Skip to main content
For current pricing and to subscribe, see the canonical pricing page. This page documents the technical limits, quotas, and usage rules for each plan.

​
Plans

Every Request is billed per call plus per billed token, at one list price, and every plan’s fee is usage credit at that list price. Free, Developer and Enterprise run the same detection engine, both LLM judges included, and the same full detector set, including data exfiltration, toxicity, fraud, secret keys, malware and URL filtering. The plans differ in credit, projects, retention and support, not in what is detected. See Feature Comparison.

​
List prices

Every plan, Free included, runs the full engine at this price: no plan gets a cut-down version, and a lower price will come only from making the engine cheaper to run. A Request’s cost is its calls times the per-call price plus its billed tokens times the per-token price, and the Guard API reports both on every response. Free’s $5 of usage is about 4,500 calls before tokens.

Free

$0/month
  • $5 of usage a month at list prices
  • 1 project, 1 API key
  • Full detector set: prompt injection, PII, exfiltration, toxicity, fraud, secrets, malware, URLs
  • 24-hour log retention
  • Community support

Developer

$20/month, billed monthly
  • $20 of usage credit a month: the whole fee, at list prices
  • Then list prices up to your spend cap ($100 by default, up to $10,000)
  • Unlimited projects and API keys
  • Full detector set, custom security policies
  • Advanced analytics, email and webhook alerts
  • 30-day log retention
  • Priority support (24-hour response)

​
Shadow AI

The plans above protect the AI features you build. Shadow AI — the browser extension and macOS/Windows desktop agent that stop your employees leaking data into public AI tools — is a distinct product you can use on its own or alongside the gateway.
  • Included with every plan: personal Shadow AI protects up to three of your own devices, metered against your existing request quota — no separate bill. Linking a fourth is refused until you remove one; covering an organisation’s devices is what a Team plan is for. A device that is linked stays protected: no scan is ever refused for a plan or device reason.
  • On a Team plan: the fleet layer — MDM enforcement, an org-wide “required” policy, multi-device enrollment, and a per-employee usage rollup. Fleet is sold by the per-seat plans and by nothing else, so a gateway plan alone does not grant it however large.
  • Standalone, per seat: for rolling out to a whole team (or using Shadow AI exclusively), priced per seat and sized to your fleet — cloud, hybrid self-hosted, or air-gapped.
  • A seat starts when a device enrols, not when you invite someone. Invite the whole company for nothing; you pay for the machines that are actually being protected. A seat covers one person on every device they sign in on, so one person’s laptop and desktop are one seat. A device enrolled without anyone signing in — an MDM rollout, say — counts on its own, because nothing yet says whose it is. To fold it into its owner’s seat, have them connect it from the desktop app and then revoke the original enrolment: connecting enrols the machine afresh under their account rather than re-labelling the existing entry.
Rolling out to a team? Shadow Team starts with a 30-day trial — the only plan with one, and long enough to produce a full monthly report of what your staff nearly sent. Book a pilot or see how it works and deployment modes.

​
Enterprise

Enterprise adds SSO, compliance controls, and custom infrastructure options. Organizations with role-based access control (Owner, Admin, Member, Viewer), per-project roles, and GDPR data export and deletion are on every plan, Free included.

SSO

Single sign-on via OIDC (Okta, Microsoft Entra ID, Google Workspace, and more), set up with our team on the hosted service. SAML is available on self-hosted installs.

Audit Logs and Compliance

Persistent audit trail with integrity hash chaining.

Security Controls

IP allowlisting and custom log retention.

Custom Limits

Custom monthly request quotas and retention periods per organization.

Dedicated Support

A dedicated account manager, and any uptime or response commitment written into your signed agreement.
Contact sales@promptguard.co for Enterprise pricing.

​
Compliance & Governance

Evaluating PromptGuard for your organization? Here’s where it stands:

Certifications

SOC 2 Type II and ISO 27001: not started, no audit scheduled (today: source access under NDA + verifiable self-host) · GDPR / CCPA supported (DPA available). See Compliance.

Standards alignment

EU AI Act (Articles 9–15) and ISO/IEC 42001 — technical controls mapped.

Audit & data handling

Tamper-evident audit logs, masked content previews that zero retention turns off, plan-based retention. Self-host to keep data in your infrastructure.

Full details

Read the complete Compliance & Security page.
Need a specific certification, a DPA, or a security questionnaire completed? Contact sales@promptguard.co.

​
Feature Comparison

Shadow Team also includes SSO and custom policies, and pools $8 of usage a Seat a month. Shadow Enterprise adds audit logs and Hybrid self-hosting. Shadow Business is retired: its subscribers keep it until they change plan. No plan includes an uptime commitment: one exists only if it is written into an agreement you sign with PromptGuard (Reliability & Status).

​
Integration Methods

All plans include every integration method:

​
Rate Limits

​
Monthly usage credit

Usage credit is tracked per account and resets each month; unused credit does not roll over: See Reaching your limit for how to avoid an outage when you hit a quota.

