Pricing — GhostLogic

● TRANSPARENT · NO PER-INCIDENT SURPRISES

Forensic-grade capture, without forensic-grade invoices.

Deploy GhostLogic where it matters, pay for what you actually use, and keep every frame of the story when things go sideways.

All paid plans are billed quarterly. No credit cards. No automatic renewals.

Human-reviewed onboarding for every account. We expect opposing counsel.

✓ SOC 2 Type II

✓ Chain-of-custody compliant

✓ Used in depositions

Pre-incident protection

Capture the truth before anything breaks.

Proactive plans for teams who want clean evidence and reproducible timelines before the incident report exists.

Personal

For DFIR shops, MSSPs, and serious blue teams.

$97/quarter

~$32/month · $6.47/endpoint/month

Up to 5 endpoints · Priority support.

Who it's for: consultants and in-house teams who live in IR.

✓ Managed GhostLogic mesh & automatic updates
✓ AI-assisted triage & anomaly correlation
✓ Full incident replay & exportable timelines
✓ Multi-destination evidence backup (R2, S3, cold)
✓ Case-based organization for engagements
✓ Email support with response-time targets
× Dedicated liaison & custom SLAs

Professional

For DFIR shops, MSSPs, and serious blue teams.

Enterprise

Multi-tenant, regulated, and "see you in court" ready.

$9,999/quarter

~$3,333/month · $0.67/endpoint/month

Up to 5,000 endpoints · White-glove onboarding.

Who it's for: banks, critical infrastructure, MSPs, and anyone who expects opposing counsel.

✓ Dedicated tenant & custom data residency
✓ Notarized exports & deposition-ready kits
✓ Custom retention, redaction & legal holds
✓ Integration with your SIEM / EDR stack
✓ Dedicated GhostLogic liaison & IR playbooks
✓ Contracted SLAs & security reviews

Post-incident response

When everything is already burning and you need the truth reconstructed.

Operator-grade forensic reconstruction, packaged for lawyers, boards, and opposing counsel.

Forensic service

Forensic Timeline Reconstruction — one-time service

$9,500 · One-time service

Full operator-grade reconstruction across all available logs, artifacts, and correlated evidence.

Includes up to 3 endpoints. Additional endpoints at $500 each. Custom scoping available for complex environments.

Deep reconstruction of events, actions, and sequences
Correlated view across systems, users, and timelines
Lawyer-ready report with clear, defensible narrative
Packaged, hashed evidence bundle with chain-of-custody integrity

Apply Now→ Ideal for post-incident investigations, regulatory inquiries, and "we need the real story" moments.

Already breached? Use GhostLogic as the evidence spine while your IR team triages and contains.

Crypto: BTC · ETH · USDC · XMR ACH · Wire · Zelle Manual invoicing

Free community resources

Community Edition — Free plan with limited features

Free plan with limited features. Data collection enabled for model improvement. Deploy it yourself and stay within the 20-endpoint cap.

View Repository↗ Documentation→

Common questions

Frequently asked questions

Why quarterly billing instead of monthly?

Investigations don't happen on neat 30-day cycles. Quarterly billing aligns with how security teams actually work—you deploy once, investigate for months, and don't want billing surprises during an active incident.

What happens if I exceed my endpoint count?

We'll reach out to discuss an upgrade path. No surprise overages, no automatic shutdowns during an active investigation. We bill fairly at the end of your quarter based on actual sustained usage.

Can I switch plans mid-quarter?

Yes. Upgrades are prorated and immediate. Downgrades take effect at your next renewal to avoid disruption during active cases.

Is my evidence data encrypted?

Yes. All evidence is encrypted at rest and in transit. Professional and Enterprise tiers support bring-your-own-key (BYOK) for additional control. Evidence archives are immutably hashed and tamper-evident.

Do you offer discounts for nonprofits or education?

Yes. Verified educational institutions and 501(c)(3) organizations receive 50% off Professional plans. Contact sales for verification and discount codes.

What's your data retention policy?

You control retention. Set policies from 30 days to permanent archival. Enterprise customers can configure custom retention, legal holds, and automated purging for compliance requirements.

What's actually included at each level?

Everyone gets the same core forensic engine. You're paying for scale, hosting, and how much help you want when things burn.

Capability	Community Edition	Personal	Professional	Enterprise
Core evidence capture & hashing	✓	✓	✓	✓
Timeline reconstruction & replay	✓	✓	✓	✓
Self-hosted, self-operated	✓	×	×	×
Managed hosting & updates	×	✓	✓	✓
AI-assisted anomaly correlation	×	✓	✓	✓
Multi-tenant / multi-org support	×	×	×	✓
Deposition-ready exports & notarization	×	×	×	✓
Dedicated liaison & custom SLAs	×	×	×	✓

Ready to capture the truth?

Start with our free plan with limited features, or talk to us about a hosted plan that fits your team.

Schedule a Demo→ View Repository↗