Pricing
Every security feature is free. Forever.
Decoyrail makes money when it saves you money and runs your fleet, not by holding protection hostage. Decoys, tripwires, egress policy, data detectors, the audit log, and exact spend metering are free for individuals, with no caps and no fuzzy numbers. The paid tiers cut your token bill and manage many machines.
Free
$0 one seat, forever
For every individual, on all of their own machines. Commercial use included.
- Decoy credentials with the real-secret swap
- Exfiltration tripwires, including encoded forms
- Default-deny egress policy
- Sensitive-data detectors (cards, SSNs, bank ids)
- Tamper-evident audit log with live tail
- Exact per-model token metering
Pro
$10 per seat per month
or $96 per seat per year
For anyone paying real money for API tokens. Everything in Free, plus the fixes:
- Budget soft-landing (downgrade, not dead stop)
- Prompt-cache repair and keep-alive
- Model routing by policy
- Email support
Team
$15 per seat per month
or $144 per seat per year
For the lead running agents across a group. Everything in Pro, plus:
- Admin console with policy dry-run v0.4
- Signed policy push with rollback v0.4
- Machine enrollment and seat attribution v0.4
- Fleet spend roll-up and chargeback export v0.4
- Org budgets and model rules v0.4
Enterprise
from $30 per seat per month, annual
invoice or PO
For fleets, auditors, and air gaps. Everything in Team, plus:
- MDM deployment (.pkg, Jamf, Kandji) v1
- SSO / SCIM seat management v1
- SIEM content packs (dashboards, alert rules) v0.4
- Air-gapped licensing and delivery
- Priority support with an SLA
Checkout is handled by
Lemon Squeezy, the merchant of
record. Your license file arrives by email within one business day;
decoyrail license install it and you are done.
Compare the tiers
A version tag (v0.4) marks a feature on the public roadmap that has not shipped yet. Everything untagged works today. We would rather show you the tags than sell you a checkmark.
| Free | Pro | Team | Enterprise | |
|---|---|---|---|---|
| Security Free in every tier, forever. A security product with a crippled free tier is not a security product you can trust. | ||||
| Decoy credentials with the real-secret swap | ✓ | ✓ | ✓ | ✓ |
| Exfiltration tripwires, including encoded forms | ✓ | ✓ | ✓ | ✓ |
| Default-deny egress policy | ✓ | ✓ | ✓ | ✓ |
| Sensitive-data detectors (cards, SSNs, bank ids) | ✓ | ✓ | ✓ | ✓ |
| Tamper-evident audit log with live tail | ✓ | ✓ | ✓ | ✓ |
| TLS interception with a per-device CA | ✓ | ✓ | ✓ | ✓ |
| Spend tripwire (runaway loops caught in minutes) | ✓ | ✓ | ✓ | ✓ |
| Cost The free tier measures the waste with exact numbers; the paid tiers fix it automatically. | ||||
| Exact per-model token metering | ✓ | ✓ | ✓ | ✓ |
| Monthly budget and kill switch | ✓ | ✓ | ✓ | ✓ |
| The waste report, in dollars, with causes | ✓ | ✓ | ✓ | ✓ |
| Budget soft-landing (downgrade, not dead stop) | ✓ | ✓ | ✓ | |
| Prompt-cache repair and keep-alive | ✓ | ✓ | ✓ | |
| Model routing by policy | ✓ | ✓ | ✓ | |
| Fleet One pane of glass once agents run on more machines than yours. | ||||
| Admin console with policy dry-run | ✓ v0.4 | ✓ v0.4 | ||
| Signed policy push with rollback | ✓ v0.4 | ✓ v0.4 | ||
| Machine enrollment and seat attribution | ✓ v0.4 | ✓ v0.4 | ||
| Fleet spend roll-up and chargeback export | ✓ v0.4 | ✓ v0.4 | ||
| Org budgets and model rules | ✓ v0.4 | ✓ v0.4 | ||
| Maintained agent policy packs | ✓ v0.5 | ✓ v0.5 | ||
| Deployment & compliance What a large rollout and its auditors need. | ||||
| Offline license file, no phone-home ever | ✓ | ✓ | ✓ | |
| MDM deployment (.pkg, Jamf, Kandji) | ✓ v1 | |||
| SSO / SCIM seat management | ✓ v1 | |||
| SIEM content packs (dashboards, alert rules) | ✓ v0.4 | |||
| Compliance packs (SOC 2, ISO 27001 evidence) | ✓ v0.5 | |||
| Air-gapped licensing and delivery | ✓ | |||
| Cross-provider rewrite onto committed cloud spend | ✓ v2 | |||
| Support | ||||
| Community (GitHub issues) | ✓ | ✓ | ✓ | ✓ |
| Email support | ✓ | ✓ | ✓ | |
| Priority support with an SLA | ✓ | |||
Questions
Why is every security feature free?
Because a TLS-intercepting proxy lives or dies on trust, and charging to turn protection on is a bad way to earn it. The rule that decides every tier boundary: security is never paywalled; the business is efficiency (the cost pack) and fleet management. The free tier's exact waste numbers are also, frankly, the ad for Pro.
What happens when a license expires?
You get a grace window (14 days by default) where everything keeps
working and decoyrail license status warns. After it, paid
conveniences switch off in their safe direction: soft-landing reverts to
the hard kill switch, routing stops rewriting, and you keep every
security feature, forever. An expired license can never block traffic or
weaken enforcement; that is a design invariant, not a promise.
Do endpoints phone home?
Never. The license is a signed file verified offline against keys inside the binary; there is no license server, no activation, and no telemetry. Nothing about your traffic ever flows to us. This is also why Decoyrail works fully air-gapped.
What counts as a seat?
A human. One person's seat covers all of that person's machines. Seat counts are enforced by the license terms and console warnings, not by bricking endpoints: a fleet that drifts over its count keeps running while you true it up.
How does buying work in an air-gapped environment?
Invoice or PO, and we deliver a license file you carry in alongside your policy bundle. Verification is offline by construction, so nothing about an air gap is a special case.
Can I audit the binary that intercepts my TLS?
Yes. The endpoint core is source-available under FSL-1.1-ALv2 (each release becomes Apache-2.0 after two years), so your security team can read and build the exact code that holds your keys.
How do I buy Pro?
Click Get Pro. Checkout runs through Lemon Squeezy, the merchant of
record, so your card never touches us. We then issue your offline license
file to the email you paid with, within one business day.
decoyrail license install it, and you are done: no account,
no activation, no phone-home. Team and Enterprise start with an
email.
Can I cancel?
Any time, from the link in your Lemon Squeezy receipt. The term you paid for runs out, then the product downgrades itself to the free tier, gracefully. There is nothing to uninstall and nothing held back: your vault, policy, and audit log are yours and stay fully functional.
Anything else: [email protected]