Grow as you go
Blekline Pricing
Free local hooks on your laptop. Standard hosted MCP. Fleet sidecar in your cluster. Enterprise in-VPC when you need admission control and customer KMS.
01 - Try Blekline
Blekline Local
Open-core local governance for solo devs and security review.
$0
/mo
Billed: Free Forever
Local hooks + stdio MCP for Cursor and Claude
Irreversible local mask — secrets stay on device
Never-Share rules and custom regex on your laptop
Open-core on GitHub — security can review the code
NHIM audit CLI for Kubernetes posture checks
Community support via GitHub issues and public docs
02 - For Growing Teams
Blekline Mark
Hosted MCP and active PII vault for engineering teams.
$499
/mo
Billed: Monthly or $5,090 / €5,090 billed annually
Hosted MCP + ingress proxy on Blekline infrastructure
25 connected agents — flat workspace fee, not per-seat
3M guarded tokens/mo included on the hosted path
Active PII vault — Blekline holds keys (not zero-knowledge)
Team policy + metadata-only Activity audit trail
99.5% control-plane SLA · email · 1 business day
03 - Dedicated Infrastructure
Blekline Redact
In-cluster Enclave sidecar for mandatory-hop NHIM in K8s.
$1490
/mo
Billed: Monthly or $15,200 / €15,200 Annually
100 connected agents · 5 Enclave nodes included
Sidecar on your PVC — your master key, not ours
K8s admission Auto-Route + downstream MCP policy
In-cluster mask unlimited — not guarded-token billed
Audit-only default · dual-control to enforce block
SIEM webhook JSON/CEF · 4h email · 99.5% CP SLA
04 - In-VPC · Azure/AWS
Blekline Enterprise
In-VPC execution for regulated teams — your network, your keys.
From $5,000
/mo
Billed: Annually via Azure / AWS Private Offer
SAML 2.0 SSO + SCIM 2.0 user provisioning
Blekline for Microsoft Sentinel — bundled, no SKU
In-VPC on AKS / OpenShift · customer CMEK keys
Lineage Firewall enforce · optional eBPF kernel plane
25+ Enclave nodes in commit · named TAM · custom SLA
Enterprise DPA, subprocessor pack, and audit evidence
Guarded tokens apply to Mark’s hosted path only. Redact+ in-cluster Enclave masking is node-metered, not GT-metered. Three counts — agents, tokens, nodes — never conflated. VAT-exclusive where noted; tax at checkout. See app.blekline.com/docs/plans/compare for current entitlements.
Compare features across plans
01
Features & Capabilities
Local hooks + stdio MCP
Hosted MCP + ingress proxy
Control-plane sync
Control-plane sync
Active PII vault
PVC, customer key
Hosted, Blekline key
CMEK
Downstream MCP proxy
Limited
Sidecar container
K8s admission Auto-Route
Lineage Firewall
Audit only
Enforce
Blekline for Sentinel
Yes (bundled)
Client surfaces
Sidecar MCP
Hosted + local
In-VPC + local
02
Security and Administration
Fail-closed mask / tool deny
Sidecar block
Hosted + hooks
Sidecar + kernel
Audit → dual-control enforce
Metadata Activity
Sync if CP=saas
Air-gap default
Workspace RBAC
Hash-chained signed audit
SAML 2.0 + SCIM 2.0
Customer-managed keys
PVC master key
CMEK / HSM
eBPF kernel plane
Audit opt-in; enforce gated
SIEM / evidence export
JSON/CEF webhook
CSV/JSON
ASIM + Sentinel native
03
Pricing and Metering
Platform fee
$1,490 / €1,490 mo
$499 / €499 mo
from $5,000 / €5,000 mo
Annual prepay
$15,200 / €15,200 mo
$5,090 / €5,090 mo
Negotiated
Connected agents
100
25
Custom
Included Guarded Tokens/mo
2M (CP only)
3M (hosted)
Custom
GT overage
CP fallback only
$150 / €150 - 5M
Contract
Included Enclave nodes
5
0
25+ in commit
Min billable nodes
3 when active
Contract
Spend cap (GT)
2× = $998 / €988
Contract
Purchase channels
Card + Azure
Card + Azure
Private Offer
04
Support and Service Levels
Uptime SLA
99.5% CP
99.5% CP
Negotiated
First response
4 business hours
1 business day
Contracted
Support channel
Email + shared
Email
Named TAM
Guided pilot
Self-serve runbook
No
Paid SOW
DPA / subprocessors
Custom annexes
SOC 2 report
Roadmap
Roadmap
Roadmap + questionnaire
Blekline Enclave is the in-cluster sidecar deployed on your nodes. Redact includes 5 Enclave nodes; Mark does not include in-cluster deploy. Additional nodes: $125/mo.
