Siren
Siren is a search-based investigation platform published by Sindice Ltd. in Ireland. It connects open-source, vendor and classified data into one knowledge graph so national security, policing, fraud and cyber threat teams can pivot across sources.
What is Siren?
Siren presents itself as an all-in-one investigation platform and, on its home page, as a sovereign AI investigations platform. The site title states the promise plainly: a search-based investigative intelligence platform. It is published by Sindice Ltd., an Irish company based at 15 Market Street, Galway.
The starting problem is scattered evidence. Investigators hold internal records, subscribe to vendor feeds, gather open-source material and, in government settings, work with classified holdings, each in its own silo. Siren connects those sets and lets an analyst move between them by searching rather than by writing joins. The publisher calls the engine underneath a unique and patented search and retrieval system built specifically for knowledge graphs, and says results remain traceable, explainable and auditable.
Two named components carry the product. Siren Investigate™ is the front-end application where analysts search, pivot, browse the link graph, map entities, read timelines and build dashboards. Siren Federate™ is an Elasticsearch plugin that brings relational join capability to Elasticsearch clusters, which is what makes set-to-set navigation workable at volume. Optional modules add entity resolution, natural language processing and a documented Siren AI module, and a K9 AI Companion for investigators was announced in a release dated 2 December 2025. Siren 14 brought AI-driven search over a semantic data model, a reworked navigation and what the site calls officer safety on mobile.
Four use domains are displayed: national security, public safety, fraud and compliance, and cyber threat. The platform is downloaded and deployed by the customer on Windows, Linux, Mac or Docker, which is the concrete meaning of the sovereign positioning: investigation data stays on the customer's own infrastructure. Three editions are offered, named Community, IT and Business.
The origin is academic. The technology grew out of semantic web data science research, where Renaud Delbru led a team of more than thirty researchers at the National University of Ireland, Galway, in collaboration with MIT; the About page states that Siren became a product company in 2016.
What it does
- Connect disconnected sources in one place: internal records, vendor feeds, open-source material and classified holdings
- Run full-text search that tolerates typos, matches phonetically, ranks by relevance and highlights hits
- Pivot from set to set across large connected datasets instead of querying one index at a time
- Explore relationships in a graph browser with shortest path, edge grouping, graph metrics and node expansion
- Analyse geographically and over time using multi-layer interactive maps and a timebar
- Set proactive alerts and hunt for suspicious graph patterns
- Build dashboards, visualisations and reports from the same investigation
When to use Siren / When not to
A quick filter to help you decide if Siren is the right fit.
When to use Siren
- Intelligence analysts and police investigators who have to work across many disconnected sources at once
- Fraud, compliance and insider-threat teams that have been merged into a single investigative unit
- Cyber threat teams the site describes as buried under billions of rows of data
- Organisations that already run Elasticsearch, since Siren Federate™ ships as an Elasticsearch plugin
- Public-sector buyers who need a sovereign, customer-hosted deployment rather than a hosted service
When not to use Siren
- Teams looking for a self-service sign-up: Siren states it has an obligation to vet anyone who wishes to trial the platform
- Non-technical buyers, since the publisher asks for experienced analysts or IT professionals with considerable knowledge about data architecture and IT infrastructure deployment
- Buyers who need a published price or an online purchase: every paid edition routes to a pricing request
- Small teams hoping the Community Edition will be enough, as it is capped at one production node, one concurrent user, ten dashboards and five JDBC tables
- Anyone expecting a mobile app to install, as no App Store or Google Play link is published on the site
How to use Siren
A typical end-to-end flow, from setup to results.
