Question 1

How does billing work?

Accepted Answer

Choose monthly billing or an annual commitment via Dodo Payments. Annual plans charge the full year upfront; the monthly equivalent is shown for comparison. Credits follow your allowance and billing schedule. Annual invoicing is available on Teams / Enterprise plans.

Question 2

What happens when I upgrade mid-cycle?

Accepted Answer

Upgrades take effect immediately. You're charged a prorated amount for the days remaining in your current period, and the higher credit allowance and concurrency limit are unlocked instantly. The next renewal is charged at the new plan's full price.

Question 3

What happens when I downgrade?

Accepted Answer

Downgrades are scheduled for the end of your current paid period — you keep the higher plan's credits and concurrency until then. On the renewal date, the cheaper plan and its limits take effect. You can cancel a scheduled downgrade any time before it lands.

Question 4

Can I cancel anytime?

Accepted Answer

Yes. Cancel from the Billing page; you keep full plan access through the end of the current billing period, and any one-time credit-pack balance stays available indefinitely. There are no cancellation fees.

Question 5

Will I get a refund if I cancel?

Accepted Answer

Subscriptions are non-refundable for the current period, but you keep access until it ends. One-time credit packs are non-refundable once delivered. For billing disputes, email billing@xalgorix.com within 14 days.

Question 6

What payment methods do you accept?

Accepted Answer

All major credit and debit cards via our PCI-compliant processor (Dodo Payments). Annual ACH/wire invoicing is available on Teams / Enterprise plans — contact sales@xalgorix.com.

Question 7

How do credits work?

Accepted Answer

Single scan = 1 credit. Wildcard scan = 1 credit per live subdomain, charged upfront when the scan starts and only refunded if the scan fails.

Question 8

What counts as one scan?

Accepted Answer

For Single, one target running through every selected phase. For Wildcard, you're billed per live subdomain discovered during recon — if recon finds 8 hosts but only 3 resolve and respond, you pay 3 credits. A completed wildcard scan costs at least 1 credit even if no subdomains respond.

Question 9

Do unused subscription credits roll over?

Accepted Answer

Yes — unused subscription credits carry over to the next billing cycle, and your monthly allowance is added on top each renewal. One-time pack credits never expire either.

Question 10

What's the concurrent scan limit?

Accepted Answer

Starter runs 1 scan at a time, and Pro runs 3 (with custom concurrency available for Teams / Enterprise). New scans queue automatically once you hit your plan's ceiling and start as soon as a slot frees up. Upgrades raise the limit immediately.

Question 11

What happens if I run out of credits?

Accepted Answer

New scans are blocked until you top up. You can buy a one-time credit pack from the Billing page (delivered instantly) or upgrade your plan for a larger monthly allowance plus higher concurrency.

Question 12

Do you offer a free trial?

Accepted Answer

You can try a single full scan for $1 with a one-time credit pack — no subscription required, and the credit never expires. For larger evaluations, a $10 pack gives you 10 scans. All plans unlock the full 22-phase methodology.

Question 13

Is it safe to run Xalgorix against production applications?

Accepted Answer

Yes. Xalgorix uses non-destructive proof-of-exploitation payloads. It verifies vulnerabilities (such as authorization bypasses, SQL injections, or secret leaks) by proving the vulnerability path without modifying or destroying application state, dropping database tables, or performing denial-of-service. Built-in rate limiting and an instant kill switch protect your infrastructure.

Question 14

Can I use Xalgorix reports for SOC 2, ISO 27001, or vendor security reviews?

Accepted Answer

Yes. Xalgorix produces audit-grade executive and technical PDF reports complete with timestamps, tested endpoints, OWASP/CWE taxonomy, methodology disclosures, and proof-of-concept evidence. Many founders and engineering teams use Xalgorix to satisfy annual pentest requirements and clear vendor security questionnaires (VSQs) with enterprise procurement.

Question 15

Can I scan a target I don't own?

Accepted Answer

No. You must have explicit written authorization for every target you submit. We log target ownership confirmations and revoke accounts that violate the AUP.

Question 16

Do you have a Teams or Enterprise plan?

Accepted Answer

Yes. Contact sales@xalgorix.com to discuss enterprise and team requirements such as multi-user workspaces, RBAC, SAML SSO, audit logs, custom scan concurrency, private deployment, and annual invoicing.

Feature	Starter	Pro	Teams / Enterprise
Organization workspaces & shared credits	—	—	✓ · Custom seats & pooled credits
Member roles & RBAC	—	—	Owner, admin, member, viewer
Findings retention	90 days	180 days	365+ days · Custom
Monthly scan credits	40 / mo	120 / mo	Custom volume
Concurrent scans	1	3	Custom concurrency
Scan modes	Single, Wildcard	Single, Wildcard	All modes + priority queue
All 22 offensive phases	✓	✓	✓
Exploit-verified findings	✓	✓	✓
Branded PDF reports	✓	✓ + custom logo	✓ + custom logo
Public share links	✓	✓ + password-protected	✓ + password-protected
Scheduled scans	Daily	Daily	Hourly & custom cadence
API access	✓	✓	✓ + dedicated rate limits
Slack / Discord / email alerts	✓	✓	✓
Audit log	—	—	✓
SSO / SAML & SCIM	—	—	✓
Annual invoicing (ACH / Wire / PO)	—	—	✓
Support	Email · 48h	Priority email · 24h	Dedicated engineer & Slack channel

Managed security testing. A plan that fits your work.

Choose how you use Cloud

Occasional work

Regular testing

Teams & Enterprise

Traditional pentests cost $10,000–$25,000 and take 3–4 weeks.

Subscriptions

Teams / Enterprise

Credit packs

Compare plans

Pricing FAQ

Need a private deployment?