​
Per-Minute Rate Limits

Per-account requests-per-minute limits:

​
Infrastructure Anti-Abuse Limiting

Separately from your plan limits, a Cloud Armor layer enforces a per-IP request limit at the network edge:
  • Applies to all plans, independent of the per-account limits above
  • Health-check and CORS preflight paths are exempt
  • Exists to block abusive traffic, not to cap normal usage

​
Reaching your limit

PromptGuard is designed so you never lose protection at a critical moment. As you approach the end of your monthly credit you are warned twice over:
  • By email, at 80%, 90% and 100%. The email goes to whoever holds the plan your requests are counted against, and follows their Email Alerts setting under Settings → Notifications: All Alerts (the default) sends all three, Critical Only sends only the 100% email, and Disabled sends none. Each threshold’s email goes once per monthly usage period.
  • In the dashboard, from 90%. On a paid plan a banner appears at 90% used, and you can dismiss it for the session. At 100%, if your requests are now refused, the banner turns red, stays until you act, and offers the ways out your plan has: upgrade, or raise your spend cap. If your overage is metered instead (Developer, by default), it says so and can still be dismissed. There is no quota banner on Free or Enterprise. If you are acting in an Organization whose plan someone else holds, you see a dismissible notice from 90% that names whose allowance it is.
On Free, requests past the $5 credit return `429 Too Many Requests` until you upgrade: Free has no payment method to bill. On **Developer**, traffic keeps flowing past the $20 credit at the same list prices, up to a spend cap that defaults to $100. Past the cap, requests return `429` until you raise it in **Billing → Spending**, up to $10,000; set it to $0 and Developer stops at its credit instead. Enterprise is contractually uncapped. Overage and pay-as-you-go are available on monthly billing; annual plans stop at their monthly allowance. On annual billing, requests past the credit return 429 until it resets the next month. These rules apply to every counted request (see How Usage Is Calculated), whichever route it arrives on. The one exception is Shadow AI: scans from the desktop agent count against the same quota but are never refused for it, because a data-loss control that stops at a billing threshold would either block your staff’s work or let content leave unscanned.
On Developer, overage is on by default with a $100 spend cap, so a traffic spike never takes you offline; the 429 you get at the cap links to Billing → Spending. On Free, the 429 links to the upgrade instead.
Set a spend cap you’re comfortable with, and watch Billing → Usage, which shows the month’s credit used and remaining.

​
How Usage Is Calculated

One request = one API call to any of these routes, however long its content. Each call’s billed tokens are also recorded: the tokens of the content PromptGuard scans, counted with OpenAI’s published cl100k_base tokenizer, whatever model your call goes to. A security-testing run puts each attack in the test set through the full detection engine, and most attacks as several variations, so it counts one request for every prompt it can send, with that prompt’s billed tokens. The prompts are fixed before the run starts. A run from the dashboard counts the same, against the organization it runs in. Listing the tests does not count. Each scanned piece is counted on its own and the counts are added, so you can reproduce the number with tiktoken. The Guard API’s response reports both: requests_counted (1 for a scan) and billed_tokens. Both are charged for. A Request spends your credit, and past it is billed, at its calls times the per-call list price plus its billed tokens times the per-token list price. On Developer your invoice shows calls and tokens at list price, then your $20 credit. A Shadow AI Device’s scan counts tokens only for what it scans: the person’s current turn, the app’s instructions, and any tool definition not already checked. The earlier conversation an app resends with every request is not scanned again, so its tokens are not counted again. POST /api/v1/agent/validate-tool checks a tool call against your agent policy without running the detection pipeline, and does not count. Usage is independent of the model used and of the response’s length.
PromptGuard uses a pass-through model: you provide your own LLM API keys (OpenAI, Anthropic, etc.), and PromptGuard only charges for security services. LLM costs go directly to your provider.

​
FAQ

Yes. Upgrade or downgrade at any time. Upgrades take effect immediately; downgrades at the next billing cycle.
You won’t be locked out without a choice. On Free, requests past the credit return 429 Too Many Requests until you upgrade. Developer keeps running past its credit at list prices to your spend cap (default $100), and you receive alerts; past the cap requests return 429 until you raise it. Enterprise is contractually uncapped. See Reaching your limit.
Requests keep being processed and are billed at the same list prices, per call and per billed token, at the end of the cycle, up to your spend cap: $100 by default, which you can raise to $10,000, or set to $0 to stop at the credit. It isn’t available on Free. Overage is available on monthly billing; annual plans stop at their monthly allowance.
Shadow Team starts with a 30-day trial. The gateway plans have none: the Free tier ($5 of usage a month) runs the full detector set with the same ML and LLM engine as the paid tiers, so you can evaluate exactly what you would buy before upgrading.
Self-hosted deployment is available on Enterprise, and Hybrid self-hosting is also included in Shadow Enterprise. Contact sales@promptguard.co for details.
Yes. Every API call counts, including retries and blocked requests.
Last modified on November 5, 2026