- Open the Siren Classic Demo hosted online to see set-to-set navigation between companies, investments, investors and articles without installing anything
- Or use the REQUEST A DEMO form, the call-to-action repeated across every page of the site
- Apply for the free trial through the trial form, and expect Siren to vet the request before granting access
- Alternatively download from the downloads page, where each package offers Request Trial or Download Only for those already licensed
- Pick the right package: the full-stack Siren Platform, Sample Data with a preconfigured Elasticsearch demo, Siren Federate™ as an Elasticsearch plugin, Siren Investigate™ alone to sit on your own cluster, or the Secure Platform with an example security configuration
- Install on Windows, Linux, Mac or Docker, following the README shipped in the package; on Windows use an improved extractor such as 7zip or WinRAR
- Work through the getting-started tutorial built on the Community Edition, with the Analyst Guide and Implementer Guide supplied as PDFs
- Connect your data sources and JDBC-backed tables, then model the relationships that set-to-set navigation and link analysis will follow
- Consult the versioned documentation for the platform user guide, the Siren Federate™ guides and the Siren AI guides
- Get help through the Atlassian service desk portal or the public community forum
Pros & Cons
Pros
- A free Community Edition that can be downloaded and worked through with a complete step-by-step tutorial
- REST APIs genuinely documented in public and readable without authentication: Dashboard, Health, Object Definitions, Query Generator, Reconciliation and Refresh Fields
- Complete versioned product documentation, alongside a public community forum and a public GitHub organisation
- Customer-side deployment on Windows, Linux, Mac and Docker, which gives the claimed sovereign positioning real substance
- A large ecosystem of third-party sources named one by one, from Elasticsearch and ESRI to Chainalysis, LexisNexis, Dow Jones, DarkOwl and Webz.io
- A strategic investment from Elastic (NYSE: ESTC) announced on 2 December 2025, extending a partnership described as more than ten years old
- Fine-grained security: access control at index, record or field level, with auditing of user activity
Cons
- No public pricing at all: the three editions route to a pricing request and no monetary amount appears anywhere on the site, scripts included
- The free trial is not self-service, since the publisher vets every applicant before granting access
- High technical prerequisites announced by the publisher itself for anyone taking the trial
- No GDPR mention anywhere on the site, no published data processing agreement and no sub-processor list
- The Community Edition is heavily capped: one production node, one concurrent user, Basic security without LDAP, link analysis limited to 500 nodes, ten dashboards and five JDBC tables
- Loose housekeeping around the legal and documentation pages: the licence agreement is linked from no menu or footer and carries a template-bracketed Posted Date, the Contact page points at a 13.5 documentation version that returns a 404, the published JSON-LD advertises a LinkedIn URL that does not exist, and the site announces WordPress 5.5.1
- No security certification is named, no interface language is declared, and no promotional, student or reduced-rate offer is published
Pricing & Plans
A free plan exists: the Siren Community Edition is granted under a licence the agreement describes as fully paid up and royalty free, in consideration of accepting its terms, and can be downloaded without payment. No price point is published for the paid editions. The IT and Business editions both display a Request Pricing call-to-action, and no monetary amount or currency code appears anywhere on the site, scripts included. The publisher discloses only its billing units: production nodes are priced per node, and Business Edition users are priced per user, whether concurrent or named, a production node being defined as one used, directly or as a hot failover or replica, to serve end users. A free trial of the paid editions is offered for what the site calls a limited period of time, without stating any duration.
- one production node included
- no additional nodes available
- one concurrent user
- Basic security without LDAP
- link analysis capped at 500 nodes
- a maximum of 10 dashboards and 5 JDBC tables
- support through the web forum and GitHub
- best effort SLA and no 24x7 option. No price is published.
- three production nodes included
- additional nodes priced per node
- unlimited concurrent or named users
- Enterprise security
- a link analysis allowance stated as 10 per licensed node
- unlimited dashboards and JDBC tables
- support through the customer portal
- forum and GitHub
- one production node included
- additional nodes priced per node
- users priced individually whether concurrent or named
- Enterprise security
- support through the customer portal
- forum and GitHub
- tiered SLA and optional 24x7. Pricing on request.
Data, GDPR & hosting
A consolidated view of how Siren handles your data.
GDPR overview
The site never uses the term GDPR: across the twenty-one pages archived for this review there is no occurrence of GDPR or General Data Protection, and no data protection officer or Article 27 representative is named, so the publisher neither claims nor denies compliance. What the privacy policy does offer, without citing any regulation, is a set of rights exercisable at privacy@siren.io: access, correction, modification, deletion, and restriction of use or disclosure. Siren announces a 45-day response window, may verify identity first, and replies only to the email address used for the request. Sindice Ltd. is established in Ireland and the licence is governed by Irish law. Transfers to Ireland, Italy, France, Finland, Germany, Switzerland, the United Kingdom and the United States are presented as resting on the user's consent, with no mention of standard contractual clauses.
Who owns the data?
The licence agreement is explicit that the software is licensed, not sold: Siren remains the owner of the Siren Software and Documents at all times, and the customer gets a limited, non-exclusive, non-transferable, royalty free right to use it for internal business operations. The agreement carries no clause about customer data, which fits a product installed on the customer's own infrastructure: investigation data never reaches the publisher. The privacy policy covers only personal information collected through Siren's own sites, apps and emails, and excludes information handled on behalf of subscribers, governed instead by the applicable services agreement. Sindice Ltd. is named as the party responsible for jointly-used personal information.
Reuse rights
Because the platform runs on the customer's own machines, the licence sets no condition on the investigation data itself; the restriction bears on the software, whose use is confined to the licensee's internal business operations and cannot be transferred. On the publisher's side, the privacy policy governs only data gathered through Siren's sites, apps and emails, and lists broad purposes: answering requests, sending product information, customer service, email and SMS marketing, personalisation, contests, data analysis, audits, fraud monitoring and prevention, product development, usage trends and campaign effectiveness. That data may be shared with subsidiaries and affiliates, third-party business partners, service providers and agents, and event co-sponsors. Google Analytics is used, with a shortened IP address passed to Google, and Siren states that it does not recognise automated browser signals such as 'do not track' instructions. Nothing on the site addresses the training of AI models on customer data, in either direction.
