Every token counts.
Governance isn't the paid add-on.
Tokenality is in stealth. Hosted design-partner access from $99/mo. A free open-source Lite edition is planned for the post-stealth public launch. Audit trail, PII protection, hard budgets, binding-key envelope — on every tier, by default.
Included in every tier — not a paid add-on
Lite Edition
Free · open source · post-stealth launch
An open-source Lite edition is planned for release as part of the post-stealth public launch. It will include the core governance primitives (spend tokens, PII pre-flight, MCP allowlist) with the same wire-level surface as the hosted product.
- Planned scope (subject to change before launch):
- Core gateway surface — OpenAI, Anthropic, Gemini, Bedrock, Azure OpenAI
- Spend Tokens with binding-key second factor (envelope v2)
- PII pre-flight — fail-closed detectors
+ 4 more included
- MCP gateway with PKCE consent
- SQL-layer append-only audit
- SOC 2 control-collector subset
- Single-org, single-Postgres self-host
Not included (6)
- Managed Tokenality-hosted dashboard
- Multi-org / business-unit segmentation
- HRIS / SaaS connectors
- SAML / SCIM enterprise identity
- Continuous-evidence pack across all four frameworks
- KMS-backed key custody (planned — Phase 6.1)
Hosted
Design partner access · invitation-based during stealth
We host the gateway and the dashboard. You point your SDK at api.tokenality.ai and your CFO at app.tokenality.ai. Full governance layer, hosted and managed.
- Full Tokenality gateway, managed and hosted
- Chargeback CSV — by month, quarter, or custom range
- GL allocation rules — Finance writes them, engineers don't notice
- SaaS connectors — GitHub Copilot, Cursor, M365 Copilot, ServiceNow, AgentForce
+ 7 more included
- HRIS connectors — BambooHR / Workday / Rippling ingest (auto-revoke on roadmap)
- Multi-org (up to 10 Clerk orgs / business units)
- MCP gateway with audit timeline + anomaly inbox + audit-CSV export
- Continuous-evidence pack across all four frameworks
- Bearer-token API for Drata / Vanta / your own scrapers
- Per-task / per-Jira-epic attribution + clickable rejection drilldown
- Email support · onboarding call
Team
Growth teams · SSO included · unlimited orgs
Everything in Hosted, plus SSO, unlimited orgs, and 10× the volume. For teams that outgrew self-service but aren't ready for procurement.
- Everything in Hosted
- SSO — Google Workspace, Okta, Microsoft Entra ID via Clerk Enterprise
- Unlimited Clerk orgs / business units
- 1M gateway calls / month included (Hosted is 100k)
+ 5 more included
- Semantic cache short-circuit enabled by default (typical 40-80% cost cut)
- Priority chat support — same day response, first business day resolution
- Team-shared allocation rules with change history
- MCP policy admin UI with role-based grants
- Onboarding call + Slack Connect channel
Not included (4)
- BYOC Helm chart deploy (planned)
- SOC 2 Type II evidence pack export
- Dedicated CSM
- Custom MSA / SLA
Enterprise
Procurement · MSA · SLA · dedicated CSM · KMS & BYOC planned
For regulated orgs, SOC 2 Type II audits in flight, or multi-business-unit AI deployments that cannot afford an incident.
- Everything in Hosted
- KMS-backed envelope encryption — AWS KMS, Azure Key Vault, GCP Cloud KMS (planned — Phase 6.1)
- Identity providers — Okta · Entra ID · Auth0 · Google Workspace · Custom SAML/OIDC via Clerk Enterprise
- SAML / SCIM via Clerk Enterprise — identity lifecycle management
+ 7 more included
- BYOC — Helm chart for EKS / GKE / AKS / k3s (planned)
- Unlimited orgs, business units, cost centres
- Custom model allowlists per org with change-control workflow
- SOC 2 Type II evidence pack — six CC controls live, audit support
- Direct GL push — NetSuite + QuickBooks + Workday Financials
- Dedicated support channel + named CSM + onboarding lead
- Custom MSA, BAA available, SLA negotiable, security review package
Frequently asked questions
What does "in stealth" mean for pricing?
