Forensic-grade capture, without forensic-grade invoices.

Deploy GhostLogic where it matters, pay for what you actually use, and keep every frame of the story when things go sideways.

All paid plans are billed quarterly. No credit cards. No automatic renewals.

PREMIUM SERVICE

Forensic Timeline Reconstruction

Full operator-grade forensic timeline reconstruction.

$7,500 – $12,500

Full operator-grade forensic timeline reconstruction across all available logs, artifacts, and correlated evidence. Includes up to 3 endpoints. Additional endpoints billed per device. Delivered with a structured, lawyer-ready report and packaged evidence bundle.

Request Service

One-time engagement · Custom scoping available

OSS CORE

Community Hosted

Self-hosted GhostLogic core for analysts & small teams.

$99/quarter

Who it's for: solo DFIR, students, small blue teams. Self-hosted, you own the infra, we keep the core open.

✓Continuous evidence capture on endpoints
✓Timeline reconstruction & replay
✓Immutable, hashed evidence archives
✓Local storage (disk / NAS / object store)
✓CLI tools & YAML config
×Hosted dashboard & AI correlation
×Enterprise onboarding & SLAs

Get Started

Up to 25 endpoints · email support

MOST POPULAR

Professional

For DFIR shops, MSSPs, and serious blue teams.

$990/quarter

Who it's for: consultants and in-house teams who live in IR. We host the mesh. You run the investigations.

✓Managed GhostLogic mesh & updates
✓AI-assisted triage & anomaly correlation
✓Full incident replay & exportable timelines
✓Multi-destination evidence backup (R2, S3, cold)
✓Case-based organization for engagements
✓Email support with response-time targets
×Dedicated liaison & custom SLAs

Get Started

Up to 250 endpoints · priority support

SCALE & COMPLIANCE

Enterprise

Multi-tenant, regulated, and "see you in court" ready.

$9,900/quarter · starting

Who it's for: banks, critical infrastructure, MSPs, and anyone who expects opposing counsel. We treat your evidence like it will be read into the record.

✓Dedicated tenant & custom data residency
✓Notarized exports & deposition-ready kits
✓Custom retention, redaction & legal holds
✓Integration with your SIEM / EDR stack
✓Dedicated GhostLogic liaison & IR playbooks
✓Contracted SLAs & security reviews

Contact Sales

Unlimited endpoints (contracted) · white-glove onboarding

100% FREE & OPEN SOURCE

Community Edition — Self-Host for Free

The full GhostLogic forensic engine. Deploy it yourself, audit the code, contribute back. No restrictions. No phone-home. Perfect for students, researchers, or teams who want complete control.

View on GitHub →

Payment methods:

Crypto (BTC · ETH · USDC · XMR)

ACH

Wire

Zelle

Manual invoicing

No credit cards, no chargebacks, no surprises. Human-reviewed onboarding for every account.

What's actually included at each level?

Everyone gets the same core forensic engine. You're paying for scale, hosting, and how much help you want when things are burning.

Capability	Community OSS	Community Hosted	Professional	Enterprise
Core evidence capture & hashing	✓	✓	✓	✓
Timeline reconstruction & replay	✓	✓	✓	✓
Self-hosted, self-operated	✓	✓	×	×
Managed hosting & updates	×	✓	✓	✓
AI-assisted anomaly correlation	×	×	✓	✓
Multi-tenant / multi-org support	×	×	×	✓
Deposition-ready exports & notarization	×	×	×	✓
Dedicated liaison & custom SLAs	×	×	×	✓

Need something weird? Air-gapped? One-off breach investigation? Reach out. The mesh is flexible, and so is the pricing when the use case is interesting.