Licensed by product line. No SKUs inside any line.
A line is one buyer, one meter, and it is licensed on its own dimension. Inside a line every capability is included — that promise is the point, and it is why there is nothing to upsell you once you are in one. A future line arrives with its own meter, never as a tier inside an existing one.
One meter per line. Every app in the line, free.
The plans below are the platform line, metered on daily ingestion: one price buys a GB/day allowance in EventLake Cloud, or a far larger TB/day ceiling under the on-prem licence, where your hardware keeps the data. No per-seat fees, no per-module gating, turn everything on. The verification line rates on a different dimension entirely — resolved checks, by family — and its price list is not published yet, so nothing here quotes it. See the two lines.
The pricing model · drawn
The price follows one number. Every app stays on.
No per-seat fees and no per-module gating: on the platform line, the only thing that moves the price is the data you ingest each day.
Included at every volume
- Detection
- Investigation
- Response
- Hunting
- Behaviour analytics
- File integrity
- Posture
- Reports
- and every other app in the line
Seats and modules are drawn flat because neither is metered. The data you ingest per day is the one meter, and the plans below sit along it at their daily ceilings. The row of apps does not change as the meter fills, because none of them is priced.
Every plan is delivered as a signed entitlement your deployment verifies offline.
See your environment as one Timeline.
A 30-minute walkthrough on your data — on-premise, or SaaS-hosted by us. Every finding cites the regime that governs it.
Scope & Honest Limits Four commercial boundaries on this page Expand · Full ledger →
The platform line’s plans and prices are on this page. The verification line’s price list is not published yet, and the lines that meter on seats, nodes or hosts carry no published rate either; those are quoted against your own estate.
They are built, they are in the package, and you will use them in a trial. We are not going to publish a rate for them before we can invoice for them.
The unit is a resolved check. Checks are grouped into families that are priced differently, and that grouping is a quote conversation today rather than a public table.
A licence that sets no quota for agents or seats admits without limit, by design. The daily ingest ceiling is never a valve: going over it is metered and billed, and ingest is never paused.