Operated open lakehouse
The data platform a team of two can run.
Most companies get two choices: pay a vendor in “credits” you can’t trace, or assemble twenty open-source projects and hire five engineers to keep them running. RunningLake is the third option — we run the stack, an agent writes the pipelines as a reviewable diff, and the bill arrives in cloud dollars per job, per team, per table.
Databricks’ capabilities. Kubernetes’ operating model. A bill you can read.
Pre-product. The control plane, the router’s constraint layer, the data-plane Terraform module and the platform bundle are built. No customers yet — the first eight are design partners, and we charge from the start.
- All-purpose compute
- 4,182 credits
- SQL warehouse
- 1,904 credits
- Jobs compute
- 2,771 credits
- Serverless
- 988 credits
- Total
- 9,845 credits
Which pipeline? Which team? Was that Tuesday’s backfill, or the dashboard nobody opens? Credits convert to money at a rate you don’t set.
- daily_revenue_by_plan duckdb · 744 runs
- $3.72 measured
- bi.adhoc trino · 218 queries
- $214.80 $151.30 measured · $63.50 shared
- exec_dashboard starrocks · always-on
- $88.10 reserved · split shown
- Management fee 25% of metered compute
- $76.66
- Storage 1.7 TB, your bucket
- $39.10 at cost
- RunningLake Team platform fee
- $1,500.00
- Total
- $1,922.38
Two of these compute figures are measured and one is an allocation. The invoice says which, and shows the division. An allocation you can see is not a credit unit. An allocation you can’t is.
Illustrative, for a 12 GB hourly pipeline plus a BI workload on the Team tier. Your numbers will differ; we measure them on your workload before you sign anything.
control plane · router CONSTRAIN · data-plane Terraform module · platform bundle
engine services · cost attribution · Pipeline Agent · Quality Agent
Spark · StarRocks · Flink · Hudi · GCP · Azure · Analyst Agent · Repair Agent
SOC 2 · HIPAA · ISO 27001 · PCI DSS
Every capability claim on this site carries one of these. If it isn’t marked RUNNING, we haven’t built it. The full build order →
The parts are free. Running them is the job.
Every capability in a data platform now exists as open source that genuinely works — Spark on Kubernetes with Karpenter, Kyuubi, Celeborn, Gluten or Comet, Lakekeeper, OPA and Ranger, OpenLineage, OpenCost. The components are not the problem. Integrating them behind one coherent surface and operating them well takes three to five strong platform engineers who know Kubernetes and Spark internals. A company with a two-person data team cannot hire that team.
platform engineers needed to run the open stack well
what they cost all-in, per year — at $160K–$290K each
average annual pipeline maintenance per company (Fivetran)
of a data engineer’s time on maintenance, not new capability
The second figure is our own arithmetic on our own source, and it is larger than the number our go-to-market document uses. We publish the larger one because it’s the one the source supports.
RunningLake is that platform team, delivered as software.
Three claims, in the order we’d like to be judged on.
One is easy to prove and we lead with it. One is the product. One is the reason a security team says yes.
A bill you can read.
Real cloud dollars per job, per team, per table. No credit unit anywhere in the product. Where a figure is an allocation rather than a measurement — an always-on cluster’s share, a warm pool’s floor — it is labelled as one, and the split is shown.
Stop needing a platform team.
Karpenter, Celeborn, Kyuubi, Kueue, Lakekeeper, Gluten — pinned, patched and upgraded on a schedule. Not by you.
Your data, your bucket, open formats.
Iceberg in your own S3. Every component we run is permissively licensed, foundation-governed, with no vendor licence. A customer who cancels keeps working tables — retention has to be earned elsewhere.
One qualification, stated here rather than at the bottom of a page: your bucket starts at Business. The Free tier runs on ours; Team can run on either. Customer-managed keys also start at Business. At-rest encryption is free at every tier including Free, because charging for baseline encryption would be indefensible.
The router
You don’t pick the engine. Correctness picks it, then price picks between what’s left.
Step 4 runs before step 5, always. A wrong answer delivered cheaply is worth less than nothing.
