Start free, scale when your team does.

Yes, in two different senses. The security engine is open source: run the runtime yourself and there is no account, no quota, and no evaluation limit, because the runtime reports nothing to us to reach a decision. (The client SDKs do send one anonymous install ping, which ZNYX_TELEMETRY=0 turns off.) Separately, the hosted console has a free Starter plan with 10,000 evaluations a month, which is the metered tier - you only need it if you want the managed control plane.

One evaluation recorded by a managed ZNYX runtime: an input, output, retrieval, agent-plan, agent-step, or memory-write check. The evaluation itself happens in your runtime; what reaches us is a metadata-only usage event, reported asynchronously, which is what increments the counter. The count is per organisation per calendar month and resets at the start of the month. Detectors are not counted individually, so one request firing eight detectors is one evaluation, and a standalone runtime that reports nothing is not metered at all.

Console features that meter against your plan stop until the month resets, you upgrade, or we raise your limit. Your runtime keeps enforcing policy throughout either way, because enforcement happens in your own infrastructure and does not depend on us - hitting a quota costs you visibility, never protection. If you are approaching the Growth ceiling, talk to us and we will raise it; Enterprise volume is set in the contract.

No. The engine runs inside your own infrastructure on every plan, including Enterprise. What a paid plan adds is the control plane: policy versioning, bundles, traces, benchmarks, and evidence. Its traces are built around identifiers, decisions, detector summaries, and latency rather than full prompt and response bodies, and Enterprise can self-host the control plane too for a deployment with no ZNYX-operated component in the path.

Starter is the hosted console on its free tier, so it is metered and needs an account. Self-hosting is the open-source runtime with a local YAML policy file: unmetered, no account, and no outbound call to reach a decision. Most teams start self-hosted to prove the engine, then add the console when they want version history, shared policy, and audit evidence across a team.

Yes. Plans are monthly, and because policy lives in a bundle you own, downgrading does not strand your configuration - the runtime keeps enforcing the last bundle it holds. Moving from the hosted console to full self-hosting is a supported Enterprise path rather than a migration you have to reverse-engineer.