Pricing & evaluation

Start locally. Choose the scope your team needs.

Q: Why use CipherMap if our developers already have Claude Code, Cursor, or GitHub Copilot?

AI coding assistants are helpful for interactive refactoring, and Enterprise Fleet pairs directly with them via ciphermap mcp (local stdio AI referee) plus .cursor/rules and CLAUDE.md policy ratchets—but LLMs alone cannot replace a deterministic local cryptography audit or CI gate for five reasons: (1) Zero-egress offline privacy—CipherMap runs locally (--offline --no-telemetry) rather than streaming proprietary cryptographic, HSM, and key-management code to cloud LLM context windows; (2) Compiled binary and keystore inspection with fail-closed coverage—CipherMap inspects .jar/.war/.whl constant pools, .jks/.p12 keystores, and ELF/Mach-O/PE symbols, exiting 2 (coverage_status: incomplete) when artifacts are truncated or corrupted instead of only reading text fitted into a prompt; (3) Standards-pinned AST/CFG rules—LLMs trained on pre-FIPS repositories frequently hallucinate wire-incompatible NIST Round 3 kyber768 and dilithium3 drafts (caught by PQC-PRE-001..005) instead of finalized FIPS 203/204/205 parameters; (4) T0/T1 & Gate 2 compiler and test-suite verification—CipherMap isolates pre-existing repository errors, compiles candidate patches inside network-denied sandboxes, and explicitly declines wire-breaking protocol rewrites (declined_protocol_guardrail) rather than applying unverified edits; and (5) Signed audit provenance—Tier A produces CycloneDX 1.6 CBOM, SPDX 2.3, PQC OpenVEX 0.2.0, and cbom --diff deltas, while Tier B Enterprise adds 12-language Immunity scanning, signed CycloneDX 1.6 CISA IBOM + Immunity OpenVEX 0.2.0, and sub-second deterministic PR guardrails signed with composite Ed25519 + ML-DSA-65 (.pqc.sig), whereas auditors cannot accept non-deterministic chat transcripts.

Free discovery helps you inspect findings on your own machine. A signed seven-day Tier A trial lets you evaluate evidence outputs; guided Enterprise pilots add an agreed CI and fleet workflow.

Download CipherMap CLI Start a 7-day trial Plan an Enterprise pilot

Standalone Auditor checkout is available; Enterprise plans are sales-assisted. Already subscribed? Manage subscription & invoices.

Show planning prices:

Local discovery · Free Forever

Free Discovery

Run PQC repository preflight checks and triage cryptographic risk locally with zero network egress.

$0 No licence required

Unmetered local repositories · Unlimited LOC ($0 per-LOC fees)

12 supported languages (AST + regex), .jar/.whl bytecode, .jks/.p12 keystores, PKCS#11 HSM & IaC
101+ PQC & classical crypto rules mapped to NIST FIPS 203/204/205 & CNSA 2.0 readiness
ciphermap preflight PQC repo/toolchain checks & self-contained ciphermap demo sandbox (0 egress)
Readiness findings in text, JSON and SARIF 2.1.0 + basic CI severity gates (--fail-on)
Gate 2 dry-run PQC remediation previews (fix --dry-run) + offline report, vault, proof & IBOM verification

Download the local scanner Read the quickstart

Evidence · Tier A

Standalone Auditor

Produce signed CycloneDX 1.6 CBOM, SPDX 2.3, PQC OpenVEX 0.2.0, and T0/T1 crypto readiness evidence for engineering and audit review.

$4,999 / year

1 Scoped Repository · 1 Named Auditor Seat · Unlimited LOC ($0 per-LOC fees) · equivalent to $417/mo billed annually

Under $5,000 Corporate Card Limit · 100% Credited Toward Fleet Upgrade Within 30 Days

1 Scoped Repository · 1 Named Auditor Seat · Unlimited LOC ($0 per-LOC fees)
Signed CycloneDX 1.6 CBOM, SPDX 2.3 & PQC OpenVEX 0.2.0 attestation alongside CNSA 2.0, FIPS 140-3, --omb-m23-02, --cmmc, PCI-DSS 4.0 & DORA exports
Composite Ed25519 + ML-DSA-65 (.pqc.sig) artifact signatures, HTML reports, cbom --diff & T0/T1 blame-separated readiness diagnostics
Licensed Gate 2 AST hash/cipher remediation (--zero-attestation) for supported patterns; review platform and workflow limits before applying

The trial is separate from this list price. Evaluate one repository with one auditor seat. No card or automatic purchase. A valid signed key is required.

