GitGuardian Pricing

The GitGuardian Platform provides unified secrets and NHI security through four core capabilities: Internal Secrets Monitoring (find leaks across code, CI/CD, and collaboration tools), Public Secrets Monitoring (catch what leaks on public GitHub), NHI Governance (protect every machine identity across your vaults and IAM systems), and Developer Endpoint Protection (extend coverage to the developer's own machine).

GitGuardian Platform licenses can be acquired via the AWS Marketplace. As an AWS ISV Accelerate partner, we offer seamless integration and streamlined procurement. Please visit https://aws.amazon.com/marketplace to learn more.

If you are a large organization looking to acquire several hundred licenses, you can also request a private offer from the GitGuardian team. Please contact sales@gitguardian.com.

These two products are complementary and available in the platform. They come in the form of two different dashboards. GitGuardian for Public Secrets Monitoring is typically used by Threat Response, while Internal Secrets Monitoring is typically used by Application Security.

This greatly depends however, on the way responsibilities are split between your teams. In any case, the look and feel of both GitGuardian dashboards are very similar, so that your team members aren’t lost when they use both products!

GitGuardian NHI Governance and Internal Secrets Monitoring gives you a complete NHI security picture. Governance finds all your secrets, and Internal Monitoring pinpoints leaks. This combo boosts accuracy, speeds up incident response by showing you exactly where secrets live, and helps prevent future leaks by guiding developers. Together, they make secrets management faster, safer, and more efficient.

Additionally, NHI Governance includes Honeytoken for preemptive threat detection.When Secrets Monitoring finds an exposed credential, you can deploy a honeytoken in its place. If an attacker attempts to use it, you get instant alerts—turning remediated incidents into tripwires for future intrusion detection.

For Public Secrets Monitoring: any publicly active developer who has made at least one public commit somewhere on GitHub.

‍For Interal Secrets Monitoring and NHI Governance: any active contributor to a project you are securing with GitGuardian who has made at least one commit in the last 90 days.

Developer Endpoint Protection is priced per endpoint per year, with two tiers:

• Developer endpoints — priced per endpoint/year, mapped 1:1 to the developer seats you already have on the GitGuardian Platform. If you have 1,000 platform seats, you have 1,000 developer endpoints.

• Standard endpoints — priced per endpoint/year at a lower rate. These cover non-developer machines (marketing, operations, and other functions outside the engineering team).

Each endpoint includes at least one Honeytoken for passive threat detection. Contact us to get a count of your endpoints and a custom quote.

For Public Secrets Monitoring, the best option that you have is to reach out to us. We use many different rules to identify public activity that is linked with your company. It just takes one email to our support to get your company’s public activity metrics based on our historical data.

For Internal Secrets Monitoring and NHI Governance, a developer is an active contributor to a project you are securing with GitGuardian who has made at least one commit in the last 90 days. This applies to both Internal Secrets Monitoring and NHI Governance, as NHI Governance is part of the unified GitGuardian Platform and is priced per developer seat.

Our GitGuardian platform is free for repositories hosted under your GitHub Organization.

Our Public Secrets Monitoring product is charged based on your numbers of publicly active developers. Contributors to your Open Source projects aren’t always members of your development teams. We count these contributors only if they are actual employees. In such a case, we monitor these contributors wherever they commit on public GitHub, especially on personal and third party repositories.

Quota usage is based on requests and not on content amount or size. As an example, the scan of a single file, via single scan endpoint, and the scan of a commit involving multiple files, via multiple scan endpoint, both use 1 API call per request.

The quota is set on a rolling month basis (and not on calendar month). By default, we grant 10,000 calls/month on our free plans and 1M calls/month for our customers on the business plan. Those quotas can be fine tuned upon request.

We do! Please contact us.