Do you see our prompts or data?
No, and not as a policy. The collector will run inside your network and hash payloads in place. What reaches us will be which tool ran, what authority it held, and whether it was reversible.
Pricing
Free where it runs on your machine.
The scanner and the watcher are open source and stay that way. You pay when you want the record kept somewhere other than one laptop, and when you need it to stand up to someone else's scrutiny.
Free
Free · forever
Price on 10.9.2026: free
One machine. No account needed, no telemetry, no expiry.
- Every watch source and every rule
- Authority scan across twelve providers
- Usage pulls from your own audit logs
- HTML and JSON reports
- MIT licensed, no dependencies
- Nothing sent to us
- An optional free account, to link machines with ranwhat login and see what Plus adds
Team
Contact us · annual
Being built. Not available yet.
When someone outside the company is going to ask what your agent did, and your own word is not the answer they want.
- Everything in Plus
- Hash-chained records you cannot alter either, which is the only reason they are worth anything to a third party
- Seven-year retention as an obligation we carry, not a backup policy you maintain
- Underwriter export pack for renewal or a claim
- A Trust Page your own prospects can load, attested by someone other than you
- Named contact, annual billing
Compare
Free or Plus: what each one covers.
If you run agents on one machine, Free is enough. Plus starts to matter when the record has to live somewhere other than that laptop.
| What you need | Free | Plus |
|---|---|---|
| Read an agent's history and flag risky actions | Yes, every source and rule | Same code, nothing extra needed |
| Find secrets in transcripts and mask them | Yes | Same |
| Score what an agent's tokens allow | Yes, against the catalogue shipped with your version | Against a catalogue kept current as providers add scopes |
| HTML and JSON reports | Yes | Same |
| CI tokens, and teammates invited by email | No | Yes, on your account |
| One view across machines and CI runners | One report per machine | Yes: run ranwhat push on each, and read them side by side on your account. Metadata only; the latest push and 30 days of summaries are kept |
| 13-month retention, alerts and drift notices | Your own backups | Being built |
| Price | Free, forever | €12 a month per organisation, or €120 a year |
Not sure which you need? Start with Free: uvx ranwhat check. Nothing is sent to us, and there is no account to make first.
The rule
We don't charge per finding.
A tool paid by the alert has a financial reason to cry wolf, and the only thing this product really sells is being believed.
The first watch build flagged six findings on real history, and three were false positives. A later release reported fifteen findings on one machine's 90-day history. Eleven were deletions of build and temp directories: all true, none worth reading. After the fix, the same history gave four. Under per-finding pricing both fixes would have cost us money, which is exactly why the meter isn't there.
Nothing is held back from the free tier to make the paid ones look better. Every rule, every source and every report runs locally, and the code is there to check. You are not paying for features withheld from a binary; you are paying because retention, correlation and a record you cannot edit yourself all need someone else to run them.
What you pay
One flat price per organisation. Not per agent, not per seat, not per machine.
Not metered
Findings, alerts, seats, agents, scans, rules, reports, retention queries.
Why flat
A catalogue is worth the same to you whether two machines read it or two hundred. Charging by agent would only teach you to under-report how many you run, which is the opposite of what this tool is for.
Questions
Before you pay.
What happens if we stop paying?
Local keeps working, because it's the same open-source code. You export your records; we don't hold them hostage to a renewal.
We have two hundred agents.
Then you pay the same €12 as someone with two. The price is per organisation, so scale is not a reason to talk to us. Needing records a third party will accept is.
Can we self-host the evidence store?
No, and that is the point rather than a limitation. A hash chain you control is one you can rewrite, so an underwriter should ignore it. The records are worth something precisely because we hold them and you cannot quietly change them. The collector that will run in your network is yours; the chain is deliberately not.
How do we cancel?
With Manage billing on your account at account.ranwhat.com, or from the billing page, any time. The feed keeps working to the end of the period you paid for. Changed your mind in the first 14 days? Write to us and the first payment is refunded in full. The terms have the rest.
Where does the token go?
Run uvx ranwhat login once on each machine: it prints a code to type at ranwhat.com/device, signed in to your account, and that machine gets a token of its own, which ranwhat update then uses. Pipelines use a CI token from your account page. Anyone who bought Plus before accounts keeps the token they were emailed, saved once with ranwhat update --save-token.
Honest status
Free ships today and is what the GitHub repository contains. Of Plus, the catalogue feed is live: subscribe, and ranwhat update keeps your catalogue current from feed.ranwhat.com as providers add scopes. So are CI tokens and members, on the account at account.ranwhat.com, and the view across machines that ranwhat push fills. The account itself is free, and so is linking a machine to it with ranwhat login. Retention and alerts are not written yet, and nor are Team's hash-chained records. Plus subscribers get each of them at the same price as it ships, and Team is not for sale until its records exist. If you want Team now, write to us: you'd be an early customer shaping it, and you should expect to be treated like one.