Plan and usage
Overview
You can find your plan and usage details in your workspace settings. Visit the Plan & usage section.
Plans
GitGuardian offers three plans:
- Free (Starter): monitor your repositories with up to 25 contributing developers.
- Growth: the complete secrets security platform to detect, prioritize, and remediate secrets exposure across your repositories, SDLC, and endpoints.
- Enterprise: everything in Growth, plus the governance and administrative controls large organizations need, including self-hosted deployment, custom detectors, and GitGuardian Bridge.
You can try all paid features with a 30-day free trial. For pricing details, visit the pricing page on our website.
Feature comparison
Each feature below is delivered by a GitGuardian product. Features are grouped by what they help you do, following the same structure as our pricing page.
Monitor
| Feature | Product | Free (Starter) | Growth | Enterprise |
|---|---|---|---|---|
| Git repositories (GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit) | Internal Monitoring | ✅ | ✅ | ✅ |
| Scanning capacity | Internal Monitoring | 1 GB | 12 GB | 60 GB |
| CI/CD, container and package registries | Internal Monitoring | ❌ | ✅ | ✅ |
| Custom data sources | Internal Monitoring | ❌ | ✅ | ✅ |
| Corporate data sources (ticketing, messaging, documentation, file storage) | Internal Monitoring | ❌ | 1 source upon request | ✅ |
| Endpoint scanning | Endpoint Protection | ❌ | Up to seat count | Up to seat count |
| Public Monitoring | Public Monitoring | ❌ | Limited scope | ✅ |
| Honeytokens (AWS) | Honeytoken | 5 | 2 per seat | 10 per seat |
Detect
| Feature | Product | Free (Starter) | Growth | Enterprise |
|---|---|---|---|---|
| Real-time monitoring and scanning | Internal Monitoring and Public Monitoring | ✅ | ✅ | ✅ |
| Historical scans | Internal Monitoring and Public Monitoring | Up to 500 (internal monitoring only) | Unlimited | Unlimited |
| Specific and generic detectors | Internal Monitoring and Public Monitoring | ✅ | ✅ | ✅ |
| Filepath and pattern exclusions | Internal Monitoring | ❌ | ✅ | ✅ |
| Custom regex detectors | Internal Monitoring | ❌ | ❌ | Unlimited |
| Maximum scanned file size | Internal Monitoring and Public Monitoring | 1 MB | 1 MB | 10 MB |
Investigate
| Feature | Product | Free (Starter) | Growth | Enterprise |
|---|---|---|---|---|
| "Publicly leaked" tag | Internal Monitoring | ❌ | ✅ | ✅ |
| Validity checks | Internal Monitoring and Public Monitoring | Low frequency | Low frequency | High frequency and custom checkers |
| Automated severity scoring | Internal Monitoring and Public Monitoring | ✅ | ✅ | ✅ |
| Custom severity rules | Internal Monitoring and Public Monitoring | ❌ | ✅ | ✅ |
| Saved views | Internal Monitoring and Public Monitoring | ✅ | ✅ | ✅ |
| Occurrence grouping | Internal Monitoring and Public Monitoring | By secret | By secret | Customizable |
| Generic secret enricher (AI) | Internal Monitoring and Public Monitoring | ❌ | ✅ | ✅ |
| AI filters | Internal Monitoring and Public Monitoring | ❌ | ✅ | ✅ |
| AI risk scoring | Internal Monitoring and Public Monitoring | ❌ | ✅ | ✅ |
| Custom tags | Platform | Up to 100 | Up to 2,500 | Unlimited |
Remediate
| Feature | Product | Free (Starter) | Growth | Enterprise |
|---|---|---|---|---|
| Remediation playbooks | Internal Monitoring | ❌ | ✅ | ✅ |
| Notifiers (email, Slack, Microsoft Teams, Discord, Splunk, PagerDuty) | Platform | ✅ | ✅ | ✅ |
| Ignored valid secret notifications | Platform | ❌ | ✅ | ✅ |
| TMS integration (Jira, ServiceNow) | Platform | ❌ | ✅ | ✅ |
| ASPM (Wiz) | Platform | ❌ | ✅ | ✅ |
| Event-driven webhooks | Platform | ✅ | ✅ | ✅ |
| AI false-positive remover | Internal Monitoring and Public Monitoring | ❌ | ✅ | ✅ |
| Smart routing | Internal Monitoring | ❌ | ❌ | ✅ |
Prevent
| Feature | Product | Free (Starter) | Growth | Enterprise |
|---|---|---|---|---|
| Check runs and pre-receive hooks | Internal Monitoring | ✅ (excluding forks and large pull requests) | ✅ | ✅ |
| ggshield CLI | ggshield | Limited | ✅ | ✅ |
| VS Code extension | ggshield | ❌ | ✅ | ✅ |
| AI IDE integrations (Cursor, Claude Code, Copilot) | ggshield | ✅ | ✅ | ✅ |
Secure
| Feature | Product | Free (Starter) | Growth | Enterprise |
|---|---|---|---|---|
| Secrets manager integration | NHI Governance | ❌ | ✅ | ✅ |
| Push to vault | NHI Governance | ❌ | ✅ | ✅ |
| NHI inventory | NHI Governance | ❌ | ❌ | ✅ |
| Cloud IAM visibility and permissions mapping | NHI Governance | ❌ | ❌ | ✅ |
| Ownership mapping | NHI Governance | ❌ | ❌ | ✅ |
| Duplicated and reused Internal Monitoring and Public Monitoring | NHI Governance | ❌ | ❌ | ✅ |
| OWASP Top 10 NHI policies coverage | NHI Governance | ❌ | ❌ | ✅ |
