Start with judgment for free. Prove governed execution with us.
Every conversation starts with the product already judging your changes. Right now we are taking on a small number of design partners on real EKS environments; Professional and Enterprise plans are scoped with you, not bought from a page.
Starter
No credit card · judgment on your changes
- Preflight: judge a change by hand, with nothing connected
- SHIP / HOLD / BLOCK on every GitHub pull request, with the outcome joined back to it
- Verdict from any pipeline or agent with one call
- Permanent change records and history
- Slack, Teams and webhook notifications
Design partner
A small number of teams running Kubernetes on AWS EKS
- Everything in Starter and Professional, on one real environment
- AWS Account Center and Connected Environments — read-only Fleet evidence
- Permit-governed execution with the Cloud Executor, Advise by default, Auto within your policy
- Observed, verified outcomes and a measured outcome record
- Direct engineering access; you shape what ships next
Professional & Enterprise
By environment count, after a design partnership or a conversation
- Connected environments with Fleet evidence; optional Edge collector
- Permit-governed execution: Cloud Executor or Local Executor
- Incidents attributed to changes, verified remediation, audit trail with CSV / JSON export
- Posture scanning and compliance evidence export (with Edge)
- Engineering Advisor & judgment capabilities (Early Access)
- SSO / SAML, self-hosted inference (roadmap)
Plan scope is indicative; we confirm the exact scope with you. Items marked Early Access or roadmap are labeled honestly and are not sold as generally-available features. Upgrading from the trial is a conversation today, not a checkout.
Common questions
Does the free trial touch my environment?
No. Preflight and GitHub verdicts work with nothing connected. Connecting an environment is a read-only grant you make and can revoke per cluster. Nothing executes in any environment without a Permit, and Permits exist only where you enable execution.
Can it block our deploys?
A verdict is a judgment. In your pipeline you choose whether a BLOCK fails the job — the shipped GitHub Action does by default and can run purely advisory. Execution that ChangeGuard performs itself is a separate authority, bound to a Permit.
How do you handle our data?
ChangeGuard receives environment state (workloads, events, quotas, posture findings) and change metadata from your pull requests and pipelines, tenant-isolated at the database with row-level security. Source code and secret values stay in your environment; the Executor is denied reading Secrets at all. See Security & trust.
Do you have SSO, an SLA or a certification?
SSO/SAML is on the roadmap. We hold no formal certification today and do not claim one. For SLAs, attestations or a DPA, talk to us and we will tell you exactly what is available.
See value first, talk later
Judge a change for free in the next five minutes — or bring one real environment and prove the whole loop with us.