Last updated: 2026-07-18 09:34 UTC
Enterprise
Custom pricing. SSO, compliance exports, multi-region, air-gapped.
Talk to us →

Enterprise: what you get, and why pay

Enterprise is for regulated industries, multi-region deployments, and air-gapped installations. It is everything in Startup plus the capabilities that only matter at scale and under audit. Pricing is custom, self-hosted, flat. There is still no per-request or work-unit billing; the difference is capability, not throughput.

The engine is still the free engine

Every tier runs the same AGPL-3.0 detection engine, and Enterprise is no exception. FOSS is a complete single-node bot detector, and Startup already gives you Postgres, multi-domain, and a fleet. Enterprise is not sharper detection. It is the governance, identity, encryption, and topology a regulated or multi-region operator needs on top of a fleet that already works.

What Enterprise adds over Startup

Identity and provisioning

  • SAML 2.0 for the enterprise IdPs that predate OIDC.
  • SCIM 2.0 auto-provisioning: a user joins the directory group and is materialised in StyloBot; they leave and their access is revoked. No manual account management.
  • OIDC group and role claim mapping as a first-class targeting dimension.

Encryption and key management

Startup gives you TLS in transit and at-rest encryption via your Postgres and storage. Enterprise adds control at the field and key level:

  • Field-level column encryption for sensitive persisted data, not just whole-disk.
  • Redis and payload encryption across the backplane.
  • Customer-managed keys: you hold the keys, rotate them on your schedule, and revoke them. We never do.

Compliance and audit

  • Signed compliance exports: a SOC 2 pack (config changes, policy decisions, logins over any date range) and GDPR DSAR export, as signed archives.
  • End-to-end signed audit chain, so the record itself is tamper-evident.
  • Retention and legal hold: configurable, multi-year, with hold preservation for audits.

Topology and rollout

  • Multi-region mesh: pgvector read replicas per region, Redis Sentinel, cross-cluster federation via the StyloFlow mesh.
  • Staged rollout orchestrator: apply a policy to one gateway group, auto-promote on success metrics, auto-revert on failure.
  • Per-region policy overlays so a region can diverge where regulation requires it.
  • Air-gapped activation: license against a hardware fingerprint with no call-out, for disconnected environments.

Distributed pipeline

Ed25519-signed signal bundles across chained gateways, trust-bundle node identity, per-hop layered action policies, and the Pipeline tab with a forgery log.

Who it is for

Finance, healthcare, and government replacing HUMAN, Akamai, or Kasada at a fraction of the cost, because you host the stack yourself and we never bill your traffic. Also any operator who needs SAML, SCIM, customer-managed keys, signed compliance exports, or a genuine multi-region topology.

Get started

Enterprise deployments start from the same building blocks:

Pricing and scope are bespoke. Talk to us and we will size it to your estate.