Simple, Transparent Pricing

Reputation lookups use the monthly check quota. Bulk lookups count each item in the batch (for example, 100 domains use 100 checks). On Pro and Enterprise, STIX/TAXII feed polling is outside that quota. Prompt-injection and email scans have a separate monthly allowance: an email message counts as one scan, however many links and attachments it carries, and a prompt-injection scan counts as one plus one for each additional indicator it checks.

Yes, you can change your plan at any time. Upgrades take effect immediately, and downgrades take effect at the next billing cycle.

We offer a forever-free plan with limited quotas, and paid plans are billed at checkout — cancel anytime from billing settings. There is one trial: when a Free organization reaches its saved-report limit, its owner or an admin can start a 7-day Pro trial, once per organization. Checkout asks for a card.

We accept all major credit cards. Enterprise plans can be paid by wire transfer with annual invoicing: request a quote and we send the invoice and terms. Request a quote

Yes, annual plans receive a 17% discount compared to monthly billing.

You'll receive alerts as you approach your limit. Once the monthly quota is used up, further requests are rejected with an HTTP 429 error — nothing extra is ever billed. To keep going, upgrade to a higher plan or wait for the quota to reset at the start of the next month.

No. On Pro and Enterprise, calls to the TAXII endpoints are exempt from the monthly check quota, because a feed is polled continuously by design — your connector can stay in sync without spending the allowance you bought for lookups. Per-minute burst limits still apply. Feed access itself requires Pro or Enterprise: on Free the TAXII endpoints are not served, and calls to them still count against your 500 monthly checks.

The collections are the same — what changes is the envelope around them. An Enterprise key has no page limit: ask for as many objects in a single request as you like. Responses stay paginated by size, so a large page comes back with a next token you keep following until the collection is exhausted — that is what lets a sync pull everything instead of failing on one oversized response, and it completes in far fewer round-trips than a capped page would. A much higher burst allowance means parallel paging is bounded by how much data you want rather than by the rate limiter. Enterprise also includes hands-on help wiring the connector up, whether that is OpenCTI, MISP, Microsoft Sentinel or your own client. We do not print the per-response size budget: it is tuned to the capacity of the machine serving the feed, and a published number becomes a commitment we would rather keep by measuring than by guessing.