pricing
Quoted per deployment
Divelai sits in the request path of systems that differ enormously in throughput, data sensitivity, and where they are allowed to run. A published per-seat number would be wrong for almost everyone, so we quote against your actual deployment.
While Divelai is in closed beta, engagements start as a bounded pilot with agreed success criteria and beta commercial terms. Nobody signs a multi-year contract for software that has not yet proven itself on their traffic.
What shapes a quote
Five things, in roughly the order they matter. We will tell you which of these is driving your number rather than handing you a total with no breakdown.
Deployment mode
Hosted, private cloud in your own VPC, or fully self-hosted. Self-hosted moves operational work to you and the vault never leaves your infrastructure; hosted moves that work to us. They price differently because they are different products to run.
Throughput
Sustained and peak request volume, and the size distribution of the payloads. Sanitization is inline, so capacity has to be provisioned for your peak rather than your average.
Detector coverage
The standard identifier classes are included everywhere. Custom detectors for your own schemas, internal reference formats, or a regulated data class we do not ship by default are scoped as engineering work.
Environments and regions
Non-production environments, region-pinned vaults, and multi-region failover each add infrastructure. Most teams run at least a staging deployment alongside production.
Support and assurance
Response commitments, named contacts, security questionnaire support, and any availability commitment you need in the contract.
Included in every deployment
These are not upsells. A sanitization layer missing any of them would not be one.
- The full standard detector set, with checksum validation where the class allows it
- All four transforms — redaction, tokenisation, format-preserving masking, synthetic substitution
- The token vault, with region pinning
- Append-only, hash-chained transformation logging
- Data-flow maps and evidence export
- Versioned policy configuration
- Signed DPA and subprocessor notice
- Security questionnaire support during procurement
What we will not do
Meter you in a way that makes the safe choice the expensive one. Two commitments hold in every contract we sign:
Sanitization is never rate-limited into a fail-open
If you exceed what you are provisioned for, the answer is a conversation about capacity, never a silently degraded pass that lets raw data through.
The audit log is not a paid tier
Charging for the evidence trail would mean selling you a compliance gap and then selling you the fix. Logging is in the base deployment.
How a quote is produced
A realistic first number takes about a week. A signed contract usually follows the security review, not the other way round.
-
Scoping conversation
Thirty minutes with whoever owns the egress path. What leaves your boundary today, to whom, and under what obligation.
-
Technical validation
We run the detectors against a sample of your real traffic shape — synthetic or redacted if you prefer — and show you what would have been caught and what would not.
-
Written quote
Deployment mode, provisioned capacity, detector scope, support terms, and the line items behind the number.
-
Security review
Your questionnaire, our architecture documentation, the DPA, and a call with whoever needs to sign off. We would rather do this before you commit than after.
-
Pilot, then production
A bounded pilot on one workload with agreed success criteria, then the production rollout.
Procurement questions
Contract term
Annual is standard, multi-year available. Pilots are scoped separately and are not auto-renewing.
Payment
Invoiced annually or quarterly in arrears against a purchase order.
Security questionnaires
Send yours with your enquiry. We would rather answer it at the start of the process than at the end.
Data processing
Our DPA is offered pre-signed so it does not become the slowest step. See the DPA.
Exit
Vault export in a documented format, and deletion certified in writing. Ask for the exit terms during the review, not after.
Tell us what leaves your boundary.
The more you can say about volume and deployment constraints, the closer the first number will be.