Local tools stay free; Team adds monitored decoys, alerts and 90-day operating history, while Enterprise is scoped to your deployment.
Try with test material
For evaluating local tools and a small monitored-decoy workflow.
Run your workflow
For a small company operating decoys, alerts and evidence in production.
Agree the operating scope
For customer-controlled keys, private deployment or contractual operating needs.
Usage limits apply to the subscribed API key. Enterprise capacity and operating terms are set in the signed scope.
| Capability | Free | Team | Enterprise |
|---|---|---|---|
| Hosted requests | 500 / month | 100,000 / month | By contract |
| Hosted chosen-decoy creation | Not available | Included | By contract |
| Generated decoys | 10 / rolling day | 1,000 / rolling day | By contract |
| Armed monitored decoys | 10 | 10,000 | By contract |
| Encrypted vault storage | 25 items | 10,000 items | By contract |
| Alert destinations | Dashboard | Dashboard, Slack, PagerDuty, Datadog | By contract |
| Detection history | 7 days | 90 days | By contract |
| Company sign-in | Not available | Not available | By contract |
| Customer-controlled keys | Not available | Not available | By contract |
| Support | Documentation | Email support | By contract |
Source, verification tools and the controls map are public for review. An independent cryptographic audit and SOC 2 examination are planned and are not complete. Monitoring observes matching inputs at supported deny.sh endpoints, not offline decryption or a fake credential tested directly with another provider. Enterprise agreement templates remain drafts until signed. Review the trust centre →
A request to a metered deny.sh endpoint, including hosted encryption, decryption, control generation and vault operations, counts toward the monthly allowance. Health and usage checks do not.
The browser tools, CLI and SDKs can run the core encryption construction on your device without an account. Plaintext and passwords stay in your environment when you use those local paths. Hosted services and cloud storage have different data boundaries.
An armed fingerprint triggers when a matching input is observed at a monitored deny.sh decrypt endpoint. Registration sends a one-way fingerprint. Offline decryption and provider-side tests of a fake credential are not observed automatically.
The over-limit request is refused with a 429 response. Wait for the relevant rolling window or monthly allowance to reset, or upgrade. There are no automatic overage charges.
Team annual is one $990 charge for the year. Monthly Team is $99 per month. Use the Stripe Customer Portal to cancel; the subscription remains active through the paid billing period.
Local browser, CLI and SDK encryption keeps plaintext and passwords on your device. Hosted encryption sends plaintext and passwords for in-memory processing. A realism-engine request sends the requested data type, not the secret. Cloud vault storage receives ciphertext and the metadata you provide. Read the full surface-by-surface disclosure.
Published self-serve terms govern self-serve use. Enterprise agreement, data-processing and service documents shown as drafts become binding only when the relevant document is executed by both parties.