About
We started because a trace kept stopping at the answer.
Four people, two cities that matter and two that we visit. We are building the record of what an agent nearly did, because everybody already has a record of what it said.
- Founded
- September 2025
- People
- 4
- Design partners
- 11
- Funding
- Pre-seed, undisclosed
The origin, honestly
In March 2025 Mira was asked to review an incident at a client. A support agent had refunded a customer twice, then emailed an internal ledger to an address that turned out to belong to nobody in particular. The postmortem took nine days.
Nine days, for an incident with three moving parts. The reason was not that the systems were complicated. It was that the team had a complete transcript of what the model had said and almost nothing about what it had read, planned, or reached for. The answer was logged beautifully. Everything before the answer was gone.
We spent that summer talking to twenty-six teams running agents in production and asked all of them the same question. Twenty-two had the same gap. Most of them had built some version of a private tracing hack, and every one of those hacks stopped at the same place, because that is where the vendor SDK stopped.
SentryLLM is the missing half. The prompt is easy to log. The action is easy to log. The handoffbetween them is where the incidents live, and it was nobody's job.
Incident note, redacted
Agent issued a refund of £4,218.00 against account NW-88213 following a knowledge base lookup. Ledger forwarded to audit@partner-review.co. Source article last edited four months prior. No code change in the intervening period.
Hover the bars. This is roughly what the original postmortem looked like when it reached us, and the redactions are the parts that took nine days to reconstruct.
Four things we argue from
Opinions we have had to defend more than once.
The trace is the product
Dashboards summarise. Traces explain. If a finding cannot be traced back to the exact span that produced it, with the surrounding context intact, we have not shipped a feature, we have shipped an opinion.
Guardrails you can appeal
Every block can be released by a human, and the release is recorded. A control with no appeal path gets routed around within a fortnight, and then you have neither the control nor the visibility.
Small enough to hold in your head
Seven span kinds, fifteen detections, six primitives. Every time we have added something we could not justify in one sentence, we have taken it back out within two releases.
Say the uncomfortable number
Our noisiest rule is OB-040. Our SOC 2 report is not out yet. The free tier has no availability guarantee. Putting those on the website costs us a small number of deals and saves us every difficult conversation in month three.
Who is building it
All four of us.
There is no separate marketing team, which is why the copy on this site sounds like engineers wrote it. They did.
Mira Halvorsen
Co-founder, detection
Spent six years on a red team at a Nordic bank, then four writing the detection content for an EDR vendor. Believes most security tooling fails because it is written by people who never had to carry the pager for it.
Tobias Rennick
Co-founder, platform
Built distributed tracing infrastructure for a logistics company with eleven thousand services and a truly memorable outage in 2022. Joined because he wanted to work on a schema small enough to argue about properly.
Priya Ramanathan
Engineer, policy
Came from compliance automation and has read more control frameworks than anyone should. Responsible for the fact that overrides are recorded rather than silent.
Onur Bekdemir
Engineer, collector
Wrote the ingest path twice. The second one is fine. Cares more about p99 than anybody needs to and the 7ms number is entirely his fault.
The other list
Four things we have decided not to build.
This list has been more useful to us than the roadmap. Every one of them was requested by a real prospect and turning them down is how the product stayed small.
A model firewall
Filtering the text going into a model is a thin slice of the problem and it gives teams a false sense of coverage. The interesting failures happen between the retrieval and the tool call, where a text filter cannot see.
A general observability platform
Several good ones exist. If you want to query arbitrary telemetry, use one of those and send us the seven span kinds we care about.
An evaluation harness
Offline evals tell you how a model behaves on your test set. We are interested in what happened in production last Tuesday at 14:06, which is a different question with a different shape.
Our own foundation model
No.
Come and break it, or just read the notes.
We onboard six teams a month and we would rather talk to somebody with an awkward architecture than somebody with a clean one.