Pricing

Risk is introduced by change, and change is made by developers. Billing follows the rate at which new code is produced, not the volume of code at rest.

Tracks actual risk. A repository that is not modified introduces no new vulnerabilities. Per-developer pricing tracks where new risk originates, not the size of the codebase.

Industry standard. GitHub Advanced Security, Snyk, and Semgrep all bill per active developer. The unit matches how you already count seats.

You pay for seats, not usage. Inference runs under your own LLM key, so scans, penetration tests, and tokens are never metered.

Bring your own key. Connect your own LLM provider. Inference runs under your key, not ours.

Pay your provider directly. Compute is billed by your LLM provider, not by Keygraph, so usage has no ceiling.

Never metered or capped. Scans, penetration tests, and tokens are never metered, capped, or counted toward the bill.

Your keys, your provider, your data boundary. Inference runs under your own account, so code is sent only to the model provider you designate, never to a Keygraph-controlled or shared model, and no AI subprocessor sits in the path.

No Keygraph markup. You pay your provider directly at their token rates. Keygraph does not meter or resell inference, so the bill carries no usage-based line item.

Your choice of model. Claude through an Anthropic key, AWS Bedrock, or Google Vertex AI; self-hosted and enterprise add Azure OpenAI, OpenAI, and any Anthropic-compatible endpoint. Route the right model as price and quality shift, rather than being locked to one.

Tokens are only one part. Operating AI scanning is orchestration, caching, and deduplication, not raw tokens alone.

Backlog discovery. Frontier models surface buried vulnerabilities, and so can attackers and auditors, so finding them first matters. With usage uncapped under BYOK, the question is how often you can scan every repository, not whether AI can find the issues.

Forward prevention. Backlog scans cover only existing risk. New pull requests and active repositories need continuous coverage, catching fresh issues while developers still hold the context to fix them.

Active and stale repos. Active repositories drive most scanning, while stale ones still need periodic coverage for newly disclosed vulnerability classes. Keygraph scopes each so coverage does not become wasted spend.

Operational controls. Provider limits, key management, budgets, retries, and failed scans all need an owner. Keygraph runs that control plane, so BYOK never becomes another platform to operate.

From output to resolved risk. Model output still needs routing, prioritization, suppression, and fix context in the developer workflow, or token spend becomes alert volume instead of resolved risk.

A seat is a person who changed a monitored repository and still has access. Bots, read-only users, and anyone who has lost access are excluded.

Billed. Developers who authored or reviewed code in monitored private repositories in the last 90 days, and contractors who contributed and still have access.

Never billed. Bots, CI/CD, service accounts, and GitHub Apps; read-only users, product managers, auditors, executives, and dashboard-only users; anyone who has lost source-control access, including former staff; and anyone working only in public or open-source repositories.

Definitions for the terms used in your contract. Each one is used to compute the seat count.

Seat / Billable Developer. A person who contributed to a monitored private repository and still has access. Referred to as a “Billable Contributor” in the contract.

Lookback. A rolling 90 days, recomputed monthly.

Measurement date. The date on which seats are counted for invoicing, renewal, or a true-up.

Monitored repository. A private repository connected for scanning. Public, archived, and forked repositories are never counted.

Contribution. A commit, pull request, merge, or push of code, configuration, IaC, dependencies, manifests, lockfiles, or scripts.

Counting rules are applied consistently and conservatively. Each person maps to a single seat, and ambiguous cases are not double-counted.

One person, one seat. Deduplicated across email addresses, accounts, organizations, and entities, including separate contracts.

SCM identity, not commit email. Merges routed through a release bot do not drop the people who wrote or reviewed the code.

Current access required. Historical commits alone do not create a seat.

90-day rolling window. Departed contributors age off automatically at the next monthly recompute.

Per person, not per repository. A monorepo with 500 committers is billed per person.

Ambiguous cases excluded. Unresolved commits are held out of the count and counted at most once.

A single invoice line that adjusts in both directions. Seats multiplied by your rate, reconciled on a set schedule and trued up or down as your team changes.

On your invoice. A single line: active-developer seats × your rate. No usage line items.

Reconciliation. Monthly on self-service plans; quarterly on annual plans.

±15% drift band. Routine week-to-week movement is absorbed without repricing.

Trues up and down. Sustained decreases, such as layoffs, are returned as account credit at the next quarterly true-up rather than held until renewal.

Overages. Reconciled at your seat rate in arrears; service is not blocked. A block-until-upgrade option is available on request.

Budget alerts. An advance alert identifies the seats driving any projected increase. There is no hard cap by default, and the bill does not increase without notice.

The count is verifiable and disputable. Export it, flag a miscount, or run Keygraph self-hosted and report seats by attestation.

Export anytime. Includes masked identity, the repositories that count each person, last-contribution date, and current-access status.

30-day dispute window. Flag a miscount within 30 days and duplicates, bots, and removed users are corrected.

Self-hosted & air-gapped. Counted by attestation rather than telemetry. You attest to a contracted developer group and self-certify annually.

Same price, no access. Keygraph cannot reach your environment, code, or systems, and self-hosted is priced the same as cloud.