The job · examples/analytics/pipelines/daily-revenue
gold.finance.daily_revenue_by_plan
hourly · 12 GB scanned · operation MERGE · declared consumer: Trino BI, 1h freshness
Step 1 · which format
Step 2 · constrain, then cost
Notice what did not happen. DuckDB costs 1× and Trino costs 6–20×. DuckDB was eliminated before anything was priced, because it cannot perform a MERGE on an Iceberg table. In the source specification there was no Iceberg-DML rule at all — so DuckDB stayed eligible and won on cost, for a statement it cannot execute. It bit hardest on the two things the docs give as reasons to choose Iceberg: GDPR erasure and partition evolution.
The rules are versioned, signed data released independently of any binary, and every capability cell carries an evidence reference naming the conformance run that proved it. Cells asserted from a vendor’s documentation rather than a test are marked unverified.
Actual runtime and cost are written back after every run, and the cost model is refit per tenant — so a job that ran on Trino last month may route elsewhere this month because the estimator learned it over-predicted.
What one hour costs.
One pipeline, one run, start to finish. Illustrative for a 12 GB hourly job — your numbers will differ, and we measure them on your workload before you sign anything.
This run
duration
per run
runs a month
a month, in cloud dollars
744 runs at half a cent. We show the run count so you can check the multiplication — on a page arguing for legible arithmetic, a total you have to take on trust would be self-defeating.
And when Stripe renames a field at nine in the morning.
REPAIR AGENT · PLANNEDThis one is designed, not built. The Repair Agent is item 17 of 20 in the build order and sits below the line marked “a coherent, sellable product.” We’re showing you the design, not a demo.
Agents
It’s a git diff, not magic.
Describe the pipeline in plain language. You get back a pull request: the SQL, the DAG, the quality tests, the docs, a format recommendation with its reasoning, and a cost estimate in cloud dollars. You approve it the way you approve anything else. Data engineers are professionally sceptical of AI writing production code, and they’re right to be.
Repair autonomy is L0–L3, you configure it, and L1 is the default — diagnose and propose, open a PR, wait for a human. L3, auto-apply to production, is available only for action classes with a demonstrated 99% success rate in your tenant, and is always reversible. Every autonomous action writes to an immutable audit log. There is no configuration option to disable that.
# Owned by finance. Ask #data-platform before changing the schedule.
kind: Pipeline
metadata:
name: daily-revenue
labels: { team: finance } # used for cost attribution
spec:
schedule: "0 * * * *" # hourly
routing:
format: ICEBERG # append-heavy, multiple consumers
engine: "" # unpinned — let the router learn
consumers:
- engine: TRINO
freshnessSla: 1hAgent rationale, carried in the diff: “12 GB scanned, single consumer, append-only. ICEBERG chosen over DUCKLAKE because bi-trino is a declared consumer — a second engine triggers promotion.”
Every mutating endpoint returns a change set with a git ref, not “created”. The console shows a diff before every change because there is nothing else it can show — the agent’s proposal and a human’s hand-edit are the same mechanism.
Operations
Pinned, patched, upgraded on a schedule. Not by you.
One opinionated version set, unforked, across every plane. The platform bundle is a digest-pinned OCI artifact, byte-identical on every cluster; per-plane variation lives in one config object and nowhere else. A private fork of Spark, Flink or Trino is a permanent tax on a small team — so we don’t keep one. Contributions go upstream.
customer data planes per platform engineer, by year three.
This metric is the business. If one engineer can’t support forty-plus, RunningLake is a consultancy with a product attached rather than a software company.
Today it is one. We publish the target and the current value together, because a north-star metric quoted without its present value is marketing rather than measurement.
Trust boundary
RunningLake cannot reach into your network.
Your cluster makes one outbound TLS connection to one hostname on 443, which you can allowlist at your egress proxy. The control plane never dials in — hosted and BYOC run the identical mechanism, so the BYOC path can’t rot from disuse. Work flows down the stream; metering, lineage and run history flow up.
And the schema is the enforcement mechanism, not a convention. No message in the agent protocol can carry customer data: LogRef, not Log. ResultHandle, not ResultSet. Opaque ids, never names. Query results stream from the data plane directly to your browser; the control plane sees only rows, bytes, duration and cost.
Control plane · runs at RunningLake
identity · catalog · router · policy · cost meter · agents
Data plane · runs in your cloud account
engines · your bucket · your KMS keys · Kubernetes
Where this is not absolute: the per-tenant context store lives in the control plane and holds schemas, column-level lineage, run history and sampled statistics — derived customer data. The rule keeping raw values out of a model’s context is scoped to columns classified as sensitive, which means values from unclassified columns can reach a model API. Bringing your own model endpoint is Enterprise-only today.
