Free vs Pro

The split is a module boundary, not a configuration switch. The free core is a complete program that does not contain the Pro code, rather than a crippled build with features switched off.

That distinction matters in both directions: the open core is genuinely auditable because it is all there is, and a Pro module that is not licensed simply does not register — it does not half-work.

Free: the open core

Licensed AGPL-3.0, and fully functional without a licence key. There is nothing to activate, nothing to register for and no key to buy: the free core is a complete program, and it never asks a server whether it may run.

Area	Included
Ingest	Transport, packet source, firewall IDS events, NetFlow/IPFIX, resolver query logs, generic syslog JSON
Storage	The complete database schema, migrations, freely configurable retention
Inventory	Passive device discovery, first and last seen, classification, owner, behaviour groups
Detection	Hour-of-week baselines, rarity, scan and beaconing detection, the YAML model language including your own models, isolation forest, behavioural clustering
Incidents	The full incident workflow, revisions, approval history, evidence views
Interface	The globe, the network map, live traffic, replay, search, device and incident detail, health
Response	Proposals and decisions. No execution.
Identity	Device identity clusters in the DHCP, mDNS and fingerprint base form
Connectors	Firewall feeds, packet source, NetFlow/IPFIX, resolver, hypervisor mirror, notification topic, generic webhook, Prometheus metrics
Operations	The appliance installer, backup and restore documentation, health dashboards, single-tenant operation

The intent is explicit: the free core has to be worth recommending on its own. Someone who never pays should still have a good product — that is the distribution mechanism, not a loss.

The one thing the free core does do over the network is register itself and send one small daily heartbeat, which you can switch off with NDR_TELEMETRY=off. Exactly what it contains is written out field by field under instance registration and telemetry.

Pro

Private modules, subscription, gated by an online licence check. Part of what Pro sells lives on the server rather than in the binary — threat-intel feeds, model packs and the analyst quota — which is why it needs a working internet connection where the free core never does. See licensing for the mechanics.

Module	Contains
Cyber AI Analyst	The language-model analyst with budget control, incident narratives, triage proposals, the model author
Email Security	The mail security module
Response execution	The firewall companion, the executor, feedback calibration, rollback
Connector pack	Controller, router and gateway integrations, DNS filters, home automation, overlay networks, identity providers, threat-intelligence sources
Multi-site	Several sites or tenants in one installation, cross-site peer groups
Endpoint agent	A first-party agent for software inventory, patch level and process-to-flow attribution
Outputs and export	Chat and mail sinks, SIEM export, PDF reports
Support	Prioritised response, migration help

Extensions are the same mechanism with their own feature name in the entitlement: narrower add-ons such as device-class model sets, maintained signature packs, report templates, or third-party threat-intelligence sources that carry their own licence cost. They can be bought individually instead of taking a whole tier for one of them; the larger tiers include the bundle.

Pricing

The planned shape. Nothing here is purchasable yet:

Plan	Planned price	Contains
Free	$0, AGPL-3.0	The open core above, fully functional without a key
Basic	$15 / month	The Pro modules on top of the core
Higher tiers	$35 / $55 / month	More seats and instances, more connectors, the extensions bundle, a higher analyst quota
Extensions	Individually	Single add-ons on their own, or included in the larger tiers

Note

This is roadmap information and not a purchase offer. There is no checkout: the billing path, the licence service and the purchase flow are a planned milestone, not a shipped feature, and the figures are planned prices rather than a price list. The module split will be published together with the licence before anyone is asked to pay.

What is never behind the paywall

Stated as a commitment, because a product that sells these is a trap:

• Security updates.
• Bug fixes in the core.
• Migrations.
• Backup and restore.
• The documentation.
• The ability to export your own data.

Selling data export to someone who wants to leave is the thing that makes a self-hosted product untrustworthy, and it is off the table.

When the entitlement lapses

Never by breaking what already works. See licensing — the short version is that an unreachable licence server costs nothing for 72 hours, after which Pro modules go read-only while existing data and reports stay visible and exportable, and the free core continues unchanged the whole time.