Start free. Pay as you scale.
Every plan includes unlimited agents, services, and seats. Plans differ by authorization checks per month, environments, audit retention, where the decision engine runs, and support. Annual billing saves 20%.
Enforce in one environment with seven days of audit history.
Three environments, thirty days of audit history, and email support.
Unlimited environments, the option to self-host the decision engine, log forwarding, SSO, and a 99.9% uptime target.
Run the whole platform in your own environment — fully on-prem or in your private cloud.
| Free | Core | Pro | Enterprise | |
|---|---|---|---|---|
| Price | $0 | $199/mo$159.20/mo · $1,910.40/yr | $599/mo$479.20/mo · $5,750.40/yr | Custom |
| Audit retention | 7 days | 30 days | 1 year | Custom |
| Environments | 1 | 3 | Unlimited | Unlimited |
| Decision engine (PDP) | ||||
| Shared | ✓ | ✓ | ✓ | ✓ |
| Authorization checks per month (shared) | 1M | 25M | 100M | Custom |
| Additional checks | Soft cap | $8 / 1M | $6 / 1M | Custom |
| Cloud-hosted add-on | — | From $0.15/hr | From $0.15/hr | Custom |
| Multi-region cloud-hosted | — | — | ✓ | ✓ |
| Self-hosted | — | — | ✓ | ✓ |
| Enforcement | ✓ | ✓ | ✓ | ✓ |
| Agents, services, seats | Unlimited | Unlimited | Unlimited | Unlimited |
| Log export / forwarding | — | — | ✓ | ✓ |
| SSO | — | — | ✓ | ✓ |
| SLA | — | — | 99.9% target | Contractual |
| Support | Email, 7-day | Email, 3-day | Priority | Dedicated |
Add-on: cloud-hosted decision engine
A dedicated decision engine that ZStrike hosts for you, in three instance sizes, billed by the hour. Available on Core and Pro. On Pro, engines can run in more than one region.
Pricing questions.
Do you charge per user or per agent?
No. Every plan includes unlimited agents, services, and seats. Each plan includes a monthly number of authorization checks on the shared engine: 1M on Free, 25M on Core, and 100M on Pro.
What counts as an authorization check?
Each authorization request that your service or agent sends to the decision engine counts as one check. Allowed and denied requests both count.
What happens when a plan goes over its included checks?
Free has a soft cap of 1M checks a month: checks keep working if you pass it, and we contact you about moving to Core. Core and Pro have no cap: each additional 1M checks costs $8 on Core and $6 on Pro, about the same rate you pay for the included checks.
How are tool calls through Wicket billed?
Wicket, our MCP gateway, has its own plans. Tool calls that go through Wicket are billed on your Wicket plan and do not count against your ZStrike authorization checks.
How does annual billing work?
Annual billing saves 20% on Core and Pro. Core is $1,910.40 per year and Pro is $5,750.40 per year.
Where does the decision engine run on each plan?
The decision engine comes in three versions: shared, cloud-hosted, and self-hosted. Every plan includes the shared engine at no extra cost, and Free uses the shared engine only. A cloud-hosted engine — a dedicated engine that ZStrike hosts for you — is a paid add-on on Core and Pro, in three instance sizes: Small, Medium, and Large. On Pro, cloud-hosted engines can run in more than one region, and you can also self-host the engine. On Enterprise, the whole platform runs in your own environment — on-prem or your private cloud.
Is the 99.9% on Pro a contractual SLA?
No. Pro runs to a 99.9% uptime target. A contractual SLA is part of Enterprise.
How do I get started?
Send us a message. Every plan starts the same way: bring one real permission check, and we reply within one business day.
Not sure which plan fits? Bring us one permission check.
An agent tool call you need denied, a permission check nobody can explain — we model it in Cedar, live.