Fleet & CI/CD · Tier B

Enterprise Fleet

Unified single-pass PQC migration & 4-gate bug-class extinction, local MCP AI referee, CISO Web Console, and CI policy ratchets.

$24,999 / year

Up to 100 Repos · Up to 30 Active Contributors · Unlimited LOC ($0 per-LOC fees)

Preview conditional 25% Reference Partner annual rateTeams ≤10 contributors: $9,999/yr Startup Fleet tier →

Up to 100 Repos · Up to 30 Active Contributors · Unlimited LOC ($0 per-LOC fees) with $0 per-line or per-scan overage fees
Full 12-language Immunity Engine: ciphermap immunity scan (6 IMM-* classes), 4-gate immunity extinguish --apply & unified ciphermap fix --with-immunity --apply
Signed CycloneDX 1.6 CISA IBOM + Immunity OpenVEX 0.2.0 (immunity attest), monotonic immunity ratchet & ciphermap mcp local stdio AI referee (.cursor/rules + CLAUDE.md)
Self-Hosted CISO Web Console (ciphermap server), 12-language hybrid ML-KEM-768 + X25519 sidecar codegen, inline PR guardrails (ci-review) & Jira closure (--resolve-remediated)
Zero-PII PRF_seat cryptographic contributor nullifiers & HPKE (RFC 9180) air-gapped diagnostics

Plan your fleet scope

Instant Card / ACH Checkout ($24,999/yr) →2-Page Enterprise Order Form & Zero-Egress EULA →

Sales-assisted access. Legacy portfolios, larger teams and sovereign deployments need a written quote.

Founding Reference Partner offer

Eligible annual Startup, Growth, and Scale agreements can receive a 25% discount after structured feedback and permission for a public logo or case study. Eligibility, duration and the final price are confirmed in writing. Custom agreements are assessed separately; the trial does not apply a discount automatically.

Compare list and potential partner prices

Plans and scope

Compare capabilities and agree your scope

Review capabilities, annual plan amounts, and the information needed for a scoped quote.

Compare Plans & Feature Matrix

Compare the supported capabilities and their validation status. A licence tier does not remove build, platform, or workflow limitations; provider integrations and fleet deployment are confirmed during evaluation.

