Pricing
Five plans. No surprises.
Every plan includes HMAC-signed responses, AES-256 encrypted rule storage, and sub-ms decisions. You're paying for volume and concurrent rules — never for the security itself.
Free
Drop Acrossed in front of one app and try it.
$0forever
Start free- 10,000 decisions / month
- Up to 5 active rules
- Default <slug>.acrsd.dev subdomain with TLS
- AES-256-GCM encrypted rule storage
- HMAC-SHA256 signed responses
- JS, Python, and Go SDKs
Most popular
Pro
For production apps with real traffic.
$19per month
Upgrade to Pro- 1,000,000 decisions / month
- Up to 100 active rules
- Up to 3 custom domains with on-demand TLS
- Country-level geo blocking
- Per-IP rate limiting at engine speed
- Pay-as-you-go: $0.10 / extra 1K
Scale
SaaS, marketplaces, and high-traffic APIs.
$99per month
Upgrade to Scale- 10,000,000 decisions / month
- Up to 500 active rules
- Up to 10 custom domains with on-demand TLS
- Country-level geo blocking
- Per-IP rate limiting at engine speed
- Pay-as-you-go: $0.08 / extra 1K
Business
For teams that need audit logs and multi-region.
$299per month
Upgrade to Business- 50,000,000 decisions / month
- Up to 2,500 active rules
- Up to 25 custom domains with on-demand TLS
- Audit log export (CSV, JSON)
- Multi-region routing (US + EU)
- Pay-as-you-go: $0.05 / extra 1K
- Priority chat support
EnterpriseCustom
Custom volume, custom contract, direct line to the maintainer. · Unlimited decisions (custom-priced) · Direct Slack channel with the maintainer · Custom contract & invoicing terms
Pay-as-you-go is on by default for Pro, Scale, and Business.
Outgrew your monthly cap? We keep deciding — overage is billed at the end of the cycle at your plan's per-1K rate. Toggle off in your dashboard if you'd rather hard-cap.
Pricing FAQ
- What happens when I exceed my monthly decision cap?
- Our /check endpoint returns HTTP 402 with an upgrade link. Our SDK treats that as a deny by default so you don't accidentally let traffic through unmetered. You can flip a flag to allow on quota-exceeded if you'd rather.
- Is the encryption real, or marketing?
- Real. Rules and signing secrets are encrypted with AES-256-GCM before they're written to Postgres. Decryption happens once at API process startup; the plaintext lives in process memory and is never written to disk or logged.
- Do you store my user traffic?
- No. The /check call carries a small fingerprint — IP, method, path, a handful of headers you choose. We evaluate the rules and forget. We persist counters (decisions/month, allow/deny) for billing and your dashboard, but never the request body.
- Why charge for custom domains?
- Each custom domain consumes a TLS certificate slot via Let's Encrypt and a small amount of edge capacity. We cap them per plan to keep the platform cheap for everyone.
- Can I downgrade?
- Yes. Downgrades take effect at the end of your current billing period. Your monthly decision counter does not reset on downgrade.
- Do you offer a free trial of Pro?
- No formal trial. Free gives you the full security stack (HMAC signing, AES-256 encryption, all three SDKs) at 10K decisions/month so you can wire it into a real app and prove it out. When you need custom domains, country-level geo blocking, or per-IP rate limiting, that's Pro.