Pricing
Priced for the team that already pays for Cursor.
Solo is free forever and stays on the machine. Team is live today. Business and Enterprise extend it, and the table below marks exactly what ships now and what is planned.
Four tiers
Same detection engine in every one.
$0
forever
One engineer, your own Mac
- 47 rules, the same engine the paid tiers run
- Deterministic and read-only, nothing in your prompt's send path, zero added latency
- Real-time warning as you type, the secret never enters the record
- No account, no manager attached
- 4.1 MB, signed and notarized, macOS 13+ on Apple Silicon
$50
per seat / month
$600 per seat / year, billed annually
10 to 100 engineers
- Manager dashboard: category, severity, tool, engineer, count of masked values
- Investigation mode behind a second factor, a reason and 50 characters of justification
- Every investigation notifies the engineer and expires in 24 hours
- Per-org hash chain on a table that rejects updates and deletes
- E2EE keypair generated in the manager’s browser, we hold a blob we cannot open
- Weekly digest email, shipping with early access
- Terms bar this data from performance review, printed on every dashboard page
$99
per seat / month
$1,188 per seat / year, billed annually
100 to 1,000 engineers
- Everything in Team
- SAML SSO and SCIM provisioning (planned)
- Custom policy rules (planned)
- SIEM export to Splunk and Datadog (planned)
- Slack and PagerDuty routing (planned)
- Support straight from the founders
Custom
$150K to $500K / year
Volume bundle plus platform fee
1,000+ engineers
- Everything in Business
- On-prem deployment (roadmap)
- Bring your own keys (roadmap)
- SOC 2 Type II (roadmap)
- White-glove rollout for a fleet install
- Direct invoicing, scoped with the founders
The free app is the whole engine. Paying does not detect more, it decides who else gets to see the signal and under what conditions.
Compare
What ships today, and what is next.
Every yes in this table runs in production today. Early access means built, turning on as waitlist teams onboard. Anything marked planned or roadmap is exactly that. We will not invoice you for it, and we will not demo it as if it shipped.
| Feature | Solo | Team | Business | Enterprise |
|---|---|---|---|---|
| Seats | 1 | 10 to 100 | 100 to 1,000 | 1,000+ |
| 47 rules, on-device detection | Yes | Yes | Yes | Yes |
| The secret never enters the record | Yes | Yes | Yes | Yes |
| Your own events, on your machine | Yes | Yes | Yes | Yes |
| Manager dashboard | No | Yes | Yes | Yes |
| Weekly digest email | No | Early access | Early access | Early access |
| Investigation mode, second factor and 24h expiry | No | Yes | Yes | Yes |
| Per-org hash chain, no updates or deletes | No | Yes | Yes | Yes |
| E2EE keypair in the manager’s browser | No | Yes | Yes | Yes |
| Google or Microsoft sign-in | No | Yes | Yes | Yes |
| SAML SSO and SCIM | No | No | Planned | Planned |
| Custom policy rules | No | No | Planned | Planned |
| SIEM export | No | No | Planned | Planned |
| Slack and PagerDuty | No | No | Planned | Planned |
| On-prem deployment | No | No | No | Roadmap |
| Bring your own keys | No | No | No | Roadmap |
| SOC 2 Type II | N/A, on-device | Roadmap | Roadmap | Roadmap |
| Billing | Free | Direct invoice | Direct invoice | Direct invoice |
SOC 2, on-prem, and bring your own keys arrive with the enterprise roadmap. Until then the architecture does the work: detection runs on your machines, evidence is stored masked, and the audit trail never contains a live secret.
Billing
An invoice written by a person.
Billing is founder-led. Team and Business seats get a direct invoice, annual commits get the annual rate, and seat changes are prorated on the next one. Enterprise is a volume bundle plus a platform fee, scoped on a call.