Plans & Pricing

Every CIFP subscription is built around one promise: your real credentials never leave hardened, isolated infrastructure you control. The tiers differ in how much of the platform you unlock — not in how seriously we take your security. Encryption, tenant isolation, and the credential-injection engine are identical at every level.

Tiers at a Glance

Annual billing saves 25% — Pro is $261/year and Pro+ is $351/year. Checkout is handled by Whop; manage or cancel any time from your dashboard.

Dev — $0

The Dev tier exists so you can build against CIFP without spending a cent. It is a genuine development environment, not a crippled demo:

• Local dev proxy — run the full credential-injection flow on your machine
• Complete API documentation access — every endpoint documented here works the same in production
• QA-safe checkout path — exercise your billing integration without real charges

What it does not include: hosted proxies, dedicated IPs, or the encrypted cloud secret store. When your integration works locally, a Test Drive is the natural next step.

Test Drive — $5 for 3 days

Test Drive is the recommended way to evaluate CIFP. For $5 you get every feature of the tier you choose (Pro or Pro+) on real production infrastructure for three days — a dedicated VM, a dedicated IP, the encrypted vault, the firewall engine, all of it. After three days it renews into the plan you picked at the billing cadence you selected.

• Try Pro — all Pro features, then $29/mo (or $261/year)
• Try Pro+ — Pro plus DNS filtering, then $39/mo (or $351/year)

There is nothing simulated about a Test Drive proxy — it is the exact machine you keep if you stay subscribed. Cancel before renewal and you pay only the $5.

Pro

Pro is the everyday workhorse. It unlocks the full proxy platform:

• Unlimited proxies — each on its own dedicated VM with a dedicated IP; no shared tenancy, ever
• Auto-auth credential injection — {$VAR} placeholders swapped for real secrets at the proxy layer
• Firewall mode with TLS inspection — full MITM interception with per-request policy evaluation
• CEL rule engine — allow, deny, or hold any request based on method, host, path, headers, or body
• Encrypted secret vault — AES-256-GCM at rest with per-tenant keys (see Security)
• Access logs and analytics — every request recorded with action, matched rule, and byte counts
• Isolated machines — hardware-level tenant separation, up to 26,872 credential-scoped ports per proxy
• Full API access — the entire control plane is scriptable; the dashboard is a client of the same API
• Priority support

Pro+

Pro+ contains everything in Pro and adds the network-layer defenses that matter when agents run unattended:

• CIFP DNS filtering — a private resolver that blocks malware, trackers, and custom domains before a connection is ever attempted (see DNS Resolver)
• Managed blocklist enforcement — curated blocklists kept current for you, plus Shannon-entropy DGA detection for algorithmically generated domains
• Advanced automated workflow controls — richer policy tooling for high-volume, fully autonomous pipelines
• Highest-priority support — front of the queue, every time

If your agents browse, install packages, or follow links autonomously, Pro+ is the difference between filtering requests you predicted and filtering the ones you didn't.

What Every Paid Tier Always Includes

These are platform guarantees, not features to be unlocked:

• Dedicated VM and IP per proxy — no resource sharing between tenants
• AES-256-GCM encryption at rest — quantum-resilient symmetric encryption for every stored secret
• Per-proxy revocable credentials — compromise one client, revoke one credential; real keys untouched
• IP allowlisting — restrict which source addresses may connect
• Expiry notifications — email/SMS alerts before secrets or credentials lapse
• Metrics endpoint — per-proxy observability for your monitoring stack

Choosing a Tier

Ready to decide? Head to the pricing page for checkout, or start with the Quick Start to see the flow end-to-end first.