GLACIS MANAGED · PRICING

Paid from first use.
Priced in receipts.

GLACIS Managed is a signing arbiter we run for your tenant alone, reached over a private WAN — never the public internet. Three tiers, one ladder. Each rung is an independently verifiable claim, and the meter is the receipt count your Console proves.

Start — $199/mo Verify a receipt →

Paid from first use No seats, no per-agent fees The meter is the receipt count the Console proves

THE ASSURANCE LADDER

Three tiers. One ladder.

Every tier is a dedicated arbiter — your tenant, your instance, no shared queue. What changes as you climb is the claim we can prove about it, and how you check that claim yourself.

Rung 1 · Managed

Starter

Operational isolation. A per-tenant arbiter on a private WAN, signing from the first operation.

$199/ mo

month-to-month · card checkout · cancel monthly

Dedicated per-tenant arbiter — never shared, never pooled
One-command private-WAN connector (WireGuard / Tailscale)
Signed receipts on every AI operation (Ed25519 · SHA-256 · RFC 8785)
GLACIS Console — live event stream, blocked-action audit, in-browser verification
100,000 receipts/mo included · then $5 per 10,000
Fair use: 500 GB proxied traffic/mo · we talk before we bill
Concierge onboarding — first signed receipt from your traffic within 2 business days, or the month is refunded
Not payload-blind. Attested blindness is the Nitro rung — we won't claim it here.

How you check the claimYour connector config + every signed receipt, verified in your own browser.

Start now

Most teams land here

Rung 1–2 · Managed, Nitro-ready

Team

The same dedicated arbiter, on paper for a year — with the attested-blind rung one config change away.

$1,250/ mo

billed annually — $15,000/yr · two-page order form

Everything in Starter
1,000,000 receipts/mo included · then $5 per 10,000
Fair use: 2 TB proxied traffic/mo
Nitro attested-blind enclave add-on +$250/mo — the enclave attestation proves we cannot read payloads
Annual price locked for the term
Priority onboarding and support
Nitro is an add-on here. It's included one tier up.

How you check the claimReceipts + connector config you control. Add Nitro and verify the attestation document yourself.

Get the order form

Rung 2–3 · Attested-blind + PrivateLink

Assurance

Attested-blind by default, with enterprise connectivity: the strongest claims we can make while still running the box.

from $3,000/ mo

from $36,000/yr · sales-assisted

Everything in Team
Nitro attested-blind enclave included — verify the attestation document, not our word
Connectivity your security team picks: Twingate ZTNA or AWS PrivateLink (traffic stays on the AWS backbone, visible in your own VPC console)
5,000,000 receipts/mo included · overage by agreement
Fair use: 5 TB proxied traffic/mo
Named support, white-glove onboarding
The data plane still runs in Glacis-operated cloud. If that's disqualifying, the next rung is self-host — and we'll say so first.

How you check the claimThe enclave attestation document + your own VPC console.

Talk to us

All prices USD, published July 2026. Every engagement on paper — order form, not open-ended POC.

DECLARED VS ENFORCED

Don't trust the tier. Check it.

Most pricing pages sell adjectives. Each of our tiers is a claim with a verification path attached. Here is the whole ladder, including the rung where you stop needing us to run anything.

Rung	Where it's sold	The claim	How you check it
RUNG 1Managed	Starter · Team	Operational isolation: per-tenant instance, private WAN transport, no multi-tenant mixing.	Receipts + the connector config you control
RUNG 2+ Nitro	Team add-on (+$250/mo) · included in Assurance	Attested-blind: the enclave attestation proves Glacis cannot read payloads.	Verify the attestation document
RUNG 3PrivateLink / your VPC	Assurance	Traffic stays inside the AWS backbone and your account's reach.	Your own VPC console
RUNG 4Self-hosted / airgap	Platform	The data plane never leaves you.	It's your box

Each rung is an independently verifiable claim. That's the point of us.

HOW BILLING WORKS

The bill is as verifiable as the product.

A flat fee plus one meter.

