This page mirrors the in-app billing matrix (infra-feature-matrix.ts). Enclave is a data-plane SKU under Redact+ (node-metered); it is not a separate control-plane tier.
| Tier | Platform fee | Best for |
|---|---|---|
| Local | $0 | Solo dev — local hooks + stdio MCP only |
| Mark | $499/mo | Eng teams — hosted MCP + ingress proxy |
| Redact | $1,490/mo | Platform teams — in-cluster sidecar + K8s admission |
| Enterprise | from $5,000/mo | Regulated — SSO/SCIM, Sentinel, kernel plane |
Create a workspace · Pricing FAQ
Features and capabilities
| Capability | Local | Mark | Redact | Enterprise |
|---|---|---|---|---|
| Local hooks + stdio MCP | Yes | Yes | Yes | Yes |
| Hosted MCP + ingress proxy | No | Yes | Control-plane sync only | Control-plane sync |
| Active PII vault (tokenize / hydrate) | Irreversible local mask only | Hosted, short TTL, Blekline-held key | In-cluster PVC, customer key | In-cluster, customer CMEK |
| Downstream MCP proxy (tool policy) | No | Limited — hosted proxy only | Yes | Yes |
| Single-tenant sidecar container | No | No | Yes | Yes |
| Kubernetes admission Auto-Route | No | No | Yes | Yes |
| Lineage Firewall (contaminated session) | No | No | Limited — audit only | Yes |
| Blekline for Microsoft Sentinel | No | No | No | Yes |
| Client surfaces | Local only | Hosted + local | Local or sidecar MCP | In-VPC + local |
Vault honesty: Mark is not zero-knowledge — Blekline holds the KMS key and can decrypt. Redact and Enterprise use customer-held keys. Redact and Enterprise cannot call the hosted mask endpoint.
Security and administration
| Control | Local | Mark | Redact | Enterprise |
|---|---|---|---|---|
| Fail-closed mask / tool deny | Local hooks | Hosted + hooks (enterprise default: block on Azure fallback) | Sidecar failureMode: block + shared contracts pipeline | Sidecar + kernel plane |
| Audit-only sandbox, then dual-control enforce | No | No | Yes | Yes |
| Metadata-only Activity (no raw prompts) | No cloud Activity | Yes | Limited — syncs when controlPlane=saas | Air-gap default |
| Workspace RBAC | Single user | Yes | Yes | Yes |
| Hash-chained, signed audit trail | No | Yes | Yes | Yes |
| SAML 2.0 SSO + SCIM 2.0 | No | No | No | Yes |
| Customer-managed keys | Not applicable | No | Customer master key on PVC | Customer KMS / CMEK |
| eBPF kernel plane | No | No | No | Limited — audit sensor opt-in |
| Evidence and SIEM export | No | CSV and JSON download | Yes | Yes |
Pricing and metering
| Meter | Local | Mark | Redact | Enterprise |
|---|---|---|---|---|
| Monthly platform fee | $0 / €0 | $499 / €499 | $1,490 / €1,490 | from $5,000/mo commit |
| Annual prepay | — | $5,090 / €5,090 | $15,200 / €15,200 | Negotiated |
| Connected agents (handshake cap) | 1 | 25 | 100 | Custom |
| Included guarded tokens/mo (hosted path) | None | 3,000,000 | 2,000,000 (CP fallback only) | Custom |
| GT overage per 5M block | — | $150 / €150 | CP-hosted fallback only | Negotiated |
| Included Enclave nodes | 0 | 0 | 5 | 25+ in platform commit |
| Enclave node overage | — | — | $125/node/mo | Contract |
| Default GT overage spend cap | — | 2× platform fee ($998) | 2× platform fee ($2,980) | Contractual |
| How you buy | Download | Card; Azure (blekline-mark) | Card; Azure (blekline-redact) | Private offer or invoice |
Three counts — never conflate: connected agents (cap only), guarded tokens (hosted path), Enclave nodes (sidecar heartbeat). Mark buyers never pay per-node. Redact sidecar traffic is never GT-billed.
See Pricing FAQ for GT definition, node minimums, and overage behavior.
Support and service levels
| SLA / support | Local | Mark | Redact | Enterprise |
|---|---|---|---|---|
| Uptime SLA | No | 99.5% control plane | 99.5% control plane; cluster is yours | Negotiated, with credits |
| First response | Community | 1 business day | 4 business hours | As contracted |
| Support channel | GitHub issues | Email + shared channel | Named contact | |
| Guided pilot | No | No | Self-serve runbook | Paid pilot SKU |
| DPA, subprocessor list, security questionnaire | Public docs | Yes | Yes | Yes |
| Data residency | Your machine | EU region | Your cluster | Your VPC |
Next: Choose your path · Azure Marketplace · Billing in app