Feature	Free Discovery	Standalone Auditor ($4,999/yr)	DevSecOps Enterprise ($24,999–$49,999/yr)
Local PQC crypto scanning across all 12 supported languages + IaC/TLS/SSH/JWT/K8s Static source and manifest evidence does not provide whole-program data flow or runtime reachability analysis.	Included	Included	Included
Text, versioned JSON & SARIF 2.1.0 output Static source and manifest evidence does not provide whole-program data flow or runtime reachability analysis.	Included	Included	Included
Severity filtering, diff scanning & CI fail gate Static source and manifest evidence does not provide whole-program data flow or runtime reachability analysis.	Included	Included	Included
Basic CI templates & local pre-commit hook Available within the documented local CLI scope; broader hosted account and control-plane behavior is not implied.	Included	Included	Included
12-language PQC remediation preview (ciphermap fix --dry-run) Available within the documented local CLI scope; broader hosted account and control-plane behavior is not implied.	Included	Included	Included
Bundle/vault/IBOM offline verification, demo sandbox & local diagnostics CipherMap produces scan evidence and authenticated artifacts (Ed25519 and composite Ed25519 + ML-DSA-65 .pqc.sig); it does not certify compliance or guarantee runtime reachability.	Included	Included	Included
CNSA 2.0, FIPS 140-3, SP 800-56B, BSI TR-02102, ANSSI, OMB M-23-02 & CMMC 2.0 profiles CipherMap produces scan evidence and authenticated artifacts (Ed25519 and composite Ed25519 + ML-DSA-65 .pqc.sig); it does not certify compliance or guarantee runtime reachability.	Not included	Included	Included
CycloneDX 1.6 CBOM, SPDX 2.3 & PQC OpenVEX 0.2.0 CipherMap produces scan evidence and authenticated artifacts (Ed25519 and composite Ed25519 + ML-DSA-65 .pqc.sig); it does not certify compliance or guarantee runtime reachability.	Not included	Included	Included
Executive & technical HTML reports with Rollup Tables & Ed25519 + ML-DSA-65 (.pqc.sig) attestation CipherMap produces scan evidence and authenticated artifacts (Ed25519 and composite Ed25519 + ML-DSA-65 .pqc.sig); it does not certify compliance or guarantee runtime reachability.	Not included	Included	Included
Auditor bundle with HMAC-SHA256 & composite .pqc.sig provenance CipherMap produces scan evidence and authenticated artifacts (Ed25519 and composite Ed25519 + ML-DSA-65 .pqc.sig); it does not certify compliance or guarantee runtime reachability.	Not included	Included	Included
Encrypted AES-256-GCM air-gap export & import Available within the documented local CLI scope; broader hosted account and control-plane behavior is not implied.	Not included	Included	Included
Classical Gate 2 crypto remediation apply (eligible builds) Eligible builds support recipe-specific classical remediation apply within their licensed scope. Inspect Gate 2 baseline and candidate results: syntax, compilation, and behavioral tests provide different evidence. Unsupported migrations are declined; current source changes do not establish availability in every downloaded build.	Not included	AST hash/cipher (--zero-attestation)	Included
12-language Immunity vulnerability discovery & 4-Gate bug-class extinction (immunity scan / extinguish) Requires a Tier B Enterprise license. Static 12-language AST and lexical vulnerability discovery across the 6 IMM-* bug classes runs locally; offline verification commands and ciphermap demo remain Free.	Not included	Not included	Included
Signed CycloneDX 1.6 CISA IBOM, Immunity OpenVEX 0.2.0, monotonic ratchets & PR CI gates Requires a Tier B Enterprise license to generate CycloneDX 1.6 CISA IBOM and Immunity OpenVEX 0.2.0 attestations; offline verification via ciphermap immunity attest --verify remains Free.	Not included	Not included	Included
Hybrid post-quantum sidecar proposals (--hybrid) Hybrid post-quantum sidecar proposals (--hybrid) require a Tier B license and Gate 2 verification before writing to disk; sidecar scaffolding requires protocol integration and application review before rollout.	Not included	Not included	Included
Gated TUI / LSP apply actions for supported candidates TUI apply actions require an eligible build, supported recipe, entitlement, and Gate 2 verification. This paid write capability does not make Free local diagnostics, LSP hover guidance, or remediation previews paid features.	Not included	Not included	Included
GitHub, GitLab, Azure DevOps & Bitbucket PR bots with FIPS 203/204 blueprintscontract-tested Deterministic local provider contracts pass; disposable live-service validation is still pending and is not claimed.	Not included	Not included	Included
Jira (with PQC blueprints), Slack, OTLP & Dependency-Track deliverycontract-tested Deterministic local provider contracts pass; disposable live-service validation is still pending and is not claimed.	Not included	Not included	Included
Self-hosted fleet server, sync, Prometheus metrics & SVG badgesbeta The packaged single-process fleet server is beta on macOS and Linux only; Windows remains unavailable until native console-control shutdown and restart are proven. Fleet synchronization targets the local single-process server and does not imply CipherMap's future multi-tenant HA control plane.	Not included	Not included	Included
Repository & toolchain readiness (ciphermap preflight) + T0/T1 fault isolation Separates PRE_EXISTING_REPO_ERROR and MISSING_HOST_DEPENDENCY from candidate regressions before writing edits.	PQC preflight checks (0 egress)	T0/T1 blame-separated diagnostics	Full PQC + Immunity preflight & CI T0/T1 triage
12-language Immunity vulnerability discovery (ciphermap immunity scan) Licensed in Tier B Enterprise Fleet across 6 IMM-* bug classes; offline verification commands and ciphermap demo remain Free.	Not included	Not included	Included
Signed CycloneDX 1.6 IBOM + OpenVEX 0.2.0 attestation (ciphermap immunity attest) Tier A includes CycloneDX 1.6 CBOM, SPDX 2.3 & PQC OpenVEX 0.2.0; generating CycloneDX 1.6 CISA IBOM requires Tier B Enterprise.	Offline --verify only	Not included	Included
Unified single-pass ciphermap fix --with-immunity --apply & 12-language 4-gate immunity extinguish --apply Applies supported recipes only when baseline and candidate verifiers pass inside network-denied OS sandboxes; ambiguous control flows are declined.	Not included	Not included	Included
Local stdio AI referee (ciphermap mcp --workspace .) + .cursor/rules, CLAUDE.md & immunity ratchet Local stdio verification for Cursor and Claude Code with zero cloud prompt egress; enforces repository policy rules on supported patterns.	Not included	Not included	Included
Seats	Unlicensed	1 scoped internal repository · single named auditor seat · unlimited local/offline assessments	10 (Startup) / 30 (Growth) / 100 (Scale)