The flat fee covers your dedicated arbiter, the private-WAN connector, and the Console. The meter is signed receipts. Pass your included count and overage runs at $5 per 10,000 receipts. That's the whole model. No seats. No per-agent fees.

Why receipts and not tokens, requests, or seats?

Because the receipt count is the one number you can audit. One receipt is one signed, hash-chained record of one AI operation — Ed25519 over SHA-256, canonicalized under RFC 8785. The Console proves exactly how many receipts were signed; the invoice bills exactly that number. If they ever disagreed, you would hold the cryptographic proof.

Fair use, stated plainly.

The arbiter is inline, so it carries your traffic. Flat tiers include proxied-traffic headroom — 500 GB a month on Starter, 2 TB on Team, 5 TB on Assurance. Run past it and we talk before we bill. A silent traffic surcharge will never appear on an invoice.

Annual is the discount, not the trap.

Starter is month-to-month and cancels monthly. Team and Assurance are annual on a two-page order form, and the price is locked for the term. Overage pressure on Starter is the honest signal that it's time to move up — not a penalty rate.

PRICING FAQ

Asked, answered.

Does our agent traffic cross the public internet?

No. Most hosted AI tooling asks you to ship your prompts across the public internet to a multi-tenant SaaS. We think an audit layer that widens your attack surface is a contradiction. GLACIS Managed gives every customer a dedicated arbiter — your tenant, your instance, no shared queue — reached over a private WAN. The default is a one-command WireGuard connector. Enterprises can choose Twingate ZTNA or AWS PrivateLink instead. Your agents talk to the arbiter as if it were on your own network, because as far as routing is concerned, it is.

One honest boundary: Managed means Glacis operates the arbiter. At this rung the claim is operational isolation — per-tenant, private transport, no multi-tenant mixing. It is not a claim that we cannot see payloads. That claim lives one rung up, where the Nitro enclave attestation proves it.

Why is there no free tier?

Because evidence only counts if it exists before the incident, and free tiers are where audit trails go to not exist. If a workload matters enough to arbitrate, it matters enough to pay for from the first operation. Starter is $199 a month — cheaper than the meeting where everyone asks who approved the agent.

Instead of a trial, you get a guarantee: a signed receipt from your own traffic within two business days of paying, or we refund the month.

Can Glacis read our payloads?

At the Managed rung — in principle, yes. We operate the arbiter, and operational isolation is the claim, not blindness. We won't pretend otherwise. If that's not enough for your threat model, climb: the Nitro rung is attested-blind — the enclave attestation document proves we cannot read payloads, and you verify that document yourself, not our word for it. PrivateLink keeps traffic inside the AWS backbone and your account's reach. Self-host keeps the data plane on your boxes entirely.

Regulated? Start at self-host. We'll tell you that ourselves.

We already use Vanta / Drata.

Keep them. Vanta proves your policies exist. It cannot prove any single agent action followed them. Compliance automation is a certificate about your company, once a year. GLACIS is evidence about each operation, every time. Declared versus enforced — you need both, and they don't overlap.

We already have Datadog / observability.

Keep it too. Observability is your own dashboard — useful to you, worthless to anyone who doesn't trust you. When a customer, insurer, or court asks what your agent actually did, a span won't survive cross-examination. A signed receipt will. Datadog watches. Glacis proves.

Isn't an inline arbiter a latency and outage risk?

It's a dedicated instance for your tenant alone — no noisy neighbors, no shared multi-tenant queue — with blue/green deploys behind an internal load balancer. And inline is not a bug: an after-the-fact sampler can't block anything, and can't sign what it never saw. Fail posture is your policy choice — fail-open or fail-closed — and the receipt records which posture was in force.

We publish measured latency when it comes from a real tenant, not before.

What exactly gets counted as a receipt?

One receipt is one signed record of one AI operation: the action, the policy that applied, the verdict — hash-chained to its neighbors, Ed25519 over SHA-256, canonicalized under RFC 8785. Your Console shows the running count; the invoice bills the same number. That symmetry is why we meter in receipts and nothing else.

PAID FROM FIRST USE

Can you prove it?

Your first receipt is two business days away. Don't take that on trust either — it will verify in your browser.