Start free.
Pay only for volume.

Your website asks Maskbreak about a visitor at signup, login or checkout. Maskbreak answers whether that visitor is hiding behind a VPN, proxy, Tor or cloud server — naming the service when it is known — and whether the browser is a bot or a fake, then returns allow, review or block. A VPN on its own returns review; proxies, Tor, bots and tampered browsers return block. Your code decides what to do with that answer.

Yes. On a live visit Maskbreak identifies VPN, proxy, Tor and datacenter connections and names the service (for example Proton VPN or Bright Data) when it is known. A normal home or mobile connection adds nothing to the risk score.

Yes, with fewer checks. An address lookup (GET /v1/lookup/{ip}, or the MCP lookup_ip tool) checks any public IP address from your own server or scripts. It tells you whether the address is a Tor exit (block) and whether it sits in a cloud provider’s published range, with the provider named (review). It does not tell you whether an address is a VPN or a proxy: that answer, with the service named when it is known, comes from the live visit check, which needs our script on your page. An address on neither list comes back known: false, which does not mean it is safe. See the IP reputation API.

One live call to /v1/evaluate is one check. Address lookups (/v1/lookup and the MCP lookup_ip tool) check the Tor exit list and the cloud providers’ published ranges and have their own allowance, ten times the checks. Test-key calls that run the real pipeline count too; the fixed test_* tokens and the public sk_test_sandbox key never do. Loading the browser script on your pages does not count, only your backend calls.

Past the hourly limit you get HTTP 429 with a Retry-After header until the hour turns. Past the monthly allowance you get HTTP 429 with the code monthly_quota_exceeded until the 1st of the next month (UTC), or until you upgrade, which takes effect at once. We email you at 80% and when the allowance is used up. There are no overage charges.

Yes, any time, under Settings → Plan and billing. An upgrade takes effect at once and Stripe charges the prorated difference. Cancelling keeps the plan until the end of the period you paid for; then the account returns to Free.

On Stripe’s secure checkout page, by card, Apple Pay, Google Pay or Link. Paid plans are sold through Stripe’s Managed Payments: Stripe, shown as Link, is the merchant of record, adds the VAT or sales tax that applies where you are, and emails the receipts and invoices (they are also in the billing portal under Settings). Prices are set in euros and exclude tax; yearly billing costs ten months. Enterprise can be billed by invoice.

Nothing until 30 November 2026: your account keeps the allowance it signed up with, 1,000 checks an hour and no monthly cap. From 1 December it follows the Free plan (10,000 checks a month, up to 1,000 an hour) unless you choose a paid plan. Settings shows your current allowance.

No. Every plan has every signal, the same verdict engine, device intelligence, webhooks, the SDKs and the MCP server. Plans differ only in volume.

That is Enterprise, from €990 a month: an allowance and an hourly limit set to your traffic, a countersigned DPA and billing by invoice. Write to us with roughly what you are protecting and the volume you expect.

For public-interest organisations, yes. Hospitals and health systems, public health and medical research, government at any level, election authorities, emergency and crisis services, universities and registered non-profits fighting abuse can apply on the public-interest program page to have the hourly and monthly caps removed from their key, free. Institutional email domains are fast-tracked and the answer takes a business day. Everyone else uses the plans above.

Yes — self-serve. Our DPA is aligned to UK GDPR / EU GDPR Article 28, includes the applicable international-transfer terms and the current sub-processor list with regions, and is published at maskbreak.com/dpa, where it binds on acceptance with no signature required. A PDF is available for vendor files, and a countersigned copy from support@maskbreak.com. Our Cookie Policy separately describes providers used by the public website.

None. Maskbreak is pre-audit for SOC 2 Type II. We do not currently hold SOC 2, ISO 27001, HIPAA BAAs, or PCI DSS attestation, and we will not claim otherwise. We will publish the audit firm and scope when an engagement is signed.

Application infrastructure runs on Railway and the primary database is Cloudflare D1, both in the United States (US East); our detection providers are US-based, and encrypted backups are stored in the EU (Stockholm). Card payments are handled by Stripe, which holds the card details; Maskbreak never sees them. EU-only processing is not available today; transfers are covered by Section 10 of the DPA. The full sub-processor list — with each region, a dated change log and 30-day advance notice — is published at /sub-processors.

Email support@maskbreak.com with the subject prefix [SECURITY]. Full scope, response targets, and safe-harbour terms are documented at /responsible-disclosure.