Cost attribution
An allocation you can see is not a credit unit. An allocation you can’t is.
OpenCost feeds per-namespace cloud spend, and we attribute it to job, pipeline, table and team. For a dedicated engine — one pod, one query — the figure is measured. For a shared cluster it’s an allocation, because there is no honest way to make it anything else. So every figure carries how it was derived, and the formula sits next to it.
Reconciled nightly against your cloud provider’s own bill, rounding in your favour. Hard monthly spend caps enforced at dispatch — a job is held and its owner notified, never silently overrun.
- measuredone pod, one query — from the provider’s own split cost allocation data
- shared_amortisedyour share of a cluster several jobs used, with the split shown
- idlewarm-pool floor, attributed rather than hidden
- reservedan always-on component, allocated across what used it
The cheapest tier is also the one whose bill is exactly right: Free-tier DuckDB runs one pod per query in a single-use sandbox, so its cost is genuinely measured rather than allocated.
The console’s cost page currently renders nothing rather than an estimate nobody could check. That is deliberate, and it will keep rendering nothing until the meter is wired to real provider data.
Three ways to have a data platform. You’re already on one of them.
We’re not going to run a feature-by-feature comparison against a company with a decade’s head start and several thousand engineers. This compares operating models, which is the thing that actually decides whether a two-person team can run a platform.
| Dimension | Buy the package | Assemble it yourself | RunningLake |
|---|---|---|---|
| The bill | Credits, converted at a rate you don’t set | Your cloud bill, plus three to five salaries | Cloud dollars per job, per team, per table, plus one platform fee stated separately |
| Where the data lives | The vendor’s format, the vendor’s catalog | Your bucket | Your bucket from Business up, in Iceberg. Free runs on ours; Team can run on either. |
| Who operates it | Their software; you still size and tune the machines | You, once you’ve hired the team | We do. That’s the product, not a support tier. |
| Which engine runs a job | You pick a cluster or a warehouse size | You configure every engine by hand | Chosen per job. Correctness rules first, then price. |
| When a pipeline breaks | A person reads logs | A person reads logs | Quarantined, blast radius traced through lineage, a fix proposed as a diff. Planned, not built. |
| Leaving | A migration project | Nothing to leave | Your tables are Iceberg in your bucket and stay readable by anything. What doesn’t transfer is the run history the router learned from — so we won’t tell you leaving is free. |
| Built for | The Global 2000 | Teams that can hire specialists | Companies of 200–2,000 with a data team of two to eight |
None of these are features anyone can bolt on next quarter. Each is a consequence of how a company is built and what it charges for. The first column’s constraints are unfixable without repricing the business — a strong claim, not an eternal one. If a large vendor re-architects its cost structure for the mid-market, that row changes. We’d rather say so than pretend otherwise.
What we won’t claim.
Serverless economics
Large vendors share giant pools of machines across thousands of customers. We can’t match that at our size and we don’t pretend to. Shared driver pools help; they do not match.
Heavy Python workloads
The open-source Spark accelerators get roughly 2–3× on scan-heavy SQL and nothing on Python UDFs. That figure is the community’s, not ours — we haven’t run the bake-off yet. When we do, we’ll publish it with its limits.
Depth of governance tooling
A decade-old catalog’s lineage, ABAC and audit are years ahead of a catalog plus OPA plus OpenLineage assembled. Ours will be good. It is not as deep.
Anything a certificate would prove
We hold no SOC 2, no HIPAA BAA, no ISO 27001, no PCI DSS. Not “in progress” — none. There will be no trust badge on this site before there is an auditor’s report behind it.
If one of the first three is your biggest problem, buy the incumbent. You should hear that from us before you hear it from anyone else.
The parts list is public. That’s the point.
Every component we run is permissively licensed, foundation-governed, with no vendor licence. Anyone can read this list. Almost nobody can run it — which is why we do.
We say “permissively licensed, foundation-governed” rather than “Apache or CNCF” because the shorter version isn’t true: DuckDB is MIT under its own foundation, Trino is governed by the Trino Software Foundation, StarRocks by the Linux Foundation. The licence and the governing body are in the table so you don’t have to take our word for the summary.
We keep no private fork of any of these. Contributions go upstream. A fork is a permanent tax on a small team.
