Tiers and limits
What each tier sees, how often, and for how long. The same values drive the API rate limiter and the field redactor — so marketing and enforcement can't drift.
Overview
Four tiers. Two free, two paid. The split on the free side is more interesting than the split on the paid side: Anonymous exists so a threat intel pro can validate data without signing up, and Participant exists so the validation experience makes them want to contribute.
Capability matrix
| Capability | Anonymous | Participant | Commercial Pro | Enterprise |
|---|---|---|---|---|
| Rate limit | 100 / day | 1,000 / hour | 100,000 / hour | Unlimited |
| History window | 7 days | 90 days | 2 years | Full |
| Data freshness | 1h delay | Real-time | Real-time | Real-time |
| Verdict + tags | ✓ | ✓ | ✓ | ✓ |
| Sighting totals | ✓ | ✓ | ✓ | ✓ |
| JA3 / JA4 / SSH | — | ✓ | ✓ | ✓ |
| Per-sensor list | — | ✓ | ✓ | ✓ |
| Commands & payloads | — | ✓ | ✓ | ✓ |
| Bulk / CSV | — | Capped | ✓ | ✓ |
| STIX / MISP feeds | — | Daily | Hourly | Streaming |
| Webhooks | — | — | ✓ | ✓ |
For the full commercial comparison with CTAs, see /pricing.
Anonymous
Designed to be genuinely useful for research and shareable on Twitter. You can paste an IP and get a real verdict with confidence and sighting counts — enough to validate a finding without signing up.
Participant
Free, earned. Run a sensor for 48 hours of valid telemetry and your key is promoted automatically. Full fingerprint access, 90-day history, real-time freshness, daily feeds, capped bulk lookup.
Commercial Pro
For teams that can't host sensors. Webhooks, SIEM/firewall integrations, hourly feeds, 2-year history, 100,000 req/hour. Your subscription pays for the Verified Core fleet.
Enterprise
Unlimited queries, streaming feeds, full history, dedicated support. For MSSPs and SOCs running at nation-state-grade volume.
How promotion works
- Deploy a sensor with an enrollment token
- Sensor reports telemetry to the mesh ingestion API
- After 48 hours of uniquesignatures (not just volume), the promotion check flips the key's tier
- Your next request sees the new rate limit and unredacted fields; no action needed on your end