Pricing and plans

Aevral has two products, each priced by organization, never by seat. PR security review is priced in USD with included private reviews per month; its free tier is live from install, and its paid plans are live in the console. Whole-repo scans are priced in USD with included scans per month. One GitHub App and one console for both. Neither product requires the other, and the free PR review tier needs no subscription at all.

Access is self-serve: install the GitHub App, then sign in to the console with GitHub; it connects the matching install automatically.

Since 2026-10-02 all prices on this site display in USD, amounts unchanged. These numbers and rules were reconciled against the billing implementation on 2026-09-06 and checked against the console Billing page on 2026-09-25. The canonical marketing source is aevral.com/pricing. The PR review plans below are the October 2026 plans for new organizations. In the console, Billing has two tabs: PR reviews (the default) and Scans, each with its own plan, usage meter and plans list.

PR security review, USD per organization per month, excluding VAT

PR security review is Aevral's lead product. It needs no scan plan. Installing the App starts PR reviews, before anyone signs in (25 free private reviews a month); connecting the install in the console keeps them on. An opt-out stays off while the App stays installed; reinstalling the App turns reviews back on. Setup Complete or the Reviews page can turn them off. The App install must have accepted Pull-requests write. Reviews are never counted as scans, and scans are never counted as reviews: a review is never one of the included whole-repo scans of a scan plan.

Public repositories are free, 500 reviews per organization per month. Before anyone signs in, 25 private reviews a month are free. Connecting the install in the console starts a 14-day trial: private reviews are free up to 500, and the trial ends at 14 days or 500 reviews, whichever comes first. After the trial, 25 private reviews a month are free (trial-covered reviews do not consume the subsequent Free allowance); past that, a pull request gets a neutral Check and no review until the next month. No card. Paid plans are purchasable in the console. The billable-review definition and the extras choice are shown before purchase. Paid plans are billed monthly. The paid tiers are volume allowances of the same review; they differ by included reviews, and Business and Scale add a monthly export (CSV) of the security reviews Aevral ran on your pull requests, with coverage and results, that may serve as supporting evidence for automated security testing in audits (for example ISO 27001 A.8.29, SOC 2 CC8.1). The export is an automated record of the reviews, not an audit opinion. Business and Scale will offer EU-only processing when it is available; it is not live today. Every paid plan includes the standard DPA; a custom DPA is Enterprise. Enterprise starts at $4,000 a month, by quote through the Aevral contact form, not self-serve: a custom DPA, and SSO when it is available. These plans apply to new subscriptions; existing subscriptions keep their price. Upgrading an existing subscription keeps its own price list, so an organization on an older price list does not see Scale.

What counts as a review on a paid plan: one pull request per billing period. Every push to that pull request is still reviewed, and re-pushes do not count again. A review counts whether or not it found anything.

What counts as a review on Free and during the trial: one pull request head (repository, pull request number, head commit). A new push is a new head and, if it is processed, a new review; the same head is never counted twice. A pending review for an older head is skipped without charge when a newer push arrives. A review holds its slot while it is pending or running and releases it if it is skipped or fails before posting; a posted review counts whether or not it found anything. The free allowance resets on the first day of each calendar month (UTC).

Past a paid plan's PR reviews:

• First overrun. The first time an organization goes over its plan, it gets an extra quarter of the plan's PR reviews free, once.
• Extras. After that, $0.99 per extra PR review if the owner chose extras. Extras are off unless the owner turns them on, at checkout or later in the console. Extras stop at a monthly spend cap the owner can change in the console. Extras are available on every paid plan.
• Pause. Without extras, reviews pause until the next billing period, and the pull request gets a Check explaining why.
• Top plan. Scale is the highest self-serve plan (Business for an organization on an older price list): at its limit, the path is extras or contact us about Enterprise.

What a review does: What a PR review looks like.

Whole-repo scan plans, USD per organization per month, excluding VAT

Team, Business and Scale can be bought in the console. Private repositories start at Team. Team, Business and Scale differ by included volume and by the price of an extra scan; every plan carries the same product. Team, Business and Scale all support recurring repository scans, sharing the included scan allowance with manual scans.

What every scan plan carries:

• Whole-repo authorization / IDOR / business-logic scan on a default branch you authorized and triggered
• GitHub Check and console report with evidence
• Fix prompt for Claude Code, Cursor, or Codex
• Open-source models, run in the US today (EU-only processing announced, see aevral.com/security)
• Priced by organization, not by seat

Public repositories here means authorized public repositories, not that the Aevral service is open source. Authorization is required to scan. Findings are not auto-published.

Enterprise is sold by quote, not self-serve: a quote is a conversation with us through the Aevral contact form. The Enterprise console features (SSO / SAML, RBAC, audit log, multiple GitHub organizations, invoice / PO tooling) are not shipped yet. Extras coming soon on Business and Scale: directory scope, Slack or webhook, CSV / Markdown export, documented dismissals.

What counts as a scan, and when it resets

A scan counts when it is newly admitted: you press Scan on a commit that has not been scanned in the period and it is accepted. Pressing Scan again on the same commit in the same period returns the existing scan and counts nothing. A scan that ran counts whether or not it found anything and whether or not it completed; only a scan that never ran is refunded.

Included scans reset with the plan's billing period on Team, Business and Scale, and with the calendar month on Public repositories. No rollover.

Recurring scans and quota

Choose repositories once in the console. Each schedule checks at up to four checkpoints per billing month: the subscription period start plus 0, 7, 14 and 21 days. Enabling a schedule picks the next future checkpoint; it does not replay missed ones. After the fourth checkpoint, the next opportunity is the next billing period. This is not a weekly guarantee in five-week months.

Automatic scans use the same included allowance as manual scans. An unchanged commit reuses the existing report for that period, without consuming another scan. If included quota is exhausted, recurring scans pause until renewal. They never authorize extra charges or consume the private-scan trial. An owner or admin can pause a schedule, including after cancellation or removal of the GitHub installation. The console shows the next checkpoint and latest actual outcome.

A new free organization can run two private whole-repo scans in 14 days (failed scans count). After that, Team. A paid organization's first scan uses its included allowance. Public repositories stay 1 authorized scan per calendar month. There is no permanent free weekly private scan plan.

Monthly cap on extra-scan spend

Every paid organization can set a hard monthly cap on extra-scan spend, in the console under Billing. Only the organization owner can change or remove it. An extra scan that would push the period's extra-scan spend past the cap is refused with the exact numbers named; included scans and the free public-repo scan never touch the cap. Billing also shows the extra-scan amount billed so far in the period and alerts at 50, 75, 90, and 100 percent of the included allowance. The cap covers extra scans only; PR review has separate paid allowances and excess-review authorization.

Common terms

• One currency: scans and PR review both bill in USD, per organization per month.
• VAT: all prices exclude VAT. B2B.
• Extra scans: manual extra scans need explicit confirmation and respect the scan spend cap. Extra PR reviews require the owner's explicit extras choice. Scheduled scans never incur overage.
• Enterprise: quoted from $3,300 per month equivalent (200 scans and up, $16.50 per scan minimum), annual commitment, invoice billing, via the Aevral contact form; there is no separate sales mailbox.

Questions: Aevral contact form.