Tokenality is currently in stealth. Hosted, Team, and Enterprise tiers are available via invitation-based design-partner access — we work directly with a small cohort of customers rather than public self-serve signup. The pricing on this page is the intended structure for the post-stealth public launch. If you'd like design-partner access now, request a demo.
What's the Lite edition, and when will it ship?
An open-source Lite edition of Tokenality is planned for release as part of the post-stealth public launch. It will include the core governance primitives (spend tokens, PII pre-flight, MCP allowlist, SQL-layer audit) with the same wire-level surface as the Hosted product. Ship date, exact scope, and license are not yet committed. Request a demo to be notified when it releases.
What AI providers are supported?
Native invoker for Anthropic Claude; OpenAI GPT, Google Gemini, Azure OpenAI, and Amazon Bedrock through the governed proxy. Pass-through to 300+ models via OpenRouter and 1,600+ via LiteLLM with one env-var flip. The envelope discipline (binding-key second factor, append-only audit, allocation rules) wraps every call — your CFO sees the same chargeback row whether the inference ran through us directly or through OpenRouter via us.
Is governance actually enforced, or just logged?
Enforced. Spend Tokens are hard stops — the gateway returns 402 before the call leaves your network when the budget is exhausted. The binding-key second factor (envelope v2) means a leaked token without the binding key fails closed with a structured 401, every rejection logged to request_logs.binding_status for the auditor. PII detection is fail-closed — if the engine cannot evaluate a request, it blocks. Audit tables use REVOKE at the database role level; the application literally cannot UPDATE or DELETE those rows.
What does the continuous-evidence pack include?
Six SOC 2 controls live (CC6.1, CC6.6, CC6.7, CC7.2, CC7.3, CC8.1), three ISO 27001 controls (A.8.15, A.8.34, A.5.34), two ISO 42001 controls (A.6.2, A.6.2.5), and four NIST AI RMF collectors (GOVERN-1.5, MAP-3.4, MEASURE-2.7, MANAGE-4.3). The bundle is signed with SHA-256 over the canonical JSON form; auditors run vis-verify offline to confirm the fingerprint. Enterprise customers get the SOC 2 Type II evidence pack assembled against the audit window.
Do I need to pay for every seat?
No. Hosted and Team tiers are priced flat, not per user. Your entire Finance team, Security team, and Engineering org share one deployment — no seat count, no user licenses below Enterprise.
Can I use my own KMS?
It's on the enterprise roadmap (Phase 6.1). The KeyProvider interface is built to swap in AWS KMS, Azure Key Vault, or GCP Cloud KMS; today every tier uses envelope encryption with a per-org DEK in our key store, rotated quarterly. If customer-held keys gate your procurement, raise it in the design-partner conversation — that's exactly what prioritizes it.
Is there BYOC for regulated workloads?
Enterprise BYOC ships as a Helm chart for EKS, GKE, AKS, and k3s. Your customer's data never leaves their cluster; we provide the chart, the operator runbook, and the optional managed-support tier.
How long does the deploy actually take?
5 minutes for Hosted onboarding — point your SDK base URL at api.tokenality.ai and you have a working audit trail before the coffee is gone. Enterprise onboarding includes guided deployment assistance — we walk through KMS provisioning, SCIM, BYOC if applicable.
Is there a trial?
Design-partner access includes a stealth-phase trial arrangement negotiated per customer. Post-launch, Hosted at $99/mo will have no annual commitment. Request a demo to discuss design-partner terms.
Need to run this past procurement?
We can provide a vendor questionnaire response, a security review package, or a direct conversation with your compliance team. 30 minutes, no pitch deck.
Request a Demo →