for your source.

concrete: GET /static/app.js → 200, from a PoP + ASN + user-agent that has never co-occurred on that path before. Every field may be individually normal, so thresholds stay green; a source-specific Engrammatic profile can raise the combination as an anomaly candidate for policy and investigation.
open the console → run it on your own logs
[02] how it works

Encode once. Reason in bitwise motion.

Engrammatic sits beside the ingest path. A versioned, source-specific encoder turns each structured event or bounded entity window into a 10,240-bit binary hypervector. Similarity becomes XOR + popcount; the profile still has to pass a labelled holdout.

01 · encode
Event → hypervector

A source-specific, versioned profile maps one structured event or window to a 10,240-bit vector.

02 · shortlist
Two-tier retrieval

A fast sketch scan narrows millions of vectors to a small candidate set.

03 · score
Exact Hamming

XOR + popcount on the shortlist. Novelty = distance to nearest memory.

04 · act
Flag at wire speed

Flag, route, or recall context. Storage & dashboards stay where they are.

[ watch ] the method in motion
01 · encode

Fields bind to values, pairs bundle together — the whole event lands in one 10,240-bit hypervector, once, at ingest.

02 · compare

Similarity is XOR + popcount. 797 differing bits → familiar; 4,811 → novel. A few CPU instructions, no index, no query.

03 · remember

Every field individually normal, the combination never seen before. Thresholds stay green — memory flags it at ingest.

04 · the economics

Query-based detection re-reads the past. Engrammatic's encode-once path exposes one predictable per-event plan price.

//

A coprocessor, not a replacement. Your log platform stays the system of record for storage, SQL, dashboards and compliance. Engrammatic adds a bounded novelty signal at ingest; the pilot measures whether it improves your workflow.

[ run it ] inside the preview

Run it on your own logs, today.

Engrammatic has a hosted scoring API and zero-dependency Python client. pip install engrammatic, sign in for an API key and test structured events. Managed replay is a guided-preview path: availability is shown in the console, and intake fails closed when authoritative worker telemetry is disconnected. In-VPC scoring remains a design-partner deployment.

▶ hands-on quickstart · 20 sec

pip install → sign in for a key ($20 credit) → detect() against the hosted API → benchmark your own logs.

01 · pip install

Install the client, grab a key

Zero-dependency Python client from PyPI. Sign in with Google for an API key — new accounts get $20 of starting credit.

$ pip install engrammatic
from engrammatic import Client
c = Client(api_key="ek_...") # $20 starting credit
c.detect({"path": "/wp-admin.php", "status": 404})
02 · hosted sandbox

Point a stream, watch it flag

Request a sandbox key, send events to the endpoint, see anomalies and your live bill. Metered per million events — no commitment.

03 · guided managed replay

Capacity with an explicit budget and SLO

Spot-only or contracted warm capacity, in your AWS account or ours. The fleet policy, cost ceiling, queue SLO and rollback are agreed before launch.

//

Cold and warm capacity are different products. Spot minimizes compute cost, but startup time varies. Work that needs a startup guarantee uses a separately priced, contracted warm-capacity SLO.

open the console — API key + $20 credit → book a 2-week pilot
[03] use cases

Where combinatorial novelty earns a place.

BEACHHEAD

Log & SecOps anomaly detection

Pre-filter and triage structured logs at ingest. Catch novel combinations and send a smaller, explainable stream into investigation.

Fraud & behavioral fingerprinting

Candidate signals for fraud and abuse workflows. Engrammatic ranks unusual behavior; customer labels, context and policy determine whether activity is fraudulent.

Novelty & drift detection

Flag never-before-seen behavior and monitor whether score distributions, recall and alert volume drift over time.

[04] transparent economics

A price you can audit.

your current detector
measure it

Include platform compute, queue delay, query/storage overhead and analyst time. Enter your own per-million baseline below.

engrammatic
$1.00 /M developer

$0.60/M Growth · committed Scale volume from $0.30/M. One plan-priced balance covers hosted and managed processing.