Platform and administration
| Feature | Product | Free (Starter) | Growth | Enterprise |
|---|---|---|---|---|
| Teams | Platform | ❌ | Up to 10 | Unlimited |
| Roles | Platform | ❌ | 3 | 3 |
| SSO (SAML 2.0) and SCIM | Platform | ❌ | ✅ | ✅ |
| IP allowlisting | Platform | ❌ | ✅ | ✅ |
| Privacy mode | Platform | ✅ | ✅ | ✅ |
| Content access restriction | Platform | ❌ | ✅ | ✅ |
| Advanced security settings (privacy mode enforcement, token and session lifetime) | Platform | ❌ | ✅ | ✅ |
| Health checks | Platform | ❌ | ✅ | ✅ |
| API calls per month | Platform | 10,000 | Unlimited | Unlimited |
| Personal access tokens | Platform | Up to 5 | Up to 5 | Up to 10 |
| Service accounts | Platform | ❌ | Up to 500 | Up to 500 |
| Audit log | Platform | ✅ | ✅ (12-month retention) | ✅ (unlimited retention) |
| Analytics and reporting (insights, charts, CSV export) | Platform | ❌ | ✅ | ✅ |
| EU data hosting region | Platform | ❌ | ✅ | ✅ |
| GitGuardian Bridge | Platform | ❌ | ❌ | ✅ |
| Dedicated CSM and support | Platform | ❌ | ✅ | ✅ |
Add-ons
You can extend your plan with add-ons:
- Additional endpoints: Growth and Enterprise plans include endpoint scanning for as many endpoints as seats in your plan. Add coverage for endpoints beyond your seat count. See Endpoint Protection.
- Additional corporate data sources (Growth only): the Growth plan includes one corporate data source upon request. Add more sources without moving to Enterprise, where they are all included.
- Self-hosted deployment (Enterprise only): run GitGuardian on your own infrastructure. See Self-hosting.
- Premium support: enhanced support and guidance beyond the standard offering.
Contact our sales team for details.
Usage
Free (Starter) plan
The Free (Starter) plan covers Internal Monitoring only: you can monitor your business repositories within a limit of 25 contributing developers (both terms are defined in the Growth and Enterprise plans section below). Only workspace Managers and Owners can view the total number of contributing developers.
If you have more than 25 contributing developers, there are two possibilities:
- Your trial will start automatically if you reach the limit of 25 contributing developers (happens after adding new repositories to your perimeter for example).
- Your free trial has been redeemed and expired, meaning your business repositories are no longer monitored. We invite you to contact our sales team via email to upgrade your plan.
Growth and Enterprise plans
Your usage is measured against the number of seats you have acquired. Internal Monitoring and Public Monitoring use separate metrics, counted and billed independently.
Internal Monitoring: contributing developers
A contributing developer is anyone who authored at least one commit to a business repository within the last 90 days, based on the commit date. Each developer is counted only once, regardless of how many repositories they contribute to or which platforms they use.
A business repository is:
- Any project or repository hosted on GitLab, Bitbucket, or Azure DevOps.
- Any private repository within a GitHub organization.
Public repositories and repositories from individual GitHub user accounts are not counted.
To avoid counting the same person twice, we normalize every commit author email (lowercase the part before the @, strip punctuation) and count everything that normalizes to the same value as one developer. Commits from bots, CI/CD tools, and platform no-reply addresses (such as web UI edits signed with users.noreply.github.com) are excluded automatically. If you have internal service accounts committing under regular-looking emails, contact your account team to add them to your exclusion list.
The count follows a rolling 90-day window, refreshed daily: a developer who stops contributing drops out of the count after 90 days of inactivity, and a new team member is counted as soon as their first commit is ingested.
Public Monitoring: monitored developers
A monitored developer is a GitHub profile linked to your company, including current and former employees, whose public GitHub activity is continuously scanned for exposed secrets. This covers their personal projects, open-source contributions, and testing activities.
If your count looks higher than expected, contact your Customer Success Manager or support@gitguardian.com.
Legacy plans
The former Free, Business, and Enterprise plans are no longer offered. If your workspace is still on one of them, reach out to your account team to migrate to one of the new plans and unlock the full benefits of the GitGuardian platform, such as AI-powered investigation and remediation, NHI governance, and endpoint protection. You can also contact our sales team.