Commercial Packaging & Fleet Bands

One annual plan for your evaluation and deployment scope

Annual plans cover the stated seat or contributor scope to produce readiness evidence and CI guardrails. Startup, Growth, and Scale share full Tier B capabilities (including unified single-pass ciphermap fix --with-immunity, 12-language 4-gate immunity extinguish, the ciphermap mcp local stdio AI referee, the self-hosted ciphermap server CISO Web Console, and 12-language hybrid KEM sidecar codegen) and differ by contributor allowance. Pro Team, custom portfolios and Sovereign deployments require a written quote.

Plan & Licence Tier	Annual list price	25% Reference Partner	Seat / Repository Scope & Core Deliverables
Free Discovery Unlicensed CLI	$0	—	Unmetered local repositories · Unlimited LOC ($0 per-LOC fees); 12 supported languages (PQC crypto discovery), `ciphermap preflight` PQC readiness checks, `ciphermap demo` sandbox, .jar/.whl bytecode, .jks/.p12 keystores, SARIF 2.1.0, `fix --dry-run` & offline verification (`verify-report`, `immunity attest --verify`).
Standalone Auditor Tier A · Evidence	$4,999/yr	Standard list	1 Scoped Repository · 1 Named Auditor Seat · Unlimited LOC ($0 per-LOC fees); signed CycloneDX 1.6 CBOM, SPDX 2.3 & PQC OpenVEX 0.2.0 attestation (`.pqc.sig`), T0/T1 blame-separated readiness diagnostics, CNSA 2.0 / FIPS 140-3 / OMB M-23-02 / CMMC / PCI-DSS / DORA exports & Gate 2 AST hash/cipher fixes.
Enterprise Startup Tier B · Fleet (≤10 Devs)	$9,999/yr	$7,499/yr	Up to 25 Repos · Up to 10 Active Contributors · Unlimited LOC ($0 per-LOC fees), 12-language `ciphermap immunity scan`, 4-gate `immunity extinguish --apply`, unified `ciphermap fix --with-immunity --apply`, signed CycloneDX 1.6 CISA IBOM & OpenVEX 0.2.0 (`immunity attest`), `ciphermap mcp` AI referee, `.cursor/rules` + `CLAUDE.md` policy ratchets, CISO Web Console & hybrid ML-KEM-768 + X25519 sidecars.
Pro Team Scoped Team Quote	Written quote	Scoped per quote	Shared local CBOM & PQC OpenVEX evidence, T0/T1 diagnostics, and classical crypto remediation workflows for multi-auditor security teams without fleet CI rollout.
Enterprise Growth Tier B · Fleet	$24,999/yr	$18,749/yr	Up to 100 Repos · Up to 30 Active Contributors · Unlimited LOC ($0 per-LOC fees), unified `ciphermap fix --with-immunity`, 4-gate `immunity extinguish`, `ciphermap mcp` referee, `.cursor/rules` + `CLAUDE.md` ratchets, CISO Web Console, hybrid ML-KEM-768 + X25519 sidecars, 3-stage CI policy ratchet & Jira auto-closure.
Enterprise Scale Tier B · Fleet	$49,999/yr	$37,499/yr	Up to 250 Repos · Up to 100 Active Contributors · Unlimited LOC ($0 per-LOC fees), full Tier B PQC + 4-gate immunity platform, `ciphermap mcp` & IDE policy ratchets across multi-business-unit onboarding, and priority engineering support.
Legacy / Sovereign Custom Scope	Written quote	Assessed separately	Dormant repository archives (`--legacy-archive`), >100 contributor portfolios, and air-gapped SCIF enclaves with offline rulepacks & HPKE capsules.

Why we charge $0 for Lines of Code (Unlimited LOC): Even a 2-person AI-native team or modern monorepo can easily exceed 1M–50M+ LOC once generated protobufs, OpenAPI clients, vendor directories, and AI-assisted code are included. Instead of penalizing your codebase size with per-line overage fees, CipherMap governs fairness strictly by Active Contributing Developers (90-day git window, excluding bots) + Repository Band.

Zero-PII Contributor Verification

Active contributor scope uses zero-PII cryptographic PRF_seat nullifiers so you can validate contributor allowances locally without sending developer emails or Git history to CipherMap.

Dormant Legacy Repositories

Maintenance-mode or archived repositories with no active commits (--legacy-archive) are scoped separately from active contributor seats so legacy code never inflates your seat band.

