Skip to main content
Flarehawk subscriptions are based on accepted, uncompressed data volume and AI investigations. This keeps billing aligned with the telemetry Flarehawk successfully processes and the investigation work it completes. Billing is monthly; there is no advertised annual discount.
Free includes 2 GB of accepted data, 3 AI investigation cases, and 7-day hot retention per billing period. No card is required.

​
Plans at a glance

All data units are decimal: 1 GB is 1,000,000,000 bytes and 1 TB is 1,000 GB.

​
Included on every plan

  • SSO and SCIM provisioning
  • Security source integrations and API access
  • Real-time detections and notifications
  • SQL queries and compliance exports
  • Unlimited team members

​
Plan details

$0/month
  • 2 GB of accepted data per billing period
  • 3 completed AI investigations
  • 7-day hot retention
  • Fixed data and AI hard caps
  • One Free organization per owner
No payment card is required. Upgrade to continue ingesting or investigating after a hard cap is reached.

​
Choosing a plan

The pricing and billing calculators accept GB/day, GB/month, TB/month, or events/day plus average uncompressed event size. They recommend the lowest projected-cost eligible plan using a server-generated quote. Enterprise is required when:
  • Forecast accepted data reaches 1 TB/month
  • Required retention exceeds one year
  • Projected self-serve spend reaches $3,999/month
  • Custom invoicing or SLA terms are requested
Client-side estimates never activate entitlements. Paid features activate only after Flarehawk verifies the Stripe subscription state.

​
Trials and plan changes

New Detect and Investigate subscriptions include a 14-day, card-required trial. Trial data and AI usage are hard-capped at the selected plan allowance, and no metered overage is charged before conversion.
  • Detect-to-Investigate upgrades take effect immediately with a Stripe proration preview.
  • Downgrades and transitions to Free take effect at renewal.
  • A scheduled change remains visible and can be canceled before it applies.
  • Enterprise terms are immutable while active; request an amendment for changes.

​
Managing billing

Open your organization and select Billing to see accepted GB, AI cases, forecast usage, the current-period estimate, retention, caps, pending changes, invoices, and renewal date. Billing members can manage payment and paid-plan changes; admins can also manage caps; owners can cancel or move to Free.

​
Frequently asked questions

Flarehawk bills accepted, uncompressed bytes after validation and deduplication. Rejected records, duplicate deliveries, retries, and batches that fail required archive durability contribute zero usage.
One case is counted when an incident-backed or manually started investigation first produces a substantive successful result. Retries, follow-ups, and internal model calls do not add cases.
Yes. Data and AI hard caps are independent. A data cap pauses new batches; an AI cap pauses new investigations while ingestion and detections continue.
No. SSO and SCIM provisioning are included on every plan, including Free.