Plans for solo analysts, teams, and MSSPs.
Start on Recon for free. Every paid tier adds more uploads, longer retention, and more seats. You can sign up, upgrade, or cancel from your account settings without ever talking to us.
Recon
Try it out with your own data.
- 2 uploads per day
- 48-hour data retention
- 1 workspace, 1 user
- Behavioral + JA3/JA4 scoring
- 1 custom log mapping
- 3 saved pair verdicts
- No threat-intel enrichment
- No exports
Hunter
For the person investigating threats.
or $1,490/year (save 17%)
- 10 uploads per day
- 90-day data retention
- Up to 3 team seats, 1 workspace
- All detection engines: JA3, JA4, JA4H, JA4X
- Unlimited threat-intel enrichment
- Unlimited saved pair verdicts
- 3 custom log mappings
- CSV exports (all pairs, flagged)
- PDF reports (executive, IR handoff)
- MFA
Operator
For a security team running this every day.
or $3,490/year (save 17%)
- Everything in Hunter
- Unlimited uploads
- 1-year data retention
- Up to 15 team seats, 5 workspaces
- Unlimited custom log mappings
- SSO / SAML
- MFA
Partner
For firms protecting multiple clients.
- Everything in Operator
- Tailored to your client roster and volume
- Unlimited uploads and volume
- 2-year data retention
- Unlimited team seats and workspaces
- Multi-tenant client workspaces
- API access for programmatic ingest
- White-labeled PDF reports
- SSO / SAML, MFA
Strixl Labs is in private beta. Existing customers are grandfathered in at their sign-up rate for 12 months after any future price change.
What you get at each tier.
The numbers that actually run in the engine. If a field is listed here, it enforces in code.
| Capability | Recon | Hunter | Operator | Partner |
|---|---|---|---|---|
| Uploads per day | 2 | 10 | Unlimited | Unlimited |
| Data retention | 48 hours | 90 days | 1 year | 2 years |
| Team seats | 1 | 3 | 15 | Unlimited |
| Workspaces | 1 | 1 | 5 | Unlimited |
| Custom log mappings | 1 | 3 | Unlimited | Unlimited |
| Saved pair verdicts | 3 | Unlimited | Unlimited | Unlimited |
| Threat-intel enrichment | — | Unlimited | Unlimited | Unlimited |
| CSV export | — | Yes | Yes | Yes |
| PDF reports | — | Yes | Yes | Yes |
| MFA | — | Yes | Yes | Yes |
| SSO / SAML | — | — | Yes | Yes |
| API access | — | — | — | Yes |
| White-label PDFs | — | — | — | Yes |
Pricing questions, answered plainly.
What counts as an upload?
One file is one upload. A PCAP or a bundle of Zeek logs from a single investigation counts as one upload. If a single capture exceeds what your plan can hold, split it, or bump to the next tier.
What happens if I hit my daily upload limit?
You get a tier-limit response and the upload is rejected. Nothing you've already uploaded is affected. Wait until midnight UTC or upgrade.
How long are my files kept?
Depends on the tier. Recon retains 48 hours, Hunter 90 days, Operator 1 year, Partner 2 years. Files and derived detection data are deleted on that schedule.
Do my uploaded files stay private?
Yes. Each workspace has isolated storage and an isolated scoring queue. We do not share, resell, or train on customer data. Details in the Privacy Policy.
Can I self-host?
Talk to us. Self-hosted or private-VPC deployments are case-by-case and priced on top of Partner. Email info@strixllabs.com to scope it.
How do I cancel?
Settings then Billing then Cancel. No sales call, no retention email chain. You keep access through the end of the billing period.