Simple plans. Explicit limits.
Room for your next stage.
Every plan starts with sources, a watched domain, tripwires, and Incident Alerts for your stack. Ready-made rules come on every plan, and higher plans add sources, custom rules, channels, and retention. Source events are included under fair use and never charged.
Three plans, the same ready-made rules
Every plan includes sources, ready-made rules, tripwires, site checks, and Incident Alerts. Higher plans raise coverage, history, and channels rather than unlocking the basics.
Starter
For a small production app with paying users.
Custom
5 sources 75,000 source events a month, fair use, never charged
10 verified domains, scanned daily for site checks
Detect and respond
- 10 custom rules
- Alerts when a source goes silent
- 15 tripwires, fake AWS keys included
- Tripwires beyond your allowance: optional
- 1 GB of logs scanned a month
- Logs beyond your allowance: optional
- Alerts when your real key turns up
Account
- 30 days of findings and source history
- Slack, Discord, Teams and custom URL alerts
- 5 team seats
- Audit log and sign-in history, last 60 days
- Email support, reply within 5 working days
Pro
Where most small teams land after Starter.
Custom
30 sources 150,000 source events a month, fair use, never charged
30 verified domains, scanned daily for site checks
Detect and respond
- Everything in Starter
- 50 custom rules
- Outbound traffic watch through the SDK
- 50 tripwires
- Tripwires beyond your allowance: optional
- 10 GB of logs scanned a month
- Logs beyond your allowance: optional
- Revoke or rotate at 8 providers, or send to your own system
Account
- 60 days of findings and source history
- 10 team seats
- Audit log and sign-in history, last 90 days, CSV export
- Priority email support, reply within 3 working days
Business
For teams where one missed alert becomes a long night.
Custom
Unlimited sources 750,000 source events a month, fair use, never charged
Unlimited verified domains, scanned daily for site checks
Detect and respond
- Everything in Pro
- Unlimited custom rules
- 200 tripwires
- Tripwires beyond your allowance: optional
- 50 GB of logs scanned a month
- Logs beyond your allowance: optional
- Source IP allowlist
Account
- 180 days of findings and source history
- Unlimited team seats
- Audit log and sign-in history, last year, CSV export
- Dedicated account manager, reply within 1 working day
Every plan includes
Connect
- Sources for GitHub, AWS through EventBridge, Okta, Auth0, your own app, and any signed webhook
- Set up yourself in Settings, Integrations: no app to install, no vendor sign-in
- Signatures checked for GitHub, Stripe, Shopify, Paddle, Standard Webhooks, and ShellOrbit
- Source event inspector, with fields you choose masked
- REST API, MCP server, and the JavaScript SDK
- Audit log and sign-in history, with IP address and device
- 99.9 percent monthly uptime commitment, every plan
Detect and respond
- Ready-made rules for GitHub, AWS, Okta, Auth0, and your app's sign in events
- One findings feed, to acknowledge and resolve
- Live site checks for keys in browser code and exposed .env, .git, and source map files
- Checks for open Supabase tables and Firebase rules, and certificate chain and expiry
- Incident Alerts: an alert when a public security incident affects your stack, with the fix and the deadline
- SDK that masks keys in your logs, can block a response that carries a secret, and reports your runtime
- Tripwires: fake links, emails, and database rows
- AI explanations of findings and incidents, with your own AI provider key
- Email alerts, and a weekly digest in weeks with something to report
- Findings, incident matches, tripwire hits, scans, and runtime reports are activity, shown monthly and never billed
On smaller screens, scroll the table to compare every plan.
| Feature | Starter Custom | Pro Custom | Business Custom |
|---|---|---|---|
| Plan | |||
| Team seats | 5 | 10 | Unlimited |
| Connect | |||
| Connected sources: GitHub, AWS, Okta, Auth0, your own app, or any signed webhook | 5 | 30 | Unlimited |
| Source events a month, fair use, never charged | 75,000 | 150,000 | 750,000 |
| Set up yourself in Settings, Integrations, no vendor sign-in | Included | Included | Included |
| Signature checks: GitHub, Stripe, Shopify, Paddle, Standard Webhooks, ShellOrbit | Included | Included | Included |
| Send your own app events (sign ins, admin changes) to a source | Included | Included | Included |
| Source IP allowlist | Not included | Not included | Included |
| Detect | |||
| Ready-made rules for every source | Included | Included | Included |
| Custom rules: match a field, or more than N in M minutes | 10 | 50 | Unlimited |
| Alert when a source goes silent | Included | Included | Included |
| Outbound traffic watch: a new host called by your app or a package, through the SDK | Not included | Included | Included |
| Tripwires: fake links, emails, and database rows | 15 | 50 | 200 |
| Tripwires beyond your allowance, optional, per tripwire a month | Optional | Optional | Optional |
| Fake AWS key tripwires | Included | Included | Included |
| Verified domains with site checks | 10, daily | 30, daily | Unlimited, daily |
| Keys in browser code, exposed .env and .git files, open Supabase tables and Firebase rules, certificate checks | Included | Included | Included |
| Log drains from Vercel, Netlify, Supabase, Cloudflare, and CloudWatch | 1 GB a month | 10 GB a month | 50 GB a month |
| Logs beyond your allowance, optional, per GB | Optional | Optional | Optional |
| Alert when your real key turns up in a scan or log | Included | Included | Included |
| Incident Alerts: public security incidents matched to your stack | Included | Included | Included |
| SDK: keys masked in your logs, response guard, runtime report | Included | Included | Included |
| Respond | |||
| One findings feed, with acknowledge and resolve | Included | Included | Included |
| Findings and source event history | 30 days | 60 days | 180 days |
| Email alerts | Included | Included | Included |
| Slack, Discord, Teams, and custom URL alerts | Included | Included | Included |
| Revoke or rotate at 8 providers, report to 2, or send to your own system, with 10 minutes to cancel | Not included | Included | Included |
| Fix prompts for Lovable, Cursor, and Bolt | Included | Included | Included |
| AI explanations with your own key | Included | Included | Included |
| MCP server for Claude, Cursor, and other AI agents | Included | Included | Included |
| Account and support | |||
| Weekly digest of findings, incidents, and silent sources | Included | Included | Included |
| Audit log and sign-in history, with IP address and device | 60 days | 90 days | 1 year |
| Export the audit log as CSV | Not included | Included | Included |
| REST API with read only or read write keys | Included | Included | Included |
| 99.9 percent monthly uptime commitment | Included | Included | Included |
| Support | Priority email | Dedicated account manager | |
| Support reply time | 5 working days | 3 working days | 1 working day |
Findings, incident matches, tripwire hits, scans, and runtime reports are activity, shown on your overview and in the weekly digest, and never billed. Source events are included under fair use: past ten times the included volume, new events wait until the month turns. Tripwires and logs past your allowance are optional, off until you turn them on, and capped at twice the allowance.
Support reply times are targets in working days, Monday to Friday. Business has a named account manager.
Dodo Payments is the merchant of record and collects any sales tax, VAT, or GST.
Know what is included
Findings and source event history: Starter 30 days, Pro 60, Business 180. The audit log and sign-in history keep their own window, from 60 days on Starter to a year on Business.
Starter includes 5 team seats, Pro 10, and Business unlimited; check billing before purchasing more.
More pricing and product questions →Request access
Connect one system. Hear when it matters.
Tell us what you run. We set up your sources, domains, and tripwires with you, and ready-made rules work the moment a source is connected.