Changelog

A plan covers every app in your organization, where each app had its own: Starter ($49 a month, 1 app), Growth ($149, up to 5 apps) or Compliance ($499, unlimited apps). Choose, upgrade, downgrade or cancel from Account › Billing. An upgrade applies at once and the difference for the rest of the billing period is charged then; a downgrade or a cancellation applies at the end of the period, and you can undo it until then. When a plan allows fewer apps than you have, you choose which stay active. The others are paused and keep their rules, keys and history; a request with a paused app's key gets a 402 with the code app_paused and a link to Account › Billing.

Unlimited apps, 250,000 requests a month included, $3 per 1,000 above that, and two years of history. Scheduled exports, SSO and an auditor role are planned for Q1 2027.

Each plan includes requests every month: 10,000 on Starter, 50,000 on Growth and 250,000 on Compliance. Requests above that are billed with the next monthly invoice, at $5, $4 or $3 per 1,000, and going over never stops your requests. You pay for checked requests that reach your provider: blocked and unchecked requests, duplicates of a request and requests whose provider call failed are not billed. Account › Billing shows the requests this period.

Prices exclude tax. Checkout asks for your billing address and adds VAT where it applies. A business in another EU country can enter its VAT number, and the invoice is reverse-charged.

Once an app has sent the sample event from the setup page, its events page shows how to send a real request through the proxy: the base URL, the X-SignalVault-Key header and a cURL command for OpenAI and Anthropic, with which key SIGNALVAULT_API_KEY holds. It goes away when the app's own first request arrives.

vat_eu finds VAT numbers from all 27 member states, written with their country prefix (EL for Greece), and confirms each by that country's check digits.

pesel_pl (Poland), rrn_be