Search, logs and text analytics that stay in the country

The directive covers audit logs explicitly, and application logs frequently contain customer identifiers and transaction data that fall under primary processing. In our experience it is one of the most common findings in localisation assessments. Whether a given stream is in scope depends on its content, so we start with a classification of every log source. This is not legal advice; your compliance function should confirm the interpretation.

OpenSearch is licensed under Apache 2.0, which lets you run and modify it on your own infrastructure without vendor terms tied to a cloud service. It carries the security, alerting and index-management features that banks need, and the migration from Elasticsearch 7.x is well understood. Elasticsearch's licence changed in 2021 and its AGPL option in 2024 still needs careful reading for on-prem use.

Solr excels at structured search over business records where relevance is tuned in detail: customer lookup, product catalogues, document repositories. OpenSearch is the better fit for high-volume time-series data such as logs and security events, and for vector search. Many of our customers run both; we support both under the same contract.

A well-designed OpenSearch cluster scales horizontally to tens of terabytes per day of ingest. The practical limits are disk throughput on the hot tier and JVM heap per node, both of which we size from measured traffic rather than estimates. Hot, warm and cold tiers keep the cost of long retention under control.

Yes. OpenSearch, Solr and the collectors have no runtime dependency on external services. We deliver images and packages through an internal registry, and updates follow the same controlled import process we use for air-gapped Kubernetes.

NuxFamily engineers provide the support directly, from first response to root cause, on the release lines listed in the version policy. Coverage includes security patches, corrective fixes, upgrade execution and, on the Mission Critical tier, a named engineer and assistance during CBN inspections. The exact SLA terms are set out in the support agreement.

Masking happens in the pipeline before indexing: Data Prepper rules redact or hash card numbers, BVNs and other identifiers according to your data classification. Field-level and document-level security in OpenSearch then controls who can see what remains. Both layers are part of our standard deployment.

A typical estate with a few hundred log sources moves in three to four months from assessment to decommissioning, most of it in dual-run. Search migrations on Solr depend on the number of collections and the relevance work required; a single application usually takes six to eight weeks.