Skip to content

Honest pricing. No usage cliff.

Pricing

Same data on every tier. The only thing that scales is throughput.

Billed monthly in USD via Paddle (Merchant of Record). Cancel anytime.

Free

For solo learners.

$0

Free forever

  • 5 CVE / week (web console only)
  • 10-CVE bulk CSV cap (sync; subject to 5/week allowance)
  • Telegram channel gate required
  • 1 seat
  • No API access
  • No webhooks
Sign up free
Most popular

Pro

For individual operators.

$99/mo

Approx. ~17 calls/min sustained

  • API access
  • 1,000 calls / day
  • 3 webhooks
  • 100-CVE bulk CSV (sync)
  • Verdict history (Pro+)
  • 1 seat
  • Email support
Start Pro

Team

For security teams.

$499/mo

  • 3 seats, org-shared quota
  • 150,000 calls / day (shared)
  • Unlimited-by-plan webhooks*
  • 10,000-CVE bulk CSV (async)
  • API bulk endpoint up to 500 CVEs/call
  • Priority email support
Start Team

Enterprise

For MSSPs and large SOCs.

$1,499/mo

  • 10 seats, per-seat quota
  • 200,000 calls / day per seat
  • Unlimited-by-plan webhooks*
  • 100,000-CVE bulk CSV (async)
  • API bulk endpoint up to 1,000 CVEs/call
  • SLA available on request
Contact sales

Compare every feature

Everything that changes by tier — quotas, rate limits, sources, security, and support.

Feature Free Pro Team Enterprise
Pricing & access
Monthly price $0 $99 $499 $1,499
REST API access — ✓ ✓ ✓
Web console 5 CVE / week Unlimited Unlimited Unlimited
Verdict history — ✓ ✓ ✓
Quotas & rate limits
Daily quota 20 1,000 150,000 200,000 per seat
Quota model Per user Per user Org-shared Per seat
Rate limit 60 / min 1,000 / min 3,000 / min 5,000 / min per seat
Bulk endpoint (per call) — — Up to 500 CVEs Up to 1,000 CVEs
CSV upload (per file) 10 (sync) 100 (sync) 10,000 (async) 100,000 (async)
Team features
Seats included 1 1 3 10
Webhooks — 3 Unlimited by plan* Unlimited by plan*
Role-based seats — — Owner / member Owner / member
Email invitations — — ✓ ✓
Signal sources
CISA KEV ✓ ✓ ✓ ✓
FIRST.org EPSS ✓ ✓ ✓ ✓
Metasploit modules ✓ ✓ ✓ ✓
Nuclei templates ✓ ✓ ✓ ✓
ExploitDB ✓ ✓ ✓ ✓
Curated GitHub PoCs ✓ ✓ ✓ ✓
Security & compliance
Single active session ✓ ✓ ✓ (per seat) ✓ (per seat)
EU-hosted primary database ✓ ✓ ✓ ✓
Admin audit log — — ✓ ✓
DPA available — — On request ✓
Support
Channel Best-effort Email Priority email Priority email
First-response target Best effort Within 2 business days Within 1 business day Within 4 business hours, business days

* Team and Enterprise have no lower commercial webhook-count limit. Fair-use security controls allow up to 1,000 active or paused endpoints per owner, three destinations per hostname, 10 create or secret-rotation requests per user per minute, and 100 endpoint-creation attempts per owner per rolling 24 hours. Rejected creation attempts count; secret rotations do not. See the webhook guide.

CSV batches are all-or-nothing. Free files may contain up to 10 data rows, but the unique valid CVEs must fit the user's remaining five-per-week web allowance. Pro returns up to 100 results synchronously; Team and Enterprise process larger files asynchronously, send email and console notifications, and retain private result downloads for 30 days. See the bulk analysis guide.