Frequently Asked Questions
FAQs
Choosing a plan
01
Is Blekline Local really free forever?
Yes. Local is hooks + stdio MCP on your machine — no hosted proxy, vault, or Enclave. It’s for solo developers and OSS evaluation. When a team needs shared policy and hosted MCP, upgrade to Mark. When the platform team owns Kubernetes, upgrade to Redact.
02
Mark vs Redact — how do I choose?
Choose Mark if you want Blekline-hosted MCP and ingress without running a sidecar in your cluster ($499/mo, 25 agents, 3M GT on the hosted path). Choose Redact if agents must hit a mandatory-hop sidecar in your cluster, you need customer-held vault keys, K8s admission, SIEM export, and Enclave node metering ($1,490/mo + nodes).
03
When do I need Enterprise instead of Redact?
Enterprise is for regulated procurement: SAML/SCIM, Blekline for Microsoft Sentinel (bundled), in-VPC deployment, negotiated SLA, 25+ Enclave nodes in commit, and Azure private offers (~$5k/mo / $60k ACV floor). Redact is self-serve platform tier; Enterprise is the procurement answer.
Billing, limits & overage
04
What are “guarded tokens” and how is Mark metered?
Guarded tokens (GT) measure masked character volume on the hosted path. Mark includes 3M GT/mo; overage is $150 per 5M GT. Default spend cap is 2× your platform fee ($998) — admins can raise it. Mark is a flat workspace fee, not per-seat pricing.
05
How is Redact / Enclave metered — tokens or nodes?
Nodes, not tokens, on the in-cluster Enclave path. Redact includes 5 Enclave nodes; additional active nodes are $125/node/mo (minimum 3 billable when any sidecar is live). In-cluster masking is not GT-billed. Mark and Redact use separate counters, we don’t double-bill the same traffic.
06
Can I buy on Azure Marketplace?
Yes for Mark and Redact SaaS offers (blekline-mark, blekline-redact) — eligible for MACC when checkout runs in Azure. Enclave deploys via the Container offer on AKS alongside your SaaS entitlement. Enterprise typically closes via private offer, not self-serve card.
Security honesty & procurement
07
Is Mark zero-knowledge? Who holds the keys?
No. Mark is not zero-knowledge — Blekline holds the KMS key for the hosted vault and can decrypt for TTL hydrate. Redact and Enterprise use your PVC / CMEK; Blekline cannot hydrate without your keys. Redact and Enterprise do not call hosted /api/mask — masking runs in-cluster.
08
Why isn’t SSO included on Mark?
SAML and SCIM are Enterprise-only — same pattern as Wiz and Palo Alto (SSO behind enterprise gate). Mark includes workspace RBAC (owner/admin/member). If SAML is required before a platform commit, ask about Enterprise FastTrack via private offer — we don’t bolt SSO onto Mark.
09
Is there a pilot before an Enterprise commit?
Yes. Enterprise buyers typically start with a fixed-scope paid pilot (audit sandbox in your environment, 3–4 weeks). Mark and Redact are self-serve; Enterprise closes via private offer after a scope call.