Workspace · Billing

Billing & plans

Your plan determines which modules you can use and how much you can scan. The Billing page is where you see your current subscription, track usage against your limits, and review available plans.

Current pricing lives in the app Plans and pricing evolve, so this guide explains how billing works rather than listing prices. For the plans and prices available to you right now, open Billing in the app — it's always the source of truth.

What the Billing page shows

Open Billing from the sidebar (under Workspace). It's organized into a few panels:

Current plan

Your subscription and its status — for example Active, on trial, past due, or expired — plus when it started and renews.

Usage this period

Live meters showing what you've consumed against your limits.

Modules

Which testing modules your plan enables.

Plan limits

The detailed quotas your plan grants, grouped by area.

Available plans

The plans you can move to, with an option to upgrade or contact sales.

Modules are plan-gated

The headline difference between plans is which modules they unlock. Each plan enables some combination of the five testing modules. SAST is on every plan, and SCA (dependency checks) is derived from every SAST scan, so every plan has both. DAST, IAST and AI Pentest unlock on higher tiers. Enabled modules show an On state on the Billing page and appear normally in the sidebar.

The plan tiers are Trial, Starter, Pro and Enterprise. Roughly how the modules map to them (the app is always the source of truth):

Module	Trial	Starter	Pro	Enterprise
SAST	On	On	On	On
SCA with SAST	On	On	On	On
DAST	On	—	On	On
IAST early access	—	—	—	On
AI Pentest	Recon	—	—	Deep

Exact entitlements are set per subscription — talk to sales for specifics. IAST is in early access with a JVM agent first; AI Pentest runs under a profile that also depends on your plan (see below).

Billing page showing which modules are enabled and the plan limits — Module entitlements and plan limits. Which modules are “On” is what separates one plan from another.

When a module isn't in your plan, it doesn't disappear — it shows a locked state so you always know it exists:

In the sidebar, the module is greyed with an Upgrade badge and links to Billing.
Opening the module shows an “not in your plan” panel with an upgrade prompt instead of the tool.

Your data is never lost on a downgrade If a module was part of your plan and later isn't, its historical results become read-only — you can still view past findings, you just can't run new scans until you re-enable the module.

Depth within a module is plan-gated too

Beyond on/off, two modules offer deeper capabilities on higher plans:

SAST resolution tiers

How completely SAST resolves the types behind your dependencies depends on your plan:

Bundled

Bundled framework and library models — no network, no build. The floor every plan can reach.

Fetched public types

Fetches the exact public dependency types your project declares. Pro and above.

Compiler build

A sandboxed dependency build for private and first-party packages, giving the engine exact types. Pro and above.

AI Pentest profiles

An AI Pentest run executes under a profile that sets how far the swarm goes:

Recon

Surface mapping only — recon tooling, no exploitation. Available on the free trial.

Standard

The full kill chain with the standard tool tier. By arrangement.

Deep

Extended exploitation — deep tool tier, exploit suggestions, more delegations and stage revisits. Enterprise.

Usage meters & plan limits

Every plan grants a set of quotas, and CodesGuard meters your consumption against them in real time so there are no surprises. Depending on your plan, tracked usage can include:

Workspace — team members and workspaces (organizations) you can create.
SAST — number of projects, monthly scans, and concurrent scans.
SCA — whether it's included, and scan volume.
DAST / AI Pentest — scans, runs, run minutes, and maximum run duration.
IAST — connected agents and the projects they report into (Enterprise early access).
Storage — total storage, maximum upload size, and how long results are retained.

Plan limits are grouped on the Billing page by area (workspace, per-module, storage, tenant, support), each with its quota — so you can see exactly what your plan allows before you hit a limit.

Limits are enforced by the platform The sidebar and module screens reflect your entitlements, but the platform enforces them server-side — so limits apply consistently no matter how you reach a module.

Changing your plan

Review the plans available to you under Available plans on the Billing page and upgrade (or contact sales) from there. When you change plans, module access and limits update to match. Managing members and workspaces is covered in Organizations.