Who this is for, and what we’d say to you.
Your team is underwater and you can’t hire platform engineers.
“You get the platform team as software. Your engineers go back to building.”
- Three to five specialists is what the open stack takes to run well.
- The router picks engine and format, so nobody on your team has to hold that in their head.
- Pipelines arrive as pull requests your engineers review, not as a black box.
The bills are growing faster than the value.
“Your bill is cloud dollars per job, per team, per table. No credit unit. We’ll model your current spend before you sign anything.”
- Reconciled nightly against your cloud provider’s own bill, rounding in your favour.
- Hard monthly caps enforced at dispatch — jobs are held and owners notified, never silently overrun.
- The 25% management fee on Team-tier compute is a line on the invoice, not a margin inside a unit.
You tried assembling the stack and it became a second job.
“Karpenter, Celeborn, Kyuubi, Kueue, Lakekeeper, Gluten — pinned, patched, upgraded on a schedule. Not by you.”
- One digest-pinned bundle, byte-identical on every plane.
- Kubernetes is the only substrate. No YARN, no standalone, no HDFS.
- Your cluster dials out. We never dial in.
The data platform is an audit finding waiting to happen.
“Your bucket, your keys, column-level encryption, policy compiled to every engine.”
- One outbound TLS connection to one hostname on 443. Allowlist it at your egress proxy.
- Envelope encryption: your KMS root key, which you control and can revoke.
- Hash-chained, append-only audit, exportable to your SIEM.
What we can’t hand you today is a completed SIG or a SOC 2 report. We hold neither. What we can hand you is the architecture, the trust-boundary decision record, and the list of what isn’t built.
Tool sprawl, 2am pages, and format decisions you’ll regret.
“Describe the pipeline. The agent picks the format and engine, and tells you why. It’s a git diff, not magic.”
- Choosing Hudi removes three of five engines from the write path. The platform refuses the selection at creation time rather than letting you find out in production.
- Constructs that don’t transpile cleanly across your table’s engines are rejected at authoring time, with a message. Never silently rewritten.
- You can pin the engine and the format. Format, engine and instance type are all overridable.
And who it isn’t for. Under 50 people. Over 5,000. Primarily ML training. On-premises only. No existing cloud spend to compare against. No appetite for Kubernetes. We’d rather say so on the home page than on the third call.
Four tiers, and what each one actually gets you today.
The tier table we published promises more than the architecture will deliver right now. This is the corrected one.
Free
$0
included, capped
- 100 GB on our bucket
- 1 project · 3 users
- DuckDB only
- Iceberg + DuckLake
- AWS
- Pipeline Agent, 50 generations/mo
- At-rest encryption
Team
$1,500
per month, plus cloud cost + 25%
- 2 TB, or your bucket
- 5 projects · 20 users
- Up to 64 vCPU
- AWS, GCP
- Pipeline + Quality Agents
- Management fee on the invoice
Business
$5,000
per month, BYOC — you pay cloud direct
- Your bucket
- 25 projects · 75 users
- Up to 512 vCPU
- All three clouds
- Customer-managed keys
- Column-level encryption
- All four agents · Hudi
Enterprise
from $12,000
per month, BYOC multi-cloud
- Unlimited
- Bring your own model endpoint
- CMK / HSM
- Confidential compute
- Differential privacy
- 99.9% SLA
The correction, stated inline. Our published table said the Free tier included DuckDB and Trino. It’s DuckDB only — several free tenants’ rows would pass through one Trino JVM’s memory, and no amount of policy makes that a story we’d want to tell. Free-tier DuckDB runs one pod per query in a sandbox: no shared process, no shared heap.
What none of them get today: Spark, Flink, StarRocks, Hudi, GCP, Azure, the Analyst Agent and the Repair Agent are not built. Hudi is gated to Business not to upsell but because its table services carry real operational cost — and it won’t be offered to anyone until those services are automated and two design partners have run them in production.
Forty conversations, then a product.
We’re looking for eight to twelve design partners, and two or three should be CDC-heavy — those are the ones who’ll tell us whether a whole phase of this plan should exist at all. Twelve months at 70% off, direct Slack access to engineering, roadmap influence, and a written case study when there’s something to write about. We charge from the start: even $500 a month changes the quality of the conversation entirely.
No card. No demo-booking flow. A reply from a founder, usually the same day.