Need more than 10 seats? Contact sales: [email protected]

FAQ

What is a "verdict"?
A single, actionable label per CVE — one of ACTIVELY_EXPLOITED, WEAPONIZED, POC_AVAILABLE, THEORETICAL, or NOT_APPLICABLE — derived deterministically from public threat-intel signals (CISA KEV, EPSS, Metasploit, Nuclei, ExploitDB, GitHub PoCs). Every verdict ships with a 0–100 confidence score and the list of sources used.
Is there a free tier?
Yes — 5 CVE lookups per week through the web console, no credit card. The Telegram gate (join the channel and send a 6-character code to the bot) keeps abuse low and is free.
How does shared quota work on the Team plan?
All API calls from any of the 3 seats count against one org-wide pool of 150,000 / day. The counter resets at UTC midnight. Enterprise is different — each seat has its own 200,000 / day pool, so a 10-seat Enterprise org has 2,000,000 / day in aggregate without any one seat being able to starve another.
Can I change my plan anytime?
Yes. Upgrades take effect immediately and are prorated. Downgrades take effect at the end of the current billing period — you keep the higher quota until then. Cancellations follow the same rule.
Do unused requests roll over to next month?
No. Quotas reset daily at UTC midnight; nothing accumulates. We size each tier so a typical workload stays well under the ceiling, not so a heavy one barely fits.
What happens when I hit my quota?
The API returns 429 Too Many Requests with rate-limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset). No surprise overage fees, no auto-upgrade. Quota resumes at UTC midnight; if you need more capacity, upgrade from the dashboard.
How do bulk CSV limits and quota interact?
The file limit is the largest batch shape accepted by your plan; quota is the number of lookups you still have available. A batch must fit both. We reject the complete request before processing if it exceeds either limit, so there is no ambiguous partial result or automatic overage charge. To protect shared capacity, CSV creation across sync and async modes is also limited to 100 persisted upload attempts per rolling 24 hours: per user on Free, Pro, and Enterprise, and shared by a Team organization. Idempotent retries do not consume another slot; completed, cancelled, failed, and quota-rejected attempts remain in the window. A separate, non-refundable creation budget counts unique CVEs submitted to asynchronous jobs in the same rolling window: 150,000 per Team organization and 200,000 per Enterprise seat. Quota-rejected, cancelled, and failed attempts remain in this abuse-control budget, although normal lookup-quota refunds still apply. Exact idempotent retries do not consume this creation budget.
Are there setup fees?
None. The price you see is the only price — Paddle handles global tax and VAT inclusive of the listed amount.
Do you offer educational or non-profit discounts?
Contact us for educational and non-profit pricing — case-by-case basis. Email [email protected] with proof of affiliation.
How is CVE data sourced and licensed?
All signals come from public, commercially-usable feeds: CISA KEV (public domain), NVD (US government work), FIRST.org EPSS (CC BY 4.0), ExploitDB, Rapid7's Metasploit Framework (BSD-3), ProjectDiscovery's Nuclei templates (MIT), and curated GitHub PoC indexes (we link out, never redistribute exploit code). Attribution and license details ship in every response's meta.sources field.
Do paid tiers auto-renew?
Monthly. Cancel any time from your dashboard — we don't dark-pattern the cancel button. See the Refund Policy for the 14-day money-back guarantee.
Where is data hosted?
Primary account and job metadata is hosted on Hetzner in Frankfurt, Germany (European Union). Cloudflare's global edge protects the API and its private R2 service stores temporary bulk objects. See the Privacy Policy for international-transfer details.
Who handles billing and tax?
Paddle.com Market Limited acts as Merchant of Record. They handle global tax collection (VAT, GST, sales tax), receipts, dunning, and chargebacks. We never see your card number.
Can I share my Pro plan with my team?
No. Pro is single-seat by design and the web console enforces single active session per user — a new login revokes the prior session. For multi-person use, choose Team (3 seats) or Enterprise (10 seats).
Do you offer refunds?
Yes — 14-day money-back guarantee for first-time subscribers. Full details on the Refund Policy.