Summary for security, legal, and procurement reviewers evaluating Blekline.
Product summary
Blekline provides Non-Human Identity & Runtime Enforcement at the agent boundary — mask, enforce, and audit prompts and tool calls before they reach LLMs and downstream systems.
- Cloud: app.blekline.com
- Open source: github.com/Blekline/blekline-oss
- Interactive demo: Runtime Simulator
Workspace routes (post-signup)
After account creation, workspaces land on the path chooser at /auth/choose-plan?gate=signup:
| Route | Audience | Billing | Outcome |
|---|---|---|---|
| Platform eval | K8s/Docker pilots, security architecture | No Stripe during eval (SOW for production) | nhim-audit upload → self-serve probe token in Deployment hub → deployment checklist → compliance export |
| Self-serve MCP | Cursor / Claude Code integrators | Card-free tryout (50 masks) or Stripe subscription | API key + MCP wiring → MCP hub |
| Enterprise | Procurement, Enclave rollout, regulated buyers | Custom SOW | Trust Vault, Lineage Firewall, private VNet, dedicated SLA |
Platform eval does not substitute for a production contract — eval workspaces are fixed-scope pilots with relaxed billing gates for posture and deploy tooling only.
OSS vs enterprise boundary
| Capability | OSS (Local) | Mark | Redact | Enterprise |
|---|---|---|---|---|
| MCP server, proxy, SDK | Yes | Yes | Yes | Yes |
| Ingress sidecar (contracts) | Yes | — | Yes (Enclave) | Yes |
| Hosted MCP + ingress proxy | — | Yes | Yes (CP) | Yes |
| In-cluster Enclave sidecar | — | — | Yes | Yes |
| K8s admission + dual-control enforce | — | — | Yes | Yes |
| SIEM webhook (basic JSON/CEF) | — | — | Yes | Yes |
| Active PII vault (Blekline-held keys) | — | Yes | — | Yes |
| Trust Vault (customer master key) | — | — | Yes | Yes |
| Lineage Firewall (destructive block) | — | — | — | Yes |
| SAML / SCIM | — | — | — | Yes |
| Blekline for Microsoft Sentinel | — | — | — | Yes (bundled) |
| Azure authoritative PII | — | Yes | Yes | Yes |
| Private VNet / dedicated SLA | — | — | — | Yes |
Self-serve tiers (V2 reference)
Public self-serve plans on Stripe and Azure Marketplace:
| Tier | Platform fee | Best for |
|---|---|---|
| Local | $0 | Solo devs — local hooks, stdio MCP, no card |
| Mark | $499/mo | Hosted team governance — 25 agents, 3M guarded tokens/mo |
| Redact | $1,490/mo | Platform teams — Enclave sidecar, 5 nodes incl., 100 agents |
| Enterprise | from $5,000/mo | SAML, SCIM, Sentinel, 25 Enclave nodes, private offers |
Enclave is a data-plane SKU ($150/node list; 5 included on Redact) — not a standalone control-plane tier.
For custom order forms and private offers, contact enterprise@blekline.com or use in-app Billing.
Legal & privacy
- Terms
- Privacy
- Subprocessors
- DPA outline — contact support@blekline.com for executed DPA
Security artifacts
- Threat model
- Trust boundaries
- SSO & SCIM runbook — IdP cutover for Enterprise
- MCP identity pinning
- Implementation checklist — audit → enforce golden path
- [Eval journey](/docs/get-started/eval-journey) — Track 01–03 golden path
Pilot engagement
Design partner and pilot programs available — GitHub design partner issue, enterprise@blekline.com, or the enterprise lead form on the path chooser.