Pricing
Start free. Scale when ready.
Both tiers have the full security features: policy on every call, signed requests and a hash-chained audit trail.
Included in both
The full security features, on every plan.
- Policy on every call, in MAPL
- Signed requests and a hash-chained audit trail
- Approvals routed to the right person
- Plug-and-play identity: Okta, Entra ID, Auth0, Google, Keycloak
- OTEL export to your observability stack
- Collaboration in the console
- Claude Code and Codex
- The SDK and SecureAI adapters
- Policy Assistant
Developer
Free
For building and evaluating
- 100K policy checks free per month
- 3 console users
- 7-day log retention, then best effort
- SaaS control plane
- Docs and community support
Enterprise
Talk to us
Platform license plus policy checks
- Policy checks at the volume you need
- Unlimited console users, configurable retention
- Your VPC, on-prem (containerized) or hybrid
- SAML, SCIM and more than one identity provider
- Your own keys: PKI, HSM, cloud KMS or Vault
- Git sync, restrictive mode, custom log backends
- Dedicated support with an SLA; services and forward-deployed engineers
Compare the plans.
| Feature | Developer | Enterprise |
|---|---|---|
| Usage | ||
| Policy checks a month | 100K free per month | Platform license plus per million checks |
| Agents and identities | Unlimited | Unlimited |
| Console users | 3 | Unlimited |
| Log retention | 7 days, then best effort | Configurable, 90 days or more |
| Collaboration in the console | ||
| Coding assistants (Claude Code, Codex) | ||
| Deployment | ||
| Where the control plane runs | SaaS | SaaS, your VPC, on-prem (containerized) or hybrid |
| Data residency and log rotation | System managed | Configurable |
| Identity | ||
| Identity Bridge (OIDC) | ||
| More than one identity provider | – | |
| SAML and SCIM | – | |
| Models | ||
| Policy Assistant models | Anthropic, OpenAI | Anthropic, OpenAI and your own models |
| LLM | Your own key | Your own key, configurable |
| Model selection | – | Configurable |
| Per-user LLM limits | – | |
| Policy | ||
| Console and Policy Assistant | ||
| Git sync and bulk upload | – | |
| Restrictive mode | – | |
| Keys and evidence | ||
| Hash-chained, signed audit logs | ||
| OTEL export to your observability stack | ||
| Signing algorithms (RSA, ECDSA, RSA-PSS) | System managed | Configurable |
| HSM, cloud KMS or HashiCorp Vault | – | |
| Bring your own PKI | – | |
| Log storage | Standard | Tiered, or CloudWatch, Elasticsearch, Splunk |
| Support | ||
| Docs and community | ||
| Dedicated, with an SLA | – | |
| Services and forward-deployed engineers | – | Available |
DeveloperFree
Usage
- Policy checks a month
- 100K free per month
- Agents and identities
- Unlimited
- Console users
- 3
- Log retention
- 7 days, then best effort
- Collaboration in the console
- Coding assistants (Claude Code, Codex)
Deployment
- Where the control plane runs
- SaaS
- Data residency and log rotation
- System managed
Identity
- Identity Bridge (OIDC)
Models
- Policy Assistant models
- Anthropic, OpenAI
- LLM
- Your own key
Policy
- Console and Policy Assistant
Keys and evidence
- Hash-chained, signed audit logs
- OTEL export to your observability stack
- Signing algorithms (RSA, ECDSA, RSA-PSS)
- System managed
- Log storage
- Standard
Support
- Docs and community
EnterpriseTalk to us
Usage
- Policy checks a month
- Platform license plus per million checks
- Agents and identities
- Unlimited
- Console users
- Unlimited
- Log retention
- Configurable, 90 days or more
- Collaboration in the console
- Coding assistants (Claude Code, Codex)
Deployment
- Where the control plane runs
- SaaS, your VPC, on-prem (containerized) or hybrid
- Data residency and log rotation
- Configurable
Identity
- Identity Bridge (OIDC)
- More than one identity provider
- SAML and SCIM
Models
- Policy Assistant models
- Anthropic, OpenAI and your own models
- LLM
- Your own key, configurable
- Model selection
- Configurable
- Per-user LLM limits
Policy
- Console and Policy Assistant
- Git sync and bulk upload
- Restrictive mode
Keys and evidence
- Hash-chained, signed audit logs
- OTEL export to your observability stack
- Signing algorithms (RSA, ECDSA, RSA-PSS)
- Configurable
- HSM, cloud KMS or HashiCorp Vault
- Bring your own PKI
- Log storage
- Tiered, or CloudWatch, Elasticsearch, Splunk
Support
- Docs and community
- Dedicated, with an SLA
- Services and forward-deployed engineers
- Available
Custom deployment design and installation are available for enterprise and highly regulated environments.
Talk to usQuestions, answered.
Where do I start?
The Developer tier. It is free and has the full security features: policy enforcement, signing and the hash-chained audit trail. Move to Enterprise when you need more scale, more people or a different deployment.
What counts as a policy check?
One governed action. Each tool call, model call or agent-to-agent call that MACAW decides counts once, however many policies are fetched and applied to it. Allowed, denied or held for approval, it is one check.
How is Enterprise priced?
A monthly platform license plus a price per million policy checks. Support, services and forward-deployed engineers are priced separately. Talk to us for a quote.
What is the difference between console users and agents?
Agents are your workloads, unlimited on both tiers: people, long-running services or short-lived apps. Console users run MACAW itself: they set policy, review logs and approve requests. Usually security, platform or compliance teams, not every developer.
How do developers join?
An admin mints an API key in the console (Settings, Workspace, API Keys). Developers run the installer with it: MACAW_API_KEY=mw_… macaw-ai install. They need a key, not a console seat.
What is Policy Assistant?
Describe a policy in plain words and Policy Assistant writes the MAPL policy, or explains an existing one back to you. It is on both tiers.
How does using my own LLM key work?
You provide your own Anthropic or OpenAI key. Prompts go straight to your provider and we never see them. You keep control of cost and rate limits.
How does identity work across a workflow?
MACAW keeps the chain as identity passes along. When Alice calls a tool through OpenAI, policy sees Alice (user), the tool (app) and OpenAI (service), and enforces at every step.
What happens if I go over a limit?
We tell you as you approach it. Enforcement never stops.
Where is my data stored?
The hosted control plane runs on AWS and stores only metadata: policies, audit logs and the agent registry. Prompts and tool data stay in your environment.
Which cloud regions are available?
AWS US-West today, with more planned. Tell us what you need at support@macawsecurity.com and it helps us decide which comes next.
How does data retention work?
Developer: 7 days, then best effort. Enterprise: configurable, 90 days or more. Export logs before they rotate out if you need to keep them.
How do I pay?
Developer is free. Enterprise is an annual contract, invoiced.
What support is included?
Developer: docs and community. Enterprise: dedicated support with an SLA, and services and forward-deployed engineers when you need them.
More questions? See all FAQs or write to support@macawsecurity.com