Self-Hosted CISO Web Console

Enterprise Startup, Growth, and Scale include ciphermap server—an on-prem Web GUI for fleet posture, CBOM diffs, and compliance heatmaps that runs inside your own VPC.

The seven-day trial is a separate, no-card evaluation. Contributor allowance and auditor access are different concepts: share your repository history and intended users at a high level so the team can confirm a compatible licence. No repository identifiers or source are needed in an initial inquiry.

How contributor seats, repositories, and legacy archives are scoped

Standalone Auditor & Pro Team

Standalone Auditor ($4,999/yr) licenses 1 Scoped Repository · 1 Named Auditor Seat · Unlimited LOC ($0 per-LOC fees) for signed CycloneDX 1.6 CBOM, SPDX 2.3 & PQC OpenVEX 0.2.0 attestations (.pqc.sig), T0/T1 blame-separated readiness diagnostics, regulatory reports, and supported Gate 2 classical AST fixes. Multi-engineer teams below 30 contributors can request a scoped Pro Team quote.

Enterprise Startup (10), Growth (30) & Scale (100)

Sized strictly by a transparent dual bound—Active Contributing Developers (90-day git window, excluding bots; verified locally via PRF_seat: up to 10 / 30 / 100) and Repository Band (up to 25 / 100 / 250 repositories) with Unlimited LOC ($0 per-LOC fees). Even a 2-person AI-native team or monorepo can exceed 1M–50M+ LOC, so we never penalize lines of code. Includes 12-language ciphermap immunity scan vulnerability discovery, 4-gate immunity extinguish --apply, unified single-pass ciphermap fix --with-immunity --apply, signed CycloneDX 1.6 CISA IBOM & Immunity OpenVEX 0.2.0 (immunity attest), ciphermap mcp local stdio AI referee for Cursor & Claude Code, .cursor/rules + CLAUDE.md policy ratchets, and the self-hosted CISO Web Console (ciphermap server).

Legacy Archives & Sovereign Enclaves

Maintenance-mode or archived repositories (--legacy-archive) are scoped separately so low-commit legacy estates never inflate active developer seats. Air-gapped SCIF deployments include signed offline LKG rulepacks and HPKE (RFC 9180) support capsules.

Free Discovery ($0) is unmetered across local repositories and lines of code for 12-language PQC scanning, ciphermap preflight PQC readiness checks, the ciphermap demo sandbox, and offline verification (verify-report, immunity attest --verify, immunity extinguish --verify-proof). The 7-day Pro Trial evaluates Tier A CBOM & PQC OpenVEX evidence on one repository with zero card details or automatic renewal; the 12-language Immunity Engine (immunity scan, extinguish, attest, ratchet, and ciphermap mcp) is licensed exclusively in Tier B Enterprise Fleet.

ROI & ENGINEERING TIME CALCULATOR · US NATIONAL AVERAGE BENCHMARK

Estimate Your Monthly Manual Triage Cost vs. Automated Local Remediation

Application Security & Senior Software Engineers average $160,000/yr (~$80/hr) in the US before benefits, and multi-repository external PQC readiness assessments typically run $15,000–$75,000+ for static spreadsheets that never fix a single line of code.

1. Production Repositories in Scope25 repos

Scale from a single flagship service (1 repo) to a 250-repo enterprise fleet.

1 repo ($4,999 Sprint)25 repos100 repos250 repos

2. Security / Principal Engineers Touching Crypto & AppSec Triage3 engineers

Anchored at $160,000/yr (~$80/hr · $13,333/mo) per engineer.

1 engineer5 engineers10 engineers20 engineers

3. Current Open SAST / Crypto Findings Across Backlog450 findings

Includes deprecated RSA/ECDSA/SHA-1 call sites, JKS/PKCS#12 certs, and SQLi/XSS/path sinks.

50 findings1,000 findings2,500 findings5,000 findings

CipherMap Deterministic Savings Benchmark

At 232ms median local repo scan (verified across 832 benchmark repos with 0 crashes), CipherMap inventories all 25 repositories in ~5.8s and verifies fixes via T0/T1 compile-and-test sandboxed autofixes.

