Pricing
Four plans, and TLS on all of them
Charging for HTTPS is the thing Cloudflare got right and everyone else took a decade to copy. Certificates are free on every plan, including the free one.
free
A personal site, or trying the product on something real.
$0
Start on free- ✓Certificates, DNS and caching in full
- ✓HTTP/3 and DNSSEC
- ✓1% of requests traced
- ✓Community support
pro
popularA small team running production traffic.
$20/ month
Start on pro- ✓Purge by tag and serve-stale
- ✓Bot management and origin shield
- ✓20% of requests traced, kept a week
- ✓Per-minute analytics for 30 days
business
A company with a compliance conversation.
$200/ month
Start on business- ✓Mutual TLS to the origin
- ✓Client-certificate firewall rules
- ✓Every request traceable, kept a month
- ✓90 days of analytics
enterprise
Contractual uptime, a named contact, and terms in writing.
Talk to us
Talk to us- ✓No countable ceilings
- ✓Per-second analytics, kept a year
- ✓Traces kept 90 days
- ✓An uptime SLA in writing
Ceilings below are read live from the control plane that enforces them.
Every ceiling
Not a summary. These are the numbers the config builder copies into each snapshot, so they are the numbers the edge actually enforces on a request.
| Limit | free | pro | business | enterprise |
|---|---|---|---|---|
| Sites | 3 | 25 | 150 | Unlimited |
| DNS records per site | 200 | 3,500 | 10,000 | Unlimited |
| Firewall rules per siteYour own rules. Our managed rulesets do not count against this. | 5 | 50 | 250 | Unlimited |
| Rate-limit rulesThe counter is not implemented yet; a rule reports “did not run”. | 1 | 20 | 100 | Unlimited |
| Bulk redirect entries | 20 | 10,000 | 100,000 | Unlimited |
| Origin pools | 1 | 10 | 50 | Unlimited |
| Custom certificatesCertificates we issue by ACME are unlimited on every plan. | 0 | 5 | 25 | Unlimited |
| Trace sampling ceilingThe most you may ask for per site. 100% means every request. | 1% | 20% | 100% | 100% |
| Trace retention | 6 hours | 7 days | 30 days | 3 months |
| Analytics retention | 3 days | 30 days | 90 days | 365 days |
| Finest analytics bucket | Per hour | Per 1 min | Per 1 min | Per second |
| Functions per siteThe runtime is not implemented yet. | 1 | 15 | 50 | Unlimited |
| Function CPU per invocation | 10 ms | 50 ms | 200 ms | 1000 ms |
| Function size | 1 MB | 5 MB | 20 MB | 50 MB |
| Purge by tag | — | ✓ | ✓ | ✓ |
| Serve stale while revalidating | — | ✓ | ✓ | ✓ |
| HTTP/3Advertised per site; QUIC is not served yet. | ✓ | ✓ | ✓ | ✓ |
| DNSSEC | ✓ | ✓ | ✓ | ✓ |
| Mutual TLS to the origin | — | — | ✓ | ✓ |
| Bot management | — | ✓ | ✓ | ✓ |
| Origin shield | — | ✓ | ✓ | ✓ |
| AI analyst | — | ✓ | ✓ | ✓ |
| BandwidthUnmetered today on every plan. | Unmetered | Unmetered | Unmetered | Unmetered |
“Unlimited” means no ceiling is checked, not that capacity is infinite. Bandwidth and request volume are unmetered on every plan today; if that changes, it will appear in this table before it appears on a bill.
Questions people ask
Do I need a separate account from guardyn.dev?
No. It is one account, not a single-sign-on integration between two. The same email and password signs you into both, and the same workspace and role apply.
What happens when I hit a ceiling?
The request that would exceed it is refused with a message naming the resource, the count and the plan. Nothing already configured stops working, and nothing is silently dropped.
Why is trace sampling limited on the free plan?
A trace is a stored record of one request, and storing every one is the expensive part of the product. Free traces 1% of requests; enterprise traces all of them. You can raise it within your plan’s ceiling per zone.
Can I self-host it?
Not today. The platform runs on our infrastructure only, which is how the edge network, the certificate issuance and the anycast addresses stay one thing we operate rather than a configuration you have to get right. If running it in your own racks is a requirement, talk to us — it is not something we offer yet.
Is there a trial of the paid tiers?
A platform operator can move any zone to any plan, which is how a trial is granted today. There is no self-serve trial yet, and no card is taken for the free plan.