Limits, fair use, and overage
What each plan includes, what happens past it, the optional tripwire and log overage, and the technical limits that apply to every plan.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
What is billed?
Your plan, and nothing per event. The only metered charges are optional, and off until an owner or admin turns them on: tripwires held past your plan’s allowance, and logs scanned past it.
- Source events are included under fair use and never charged. One event is one request a source receives.
- Activity (findings, incident matches, tripwire hits, site checks, scanned log lines, and SDK reports) is never billed. Your overview and the weekly digest show it each month.
What does each plan include?
| Starter | Pro | Business | |
|---|---|---|---|
| Sources | 5 | 30 | Unlimited |
| Source events a month, fair use | 75,000 | 150,000 | 750,000 |
| Fair use ceiling | 750,000 | 1,500,000 | 7,500,000 |
| Custom rules | 10 | 50 | Unlimited, within fair use |
| Silent source alerts | Yes | Yes | Yes |
| Outbound traffic watch | No | Yes | Yes |
| Findings and source event history | 30 days | 60 days | 180 days |
| Verified domains | 10 | 30 | Unlimited, fair use 100 |
| Site checks | Daily | Daily | Daily |
| Tripwires | 15 | 50 | 200 |
| Tripwires past the allowance, optional, each a month | Optional | Optional | Optional |
| Fake AWS key tripwires | Yes | Yes | Yes |
| Logs scanned each month | 1 GB | 10 GB | 50 GB |
| Logs past the allowance, optional, per GB | Optional | Optional | Optional |
| Your own keys matched by fingerprint | Yes | Yes | Yes |
| Revoke and undo | No | Yes | Yes |
| Incident Alerts | Yes | Yes | Yes |
| Alerts to Slack, Discord, Teams, or any URL | Yes | Yes | Yes |
| Source IP allowlist | No | No | Yes |
On every plan an account can hold 20 SDK projects, 20 log drains, and 200 stack items.
What happens past the included source events?
Nothing is charged. Sources keep receiving up to the fair use ceiling: ten times the included volume. Past it, sources answer 429 until the month turns, and refused events are not checked. Some senders retry a 429 later; GitHub does not redeliver on its own. It is a guard against a runaway sender, not a sales limit; contact support if you need it raised. Passing a limit never deletes stored events.
Tripwire overage
With tripwire overage on, you can hold up to twice your plan’s tripwires: 30 on Starter, 100 on Pro, 400 on Business. Each tripwire past the allowance is billed at your plan’s rate, on the most you held at any point in the month, as one line on your next invoice. Off by default. See tripwires.
Log overage
Log drains scan up to your plan’s monthly allowance, then keep accepting logs but stop scanning them until the month turns. With log overage on, scanning continues up to twice the allowance, and whole GB past the allowance are billed once after the month closes, as one line on your next invoice, at your plan’s rate. A part GB is never billed. Off by default.
Notices
- At 80 percent of the fair use ceiling, owners, admins, and your alert addresses get one email per month saying events are not charged, and from Starter a message in your alert channels.
- At 80 percent of a plan limit (sources, verified domains, tripwires, log volume, seats), the dashboard shows one quiet line, and you get at most one email per limit a month. Nothing is blocked.
Technical limits
| Limit | Value |
|---|---|
| Source event size | 5 MB; events over 350 KB are kept in object storage |
| Intake rate per source | 100 requests per second sustained, bursts higher |
| API rate limit | 100 requests per minute per key |
| Outbound hosts per SDK report | 200 |