Priced per person
under governance.

The free plan governs models you host yourself — Ollama, LM Studio, llama.cpp, vLLM, anything speaking the OpenAI-compatible API on your own hardware — for up to five people, with no expiry. You get real capture, redaction before anything is stored, and the same tamper-evident ledger. A half-working audit trail would be worse than none.

The limits are scope and seats, not time. It does not cover ChatGPT, Claude, Gemini, coding agents or your server-side gateway, and it leaves out external anchoring, signed reports, SSO and support.

Local inference is the surface where nothing leaves your network in the first place, so it is the one you can put under governance without a procurement conversation. That makes it a genuine product for a small team running their own models, and an honest way to see the whole pipeline — capture, redaction, ledger, records — before you weigh governing the tools that do send data to somebody else.

Start with SaaS if you need evidence this quarter and have no infrastructure to spare. Pick bring your own cloud when procurement requires the data to stay in a named account and region, but your team has no capacity to run another service. Pick on-premises when the answer to “can a third party hold this” is no, or when the deployment has to work with no outbound connection at all. The software is identical in each. What changes is who operates it and where the data sits.

Anyone the collectors resolved to an identity during the billing month. Someone who never touched an AI tool does not count, and a person is counted once no matter how many devices, collectors or AI tools they used. Service accounts and pipelines posting through the compliance API are not billed per person.

Only on the SaaS pathway, and even then we never read it, train on it or sell it. On-premises and bring-your-own-cloud keep captured content entirely on infrastructure you own, where we could not reach it if you asked us to. See deployment for exactly where data lives in each. On all three, on-device redaction strips detected secrets before anything leaves the machine that captured it.

Yes, and people do. A common route is starting on SaaS to prove the value, then moving into their own cloud once procurement catches up. The ledger is a PostgreSQL database and a documented event format, so migrating is an export and an import. The hash chain verifies identically on the other side.

The ledger is yours. On-premises and in your own cloud it never leaves your possession in the first place. Where we host it, we export the complete ledger to you before anything is deleted. Nothing is withheld or held hostage.

Probably, and you should get it. Recording what staff type is employee monitoring. That carries notice obligations, and often consent obligations, which vary by jurisdiction. Works councils have a formal say in parts of Europe. Two-party consent rules apply elsewhere. Screen capture raises the bar further, which is why it is off by default. We would rather you deploy this correctly than quickly.

SaaS runs the same day. Bring your own cloud takes about a week, most of it waiting on access to your account. On-premises takes as long as your change process takes. In every case the real work is collector coverage. The browser extension goes out by policy in a day or two. Server-side gateways follow your release cycle. Most teams have useful evidence inside a week.

Yes, and that is rather the point. The signed report contains the head hash and the event count. The hashing uses a documented canonical form, so an auditor can re-implement verification and re-check the chain against your live database without trusting our code, or our word for it.