Evaluate Your First Repo in 7 Days. Review the Evidence Locally.
Request a signed 7-Day Pro Trial key for one Tier A auditor seat. Test CBOM evidence and supported CLI remediation on a representative repository, then discuss a guided fleet pilot if the workflow fits.
- Track 1 · Signed 7-Day Pro Trial Key — unlock Tier A CycloneDX 1.6 CBOM exports, mandate profiles, and supported Gate 2 CLI fixes locally on one representative repository.
- Track 2 · Tier B Enterprise Demo & 30-Day Fleet Pilot — evaluate the 12-Language Immunity Engine (
IMM-*), 4-Gate Vericoding, CISA IBOM,ciphermap mcpAI referee, and multi-repo VPC rollout via /book or /enterprise/order-form. - Founding Reference Partner Incentive (25% Off Annual) — eligible annual Startup, Growth, and Scale customers receive 25% off in exchange for structured pilot feedback and public reference permission, confirmed in writing.
Book a 25-minute engineering demo to scope a guided 30-day pilot and partner pricing.
Everything Unlocked During Your 7-Day Pro Trial
The self-serve 7-day trial unlocks Tier A Standalone PQC Auditor on one repository. Tier B 12-Language Immunity (IMM-*), 4-Gate Vericoding, and MCP AI Referee are scoped separately for Enterprise fleets.
Local Discovery & Gate 2 CLI Remediation
Scan supported source patterns across 12 languages. Preview remediation first with fix --dry-run, then evaluate licensed CLI apply on supported patterns and platforms.
CycloneDX 1.6 CBOM & Auditor Bundles
Export machine-readable Cryptographic Bills of Materials (ciphermap cbom --bundle --output) with grounded cryptoProperties, cbom --diff posture deltas, SPDX 2.3, and OpenVEX 0.2.0 metadata.
OMB M-23-02, CNSA 2.0, CMMC 2.0, BSI & ANSSI
Run ciphermap report --omb-m23-02 to separate passive [OBSERVED] / [128-BIT CLASSICAL ASSET] inventory from active vulnerabilities alongside CNSA 2.0, CMMC 2.0, BSI TR-02102, and ANSSI profiles.
Composite Ed25519 + ML-DSA-65 (.pqc.sig) Reports
Generate Executive and Technical HTML reports with Asset Inventory vs. Vulnerability Rollup Tables, signed with composite Ed25519 + FIPS 204 ML-DSA-65 (.pqc.sig) provenance and TSA countersignatures.
AES-256-GCM Airgap Vault & Bytecode/HSM Checks
Package sensitive findings into encrypted airgap vaults for classified enclaves, inspect .jar/.war/.whl archives and PKCS#11 HSM / 3DES DUKPT calls, and detect wire-incompatible Round 3 PQC drafts.
Crypto-Agility Coupling Metric
Score algorithm coupling across your source tree to locate hardcoded primitives vs. decoupled crypto abstractions for seamless future algorithm swaps.
| Capability / Evidence Format | Community ($0 Forever) | 7-Day Pro Trial (Tier A) Normally $4,999/yr · Free 7-Day Trial |
|---|---|---|
Static source-layer cryptographic discovery (12 languages + bytecode/HSM) All 12 supported languages, .jar/.whl archives, PKCS#11 HSM & 3DES DUKPT | ||
Text, versioned JSON, & SARIF 2.1.0 output Machine-readable CI results | ||
Local CI failure gates (--fail-on) Enforce crypto hygiene in CI | ||
12-language remediation dry-run preview (ciphermap fix --dry-run) Preview candidate diffs across all 12 languages | ||
Licensed CLI apply for supported remediation patterns Supported patterns and verification vary by language, platform and build | ||
CycloneDX 1.6 CBOM with cryptoProperties (cbom --bundle --output & --diff) Machine-readable Cryptographic BOM, posture diff & signed bundle | ||
CNSA 2.0, OMB M-23-02, CMMC 2.0, BSI TR-02102 & ANSSI profiles Separates [OBSERVED] inventory from active vulnerabilities | ||
Executive HTML Rollup Reports with Ed25519 + ML-DSA-65 (.pqc.sig) attestation Dual classical + FIPS 204 post-quantum provenance | ||
AES-256-GCM airgap vault export/import Encrypted airgap data transport | ||
SPDX 2.3 & OpenVEX vulnerability metadata Interoperable security exchange | ||
Local scanning with documented offline controls Review optional integrations separately |
Your Proprietary Source Never Leaves Your Host
100% Local Processing
The documented offline scanning workflow parses source in your local runtime without uploading code. Optional integrations and evidence sharing should be reviewed and configured separately.
No Telemetry Required
Evaluation license keys are validated cryptographically offline. You can execute scans in air-gapped enclaves, disconnected VPCs, or CI runners with egress blocked.
No Credit Card Needed
The self-serve Pro Trial is free for seven days from key issuance. No credit card is collected, and there are no auto-conversions or unexpected commercial charges.
Frequently Asked Questions
How does the 7-day Pro Trial differ from Tier B Enterprise & a guided 30-day pilot?
A signed 7-day Pro Trial key unlocks Tier A Standalone PQC Auditor (CycloneDX 1.6 CBOM, compliance profiles, and Gate 2 PQC remediation) for one auditor seat on one representative repository. Tier B Enterprise capabilities—the 12-Language Immunity Engine (IMM-*), 4-Gate Vericoding (immunity extinguish), CycloneDX 1.6 CISA IBOM (immunity attest), local ciphermap mcp AI referee, and multi-repo fleet governance—are demonstrated live via /book or unlocked through /enterprise/order-form and a guided 30-day pilot.
How does the 25% Founding Reference Partner discount work after our free trial?
Eligible annual Startup, Growth, or Scale customers can receive 25% Reference Partner pricing in exchange for structured pilot feedback and permission for a public logo or joint case study, confirmed in writing on your annual order.
Can I evaluate the CLI offline?
Yes. Signed trial keys are verified cryptographically offline by the CLI so you can run scans with --offline --no-telemetry inside disconnected VPCs or restricted CI runners.
What happens when the trial concludes if we don't upgrade right away?
The signed Tier A entitlement expires after seven days. Free discovery remains available forever and existing local reports stay on your machine—no payment card is collected and there is no auto-conversion.