Get started

compare

View as Markdown

Blekline sells four deployment paths, not per-seat developer tiers. Pick the path that matches where masking and enforcement run.

PlanPriceWhere masking runsBest for
Free$0Your machine (local hooks + stdio MCP)Local development, OSS workflows
Standard$199 / €199 per monthBlekline-hosted proxy + vaultTeams that want hosted MCP without running a cluster
Fleet$499 / €499 per monthSingle-tenant sidecar in your clusterPlatform teams shipping NHIM in one Kubernetes fleet
EnterpriseCustom annual commitIn-VPC sidecar + optional eBPFRegulated buyers, air-gap, SAML/SCIM, private Azure offers

Annual prepay: Standard $2,029 / €2,029 · Fleet $5,090 / €5,090.

Hosted mask units (Standard)

Standard includes 100,000 hosted mask units per UTC month. Local and in-cluster masking is never metered.

  • Overage: $8 / €8 per 1,000 units (billed in 1,000-unit blocks)
  • Default spend cap: 2× the platform fee ($398 on Standard) — throttles hosted mask rather than producing an unbounded invoice
  • Raise or remove cap: Workspace admins under Usage or Billing

Fleet and Enterprise do not use hosted /api/mask for production masking — the sidecar handles mask in-cluster.

Honesty rules (read before procurement)

  • Standard is not zero-knowledge. Blekline holds the KMS key and can decrypt hosted vault data.
  • Fleet / Enterprise vault uses customer-held keys on your PVC — Blekline cannot hydrate.
  • eBPF (Enterprise, R4) observes sockets and exec — not TLS plaintext inside the kernel.
  • Windows clients are hooks-only coverage; cluster enforcement is Linux/K8s.

Compare in product

The billing page renders the full four-category matrix (capabilities, security, commercial, support) from the same source as this docs site — they cannot drift.

Legacy plans

Workspaces on Pro ($9), Max, Team, or Privacy/Compliance/Governance SKUs are grandfathered onto Standard or Fleet entitlements. Those prices are not sold to new customers.