One balance, clear plan pricing: hosted API calls and managed replays are billed by scored logical records at your plan rate. Managed runs retain explicit worker, lifetime, and launch safety limits without creating a second customer balance.

[ estimate ] what it costs you

Paste your volume. See the bill.

See the exact account-balance charge by plan and compare it with a per-million baseline you control. The same plan rate applies whether processing is hosted or managed.

accepts 100M, 3B, or a plain number · ~30.4 days/mo
enter your measured baseline—not ours
developer plan charge
/ mo · $1.00 per M
scale plan charge
/ mo · from $0.30 per M
your entered baseline
/ mo · compare like for like

Account-balance arithmetic only—not a quote. If your current system is cheaper or a threshold solves the problem, keep it. A guided run supplies the source-specific quality, analyst-load, throughput, and latency evidence needed for a fair decision.

open the console → benchmark your logs
[05] the clean contract

A small, honest API.

Five primitives — encode · bind · bundle · write · query — plus a one-line detect(). Run it in-process for benchmarking, or point it at the hosted service.

Drop-in Python SDK — pip install engrammatic, zero dependencies, keep-alive client
Returns a novelty score 0..1, billed per event
In-VPC scoring for design partners — your data stays put
detect.py
import engrammatic

gpru = engrammatic.Client(api_key="ek_...")  # pip install engrammatic

# Stream & reason at ingest time
result = gpru.detect({
    "service": "auth", "path": "/login",
    "status": 401, "latency_ms": 3,
})
if result["is_anomaly"]:
    alert(result["score"])  # novelty 0..1
[06] pricing

Pay per million events. Prepaid credits.

Event scoring uses one prepaid account balance across hosted and managed processing. Developer is $1/M; contracted volume lowers the rate.

developer
$1.00 /M
Self-serve, pay-as-you-go 1 namespace Community support $20 minimum top-up
get started
MOST POPULAR
growth
$0.60 /M
Priority processing 5 namespaces Guided profile calibration Email support
get started
scale
from $0.30 /M
Best rate Committed volume contract Optional warm-capacity SLO 25 namespaces
talk to us

Card self-serve today — stablecoins next

Top up by card in the console today. USDC/USDT (Base · Arbitrum · Solana · Tron · Ethereum) coming with a real processor. Teams can pay by invoice (ACH / wire).

coming soon USDC USDT Base Arbitrum Solana Tron Ethereum

Account and billing data

You sign in with Google; Stripe handles card details and checkout. Engrammatic stores the account identity, ledger and usage records needed to authenticate and meter the service.

Stablecoin payments and wallet screening are not live. A production pilot documents its data roles, retention, deletion, DPA and any customer-specific regulatory requirements before traffic moves.
[08] get started

Run a benchmark on your own logs — inside Engrammatic.

Run your own logs through Engrammatic to get cost per million, queue and worker latency, false alerts per 10,000 normal units, and held-out detection quality. A tuned threshold or batch baseline can beat us, and the report says so when it does. Our edge is per-event combinatorial novelty as events arrive. The production gate is your source-specific, time-ordered holdout—not a synthetic headline.

open the console → email us

sign in with Google — every new account starts with $20 of sandbox credit. Questions? hello@engrammatic.ai

[ news ] product & research updates

Useful updates, without the content mill.

Public notes cover announced product releases, practical HDC explainers and analysis grounded in public primary sources. Customer and internal validation stays private in the account's console and run reports.

visit news → Lily monitors primary research; every public item requires human approval and technical review.
[09] the bigger picture

The memory layer for the AI age.

Engrammatic starts with one concrete job: deterministic combinatorial-novelty scoring for structured event streams on commodity CPU. Hyperdimensional representations may support broader associative-memory products later, but today the product is the narrow, measurable coprocessor described above.

[ trust ] security & status

Honest about where we are.

Engrammatic is early — we're running design-partner pilots, not pretending to be a mature SaaS. Here's exactly what that means for your data and your security review.

