Buy a single scan, top up credits as you go, or keep a monthly allowance for continuous review. Enterprise adds your own hosting, tenancy, and model keys.
A release or an audit
One surface or deep scan, delivered as findings your team can review. No subscription.
from$500
per surface scan
Deep scan priced by scope
Occasional usage
Buy credits when you need them and run the full credit-based workflow without a commitment.
Credits
bought as needed
Estimated before every scan
Includes
Continuous review
RecommendedA monthly credit allowance for teams that review every change and ship fixes on a cadence.
Monthly
credit allowance
Discounted annual billing
Everything in Pay as you go, plus
Regulated teams
Committed usage with the deployment, identity, and support terms your review requires.
Custom
committed usage
Terms set in your agreement
Everything in Recurring, plus
Pay as you go and Recurring plans draw from a credit balance. Every scan is estimated up front, held while the agents work, and settled to what it actually used.
One-time scans are quoted before work begins, so there is nothing to reserve or reconcile.
Credit lifecycle ยท per scan
Sized from changed files, lines of code, and comparable past scans.
The estimate is held against your balance for the run.
The charge settles to final usage when the scan completes.
Every plan runs on the same agents. What changes is how you pay, how often you scan, and where it runs.
Swipe the table sideways to compare all four plans.
| Capability | One-time | Pay as you go | RecommendedRecurring | Enterprise |
|---|---|---|---|---|
| Pricing and commitment | ||||
| Purchase model | One-time quote | Buy credits | Monthly or annual | Custom |
| Surface scan pricing | From $500 | Uses credits | Uses allowance | Custom |
| Deep scan pricing | Priced by scope | Uses credits | Uses allowance | Custom |
| Reusable credit balance | Not included | Included | Included | Custom allocation |
| Credit estimate before each scan | Not included | Included | Included | Included |
| Recurring commitment | Not included | Not included | Monthly or annual | Committed usage |
| Annual billing discount | Not included | Not included | Included | Custom |
| Scanning and remediation | ||||
| Surface scan | Included | Included | Included | Included |
| Deep scan | Included | Included | Included | Included |
| Application-aware code review | Included | Included | Included | Included |
| Business-logic and authorization investigation | Included | Included | Included | Included |
| Dependency scanning (SCA) | Included | Included | Included | Included |
| Incremental repository scans | Not included | Included | Included | Included |
| Scheduled scans | Not included | Included | Included | Included |
| Pull request review | Not included | Included | Included | Included |
| Reproduction evidence where feasible | Not included | Included | Included | Included |
| Suggested patch pull requests | Not included | Included | Included | Included |
| Workflow | ||||
| Findings workspace | Included | Included | Included | Included |
| Reports and analytics | Single report | Included | Included | Included |
| AI triage assistant | Not included | Included | Included | Included |
| Winfunc MCP | Not included | Included | Included | Included |
| GitHub App integration | Included | Included | Included | Included |
| Slack alerts | Not included | Included | Included | Included |
| Team access | Not included | Included | Included | Included |
| Support | Scan delivery | Standard | Standard | Named contact |
| Data and deployment | ||||
| Data retention schedule | Confirm scope | Confirm scope | Confirm scope | By agreement |
| Model-provider data terms | Confirm scope | Confirm scope | Confirm scope | By agreement |
| Customer-controlled hosting | Not included | Not included | Not included | Included |
| Isolated tenants | Not included | Not included | Not included | Included |
| Bring your own model keys | Not included | Not included | Not included | Included |
| Organization-wide policies | Not included | Not included | Not included | Included |
| Contracted response terms | Not included | Not included | Not included | Included |
Review access, retention, model-provider data terms, and administrative events. Enterprise hosting, identity, isolation, and named-support options are scoped by agreement. Use the procurement pack and current Trust Center materials for your evaluation.
Identity and access
Repository-scoped access
Authorize selected repositories and review user and administrator permissions before expanding scope.
Federated identity optionsEnterprise
Confirm the identity provider, protocol, and configured deployment in the enterprise agreement.
User lifecycle reviewEnterprise
Agree provisioning, deprovisioning, session invalidation, and access-review responsibilities.
Revocable MCP keys
Read-only MCP keys are stored as SHA-256 digests and support revocation. Review other credential types separately.
Data protection
Retention by data category
Working copies, caches, findings, resume state, operational records, backups, and provider data need an agreed lifecycle.
Model-provider terms
Agree the provider/account, processing region, training-use restrictions, and retention before granting access.
Credential protection
Onboarding test credentials support authenticated encryption when storage is configured. Confirm other storage and transport protections.
Event and trace boundaries
API event metadata excludes bodies and credential headers; agent/session traces are separate retained artifacts to review.
Deployment and models
Customer-controlled hostingEnterprise
Hosting and infrastructure, access, upgrade, and support responsibilities are scoped by agreement.
Isolated environmentsEnterprise
Review the proposed network, storage, identity, model, and administrator boundaries.
Bring your own model credentialsEnterprise
Confirm providers and account controls. Customer-owned keys alone do not establish private inference or zero retention.
Open-weight model evaluation
Public research used open models. Confirm the proposed endpoints, infrastructure, and supported workflow for your deployment.
Oversight
Administrative event review
Confirm event coverage, access, retention, filtering, saturation behavior, and export for the deployment.
Customer change approval
Agree read and pull-request permissions separately. Keep patch review, verification, and release approval with your team.
Policy and scope controls
Agree review policies, permitted actions, test environments, exceptions, and reporting for the purchased workflow.
Named supportEnterprise
Support, escalation, response targets, and incident-notice terms are confirmed in the contract.
SOC 2 Type II audited
Trust Center
Terms to agree for your deployment
We review your codebase, security goals, and expected scan volume, then show how winfunc fits your workflow. From there we recommend a one-time scan, pay-as-you-go credits, recurring coverage, or an Enterprise agreement.
A surface scan from $500 or a deep scan priced by scope, plus the findings workspace and report. It does not include a reusable credit balance, Winfunc MCP, suggested patch pull requests, the AI triage assistant, or ongoing incremental, scheduled, and pull request review.
Both use the same credit-based workflow and include the same capabilities. Pay as you go lets you buy credits when you need them. Recurring renews an agreed allowance every month, with a discount for annual billing.
Before a scan starts, winfunc estimates its credit cost from the changed files, the lines of code, and comparable previous scans. Those credits are reserved for the run, then reconciled to the final usage when the scan completes.
Yes. Recurring is billed monthly by default, and an annual commitment receives a discount. The exact allowance and discount are confirmed on the pricing call.
Enterprise includes everything in Recurring plus committed-usage pricing, customer-controlled hosting, isolated tenants, bring-your-own model keys, organization-wide policies, and a named support contact with contracted response terms.
Agree training-use restrictions and retention for the selected model provider and account before granting code access. Source working copies, caches, retained findings, resume state, and backups have different lifecycles. The procurement pack lists the data categories and deployment-specific terms to review.
They are available today, alongside SAST, SCA, IaC scanning, and red, purple, and blue team engagements. We scope them with you on the pricing call together with the rest of your coverage.
Tell us about your repositories and review cadence. We'll recommend a one-time scan, credits, recurring coverage, or Enterprise, and walk through how credits are estimated.