Data retention & training
Hosting summary
Two different things must not be confused here. The Siren platform itself is deployed by the customer, with packages for Windows, Linux, Mac and Docker, so the investigation data sits wherever the customer puts it and the publisher does not host it. Nothing on the site mentions AWS, Azure or Google Cloud, and no sub-processor list is published. The countries recorded in this listing concern something else entirely: the personal information Siren collects through its own websites and emails. The privacy policy states that such information may be stored and processed in any country where Siren has facilities or engages service providers, and names Ireland, Italy, France, Finland, Germany, Switzerland, the United Kingdom and the United States. Those transfers are presented as resting on the user's consent. The policy explicitly excludes information handled on behalf of subscribers, which falls under the applicable services agreement instead. For the record, the site itself resolves to a server hosted in Helsinki, Finland, on a non-anycast address.
Things to keep in mind
Risks and trade-offs to weigh before adopting Siren.
- The trial is not open access: Siren states it has an obligation to vet anyone who wishes to trial the platform, so expect your organisation and your intended use to be examined before you get in
- The licence agreement is the only contractual document on the site and it is reachable from no menu or footer; read it before deploying, all the more so as it carries a template-bracketed posted date that is itself ambiguous
- Termination is one-sided in practice: Siren may end the agreement at any time on 14 days' prior written notice, or immediately if you commit a material or persistent breach
- Warranty exclusions and the limitation of liability are set out in capitals, the agreement is governed by Irish law with exclusive jurisdiction of the Irish courts, the software may embed third-party open-source components under their own licences, and you carry an obligation to comply with technology control and export laws
- Retention is not quantified: the privacy policy commits only to the period necessary to fulfil the purposes, and Siren states that it does not recognise automated 'do not track' browser signals
- Nothing on the site addresses GDPR, a data processing agreement, sub-processors or a security certification, and no country or region restriction is named either; treat all of these as points to settle in writing with the vendor rather than to assume
- A tool that fuses open-source, vendor and classified data makes it easy to over-trust the picture on screen: a shortest path or a cluster is a hypothesis, not proof, and the burden of corroborating it, of keeping the search proportionate and of weighing the consequences for the people it profiles stays with the analyst
Setup & Integrations
Technical difficulty
High. The publisher itself asks for experienced analysts or IT professionals with considerable knowledge about data architecture and IT infrastructure deployment. Installation is the customer's job, from Windows, Linux, Mac or Docker packages with an installation README, and Windows extraction requires an improved extractor such as 7zip or WinRAR. Siren Investigate™ can be layered onto an existing Elasticsearch cluster and Siren Federate™ is an Elasticsearch plugin, so cluster skills matter. Shortcuts exist: a step-by-step tutorial with Analyst and Implementer guides, a preconfigured Sample Data package, and an online demo needing no installation.
Deployment
Integrations
Behind Siren
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Is Siren free to use?
Can I try Siren before committing?
Does Siren have an API?
Where does the platform actually run?
Do I need Elasticsearch to use Siren?
How much does Siren cost?
Which third-party data sources are integrated?
Is there a demo I can look at without installing anything?
Is there a minimum age?
Who publishes Siren?
Should you pick Siren?
Siren occupies a narrow, clearly stated position: investigation at scale for national security, public safety, fraud and compliance, and cyber threat teams. What it offers is not another dashboard but a way of moving between disconnected datasets by searching, with Siren Investigate™ as the analyst front end and Siren Federate™ bringing relational joins to Elasticsearch clusters.
Its strengths are verifiable rather than merely promised. The documentation is public, complete and versioned, the REST APIs are described in the open, a free Community Edition can be downloaded and followed through a step-by-step tutorial, and the integration ecosystem is named source by source. The awards on display run from a Gartner Cool Vendor listing in 2020 to a place in the Deloitte Technology Fast 50 in 2023. The platform is installed on the customer's own machines, which is the concrete substance behind the sovereign positioning. The strategic investment from Elastic announced on 2 December 2025 is a reasonable signal of durability, and Atlantic Bridge sits on the board through Gerry Maguire.
The friction is just as real. No price is published, so every paid edition starts with a sales conversation. The free trial is gated by a vetting step the publisher announces openly. The technical bar is set by the publisher itself, which asks for experienced analysts or IT professionals comfortable with data architecture and infrastructure deployment. And the compliance paperwork a European buyer usually asks for is simply not on the site: no GDPR mention, no data processing agreement, no sub-processor list, no security certification.
For a well-staffed investigative unit with an Elasticsearch estate and a real procurement process, Siren is worth the conversation. For anyone hoping to sign up, pay and start the same afternoon, it is not that kind of product.
- Choosing a selection results in a full page refresh.
- Opens in a new window.