Monthly Engineering Bleed

$6,480/mo

~81 hrs/mo manual triage (@ $80/hr)

CipherMap Net Annual Savings

$130,261/yr

Includes avoiding ~$62,500 external audit

Recommended Flat-Rate License Tier

Team Fleet (Up to 25 Repos)

$9,999/yr

$4,999 Sprint 100% credited in 30 days

Zero Hidden Fees / 100% All-Inclusive Enterprise Pledge

per-developer seat tax

Unlimited developer & CI/CD runner commits inside your licensed repository tier.

token/Byte-upload fees

100% local deterministic AST & bytecode engine—zero cloud token metering or per-line surcharges.

mandatory professional services tax

White-glove CI/CD, GitHub Actions, and local MCP setup included with annual fleet plans.

Start with a 7-Day Free Pro Trial (100 CLI scans) or $4,999 Single-Repo Sprint

Explore Founding Partner Offer

Before you choose a plan

Why use CipherMap if our developers already have Claude Code, Cursor, or GitHub Copilot?

AI coding assistants accelerate interactive refactoring—and Enterprise Fleet pairs directly with them via ciphermap mcp (local stdio AI referee) plus .cursor/rules and CLAUDE.md policy ratchets—but LLMs alone cannot replace a deterministic local audit or CI gate:

Zero-egress offline privacy: Runs locally (--offline --no-telemetry) instead of streaming proprietary cryptographic, HSM, and key-management code to cloud LLM context windows.
Compiled binary & keystore inspection: Inspects .jar/.war/.whl constant pools, .jks/.p12 keystores, and ELF/Mach-O/PE symbols, exiting 2 (coverage_status: incomplete) when artifacts are truncated rather than reading only prompt-sized text.
Standards-pinned AST/CFG rules: Catches wire-incompatible NIST Round 3 kyber768 and dilithium3 drafts (PQC-PRE-001..005) that LLMs frequently hallucinate instead of finalized FIPS 203/204/205 parameters.
T0/T1 & Gate 2 compiler verification: Isolates pre-existing repo errors, compiles candidate patches inside network-denied sandboxes, and explicitly declines wire-breaking protocol rewrites (declined_protocol_guardrail).
Signed audit provenance: Tier A produces CycloneDX 1.6 CBOM, SPDX 2.3, PQC OpenVEX 0.2.0, and cbom --diff deltas; Tier B adds 12-language Immunity scanning, signed CycloneDX 1.6 CISA IBOM + Immunity OpenVEX 0.2.0, and deterministic PR guardrails signed with composite Ed25519 + ML-DSA-65 (.pqc.sig).

Will the trial charge me automatically?

No. The seven-day trial does not collect card details or start a subscription. Generated reports remain available to you; licensed commands need a current valid key.

How does a guided pilot work?

Request a 25-minute engineering demo to discuss scope and success criteria. A guided 30-day Enterprise pilot is subject to acceptance, build availability and agreed evaluation terms. Booking a demo does not activate a pilot.

How are contributors, repositories, and large monorepos (lines of code) counted?

We use a transparent Dual-Bound Packaging model governed strictly by Active Contributing Developers (90-day git window, excluding bots) + Repository Band with Unlimited LOC ($0 per-LOC fees): Standalone Auditor ($4,999/yr) covers 1 Scoped Repository · 1 Named Auditor Seat · Unlimited LOC ($0 per-LOC fees); Startup ($9,999/yr) covers Up to 25 Repos · Up to 10 Active Contributors · Unlimited LOC ($0 per-LOC fees); Growth ($24,999/yr) covers Up to 100 Repos · Up to 30 Active Contributors · Unlimited LOC ($0 per-LOC fees); and Scale ($49,999/yr) covers Up to 250 Repos · Up to 100 Active Contributors · Unlimited LOC ($0 per-LOC fees). We charge $0 for Lines of Code because even a 2-person AI-native team or monorepo can easily exceed 1M–50M+ LOC through generated protobufs, OpenAPI clients, vendor trees, and AI-assisted code—so fairness is governed strictly by Active Contributing Developers (verified locally via zero-PII PRF_seat nullifiers) and Repository Band without punitive per-line surcharges.

What about legacy portfolios or air-gapped environments?

Dormant maintenance-mode archives (--legacy-archive), organizations above 100 active contributors, and air-gapped SCIF enclaves are scoped in a tailored written quote so archived code never inflates your active developer band.

Does a compliance profile certify our environment?

No. Profiles and reports provide scoped evidence for engineering and audit review. They do not certify compliance, prove runtime reachability or replace a complete inventory.

Review the Standard 2-Page Enterprise Order Form & Zero-Egress EULA, support boundary, and terms by access type, or scope a guided evaluation.