Your data

For design partners, in-VPC deployment keeps raw events inside your network. Hosted synchronous scoring runs in memory; managed replay durably stages bounded input batches for retry and audit. Retention, redaction and deletion are agreed before production data moves.

Compliance

SOC 2 Type II is on the roadmap; a DPA is available on request. Identity, payment and regulatory requirements are documented for the deployment instead of implied by certifications or screening programs we do not yet operate.

Stage

Python SDK and hosted synchronous scoring are available today. Public OTLP/HTTP JSON, durable managed Spot replay and signed webhook destinations are available in guided preview. Kafka, Kinesis, S3 and vendor collectors remain roadmap work.

[10] faq

Questions, answered.

Commercial answers first. Technical concepts are last.

What does Engrammatic detect—and what should I use something else for?

Engrammatic scores combinatorial novelty: a path, ASN, device, account state or other set of fields that may each be familiar but have not appeared together for that source and profile. Use a threshold for a 5xx spike, a z-score for one numeric outlier, and a WAF or signature engine for a known attack. Engrammatic supplies a candidate signal beside those tools.

Does an anomaly mean confirmed fraud?

No. A novelty score says the event or entity window differs from the profile's bounded memory. Fraud requires customer labels, context and policy. For CDN abuse, useful fields often include account/session/token or entitlement state, asset, PoP, ASN, geo, device and request sequence—not just an HTTP status.

Is this production-ready?

Guided customer pilot: yes. General self-service production ingestion: not yet claimed. A pilot requires a source-specific, time-ordered labelled holdout, a frozen versioned profile, an alert-volume gate, canary monitoring and rollback. Your validation results and limitations stay in your authenticated console and run report.

How do I connect logs, and where do alerts go?

The guided managed path accepts structured OTLP/HTTP JSON through the public TLS endpoint with API-key authentication, durable idempotency and bounded backpressure. Alerts can go to account-scoped signed HTTPS webhooks with retry and dead-letter history. Raw lines should be parsed into stable fields first. Kafka, Kinesis, S3 and vendor collectors are not all live; a pilot defines the exact source, retry contract and destination before traffic moves.

Does one encoder work for every source? Can it adapt automatically?

No. Profiles do not transfer reliably across unrelated log sources. Bounded categorical memory and alert budgets may adapt online. Field roles, entity keys, numeric ranges, weights, temporal features and thresholds do not mutate silently: candidates train in shadow, pass a customer-specific held-out gate, canary, then become a new version.

What does the run report prove?

Every owned run has a decision-first PDF and console view. Labelled evaluations report TP, FP, TN, FN, F1, precision, recall, PR-AUC, MCC, false alerts per 10,000 normal units, calibration and drift. Load reports separate admission, queue wait, worker time, end-to-end throughput and cost. Distinct HDC encodes shows how much unique representation work occurred, so repeated synthetic templates cannot masquerade as high-cardinality real-log throughput.

How is pricing calculated?

Developer event scoring is $1/M, Growth is $0.60/M, and committed Scale volume starts at $0.30/M. Hosted and managed processing draw from one prepaid balance at that plan rate. Every managed run also has explicit worker, lifetime, and launch safety limits.

What happens during a Spot cold start?

Cold Spot minimizes compute cost, but variable startup time can dominate short jobs. If startup time matters, contract a warm-capacity SLO. Your run report separates queue delay from worker execution so the trade-off is visible without exposing another customer's measurements.

What happens to my data?

Hosted synchronous scoring handles records in memory. Managed replay durably stores bounded input batches so retries, completion and account-owned evidence remain exact; its retention is scoped in the pilot agreement. In-VPC design-partner deployment keeps raw events in your network. A DPA is available on request; SOC 2 Type II is a roadmap item, not a current certification.

What is HDC, and why does it matter here?

Hyperdimensional computing represents an event or bounded window as a high-dimensional binary vector. Field/value pairs bind and bundle into one representation; distance becomes XOR plus popcount. That makes comparison cheap and deterministic, but encoder design and operating-point calibration—not the bit operation alone—determine whether the signal is useful.