Build high-performance cybersecurity applications
Spice is a portable SQL query, search, and AI runtime that you can run in your own environment or on Spice Cloud. Query logs, telemetry, and threat data across object storage, warehouses, and databases in one SQL statement. Accelerate hot data for millisecond reads in detection and response apps.
Do more with your data
100x
up to 100x faster queries
80%
up to 80% cost savings on data lakehouse spend
2x
increase in data reliability for critical workloads
Security apps demand more from their data layer
Security platforms read constant streams of telemetry, logs, and threat data. Copying that data through ETL pipelines into one more database adds latency, cost, and operations work. Queries also slow down under heavy load or fail when a source is unreachable. Security teams need one data runtime that serves fresh data to detection, response, and AI features.
A query engine built for secure, high-scale workloads
Unify, accelerate, and govern your data for reliable, low-latency operations.
Low-latency data acceleration
Spice copies frequently accessed data into a local accelerator, such as Spice Cayenne, DuckDB, or SQLite, for millisecond reads and predictable query latency.
Resilient and distributed
Run Spice next to your app at the edge, in the cloud, or on premises. From Spice v2.4, a read-only acceleration persisted to disk can serve queries after a restart while its source is unavailable. CDC datasets and datasets with search columns still wait for the source.
Unified data access
Join logs in object storage with Elasticsearch indexes and warehouse tables in one SQL query. Stream Kafka topics into accelerated tables, with no new ingestion pipeline.
AI-ready and auditable
Call hosted or local LLMs and run vector and full-text search in the same runtime for detection, triage, and reporting. Task history records each query, model call, and tool call.
The data and AI runtime for modern security applications
Spice combines federated access, acceleration, search, and AI in one runtime for security applications. Deploy it in your own cloud or data center, or use the managed Spice Cloud.
Enterprise-Grade Performance
Query and serve results in milliseconds for real-time detection and response.
Resilience at Scale
Eligible persisted accelerations keep serving queries while a source is down.
Modern SQL Federation
Federate data from object stores, warehouses, and databases with zero ETL.
Governed and Secure
API keys, mutual TLS, and task history logs for queries and model calls.
AI-Enabled Insights
Hybrid vector and full-text search plus LLM inference for alert and incident context.
Deployment Flexibility
Deploy Spice as a sidecar, cluster, or managed service, wherever your app runs.
Deployed in production
Run data-intensive workloads on a high-performance engine trusted by teams building real-time systems at scale.
100x
Faster queries
“It just spins up and works, which is really nice. The responsiveness is amazing, which is a huge gain for the customer.”
Darin Douglass
Principal Software Engineer, Barracuda
Learn how Barracuda gained 100x faster query responses and reduced costs 50% with Spice
“Spice opened the door to take these critical control-plane datasets and move them next to our services in the runtime path.”
Peter Janovsky
Software Architect, Twilio
“Partnering with Spice AI has transformed how NRC Health delivers AI-driven insights. By unifying siloed data across systems, we accelerated AI feature development, reducing time-to-market from months to weeks - and sometimes days. With predictable costs and faster innovation, Spice isn't just solving some of our data and AI challenges - it's helping us redefine personalized healthcare.”
Tim Ottersburg
VP of Technology, NRC Health
Trusted by global enterprises
Build more scalable security apps
Guides and examples for building low-latency, auditable security apps with Spice.
Intelligent Security Copilot Cookbook
Follow this step-by-step recipe to stream query logs into Spice, apply AI-driven pattern analysis, and surface alerts for suspicious database activity.
Data Retention Policy Cookbook
This recipe shows how to set up a retention policy for an accelerated dataset to evict data older than a specified duration.
Documentation
Explore the docs for examples, additional cookbooks, starting templates, and more.
FAQs
Common questions about Spice for security operations, detection, and threat intelligence teams
A data platform for cybersecurity applications gives detection, response, and AI tools fast SQL access to logs, telemetry, and threat data. Spice does this with one runtime for SQL federation and acceleration, search, and model serving. It queries Amazon S3, Elasticsearch, PostgreSQL, and other supported sources in place, with no new ETL pipeline. It also streams Kafka topics into accelerated tables.
Yes, Spice queries Parquet, CSV, and JSON log files in Amazon S3 and joins them with warehouse and database tables. With data lake acceleration, Spice copies hot log data into a local accelerator for millisecond reads. In full and append refresh modes, a retention policy evicts rows older than retention_period, measured on the time_column. It runs only when retention_check_enabled is true and retention_check_interval is set.
Yes, for eligible persisted accelerations in Spice v2.4 and later. Spice loads the existing acceleration at startup and serves its rows while the source is unavailable. An eligible dataset is read-only, persists across restarts with mode: file or the PostgreSQL engine, and uses full refresh or append with a time_column. The data refresh docs list the other conditions, such as no search columns and a checkpoint written by v2.4 or later.
Yes, Spice serves hosted and local LLMs through one OpenAI-compatible API, and models can query datasets with SQL tools. Hybrid search combines vector and BM25 full-text results to find related alerts, incidents, and threat reports. Task history records each query, model call, and tool call for review. The security copilot recipe shows AI analysis of database query logs.
The open-source runtime requires no auth until you configure API keys or mutual TLS (mTLS) in spicepod.yaml. API keys without a :rw suffix and datasets without access: read_write are read-only. Spice Enterprise adds OIDC sign-in (in preview) and Cedar policies with row filters, column masks, and roles. Spice AI, the company behind Spice Cloud, is SOC 2 Type II compliant.
See Spice in action
Walk through your use case with an engineer and see how Spice handles federation, acceleration, and AI integration for production workloads.
Talk to an engineer (opens in a new tab)