No. SOCWarden is not a WAF or firewall. It is your second line of defense, detecting and alerting on attack patterns that reach your application. It complements your existing perimeter security by providing deep visibility into what gets through.

Not at all. SOCWarden is designed for engineering teams with no dedicated SOC. It automates threat detection, risk scoring and alerting so you can focus on shipping your product instead of building security tooling.

All threat intelligence is included free. Tor exit nodes, Spamhaus DROP, Feodo C2, Emerging Threats, CINS Army, blocklist.de, GreenSnow, URLhaus, GreyNoise, Shodan InternetDB, Pulsedive, VPN/datacenter detection, disposable email checks and more. No hidden fees or premium tiers for threat data.

We offer SDKs for Laravel (PHP), Node.js, Python, Go, and Browser, plus a raw HTTP API that works with any language. The Laravel SDK is the most mature with automatic context collection and auth event listeners.

Event ingestion returns 202 Accepted in under 5ms. Enrichment (GeoIP, threat feeds, behavioral detection) happens asynchronously and typically completes within 200ms. Alerts fire within seconds of detection.

Email (all plans), Telegram (Starter+), Slack, Discord, Webhooks (Pro+), PagerDuty and Microsoft Teams (Business). All alerts include smart grouping and deduplication to reduce noise.

The SOCWarden agent is a lightweight agent binary that runs on your servers. It monitors SSH access, file integrity, process execution and Docker events, shipping all data to the same API endpoint. No separate infrastructure needed.

Yes. All traffic uses TLS 1.3+. API keys are bcrypt-hashed. Event data is isolated per organization with row-level security. We follow SOC 2 practices and support data export and deletion on request.

Yes! The Free tier is permanent (2,500 events/mo forever). Paid plans include a 7-day free trial with no credit card required.

Events exceeding your plan limit are billed at $0.20–0.50 per 1,000 events. On the Free plan, events exceeding 2,500/mo are dropped.

Yes. Monthly billing with no contracts. Cancel anytime from the billing page. Your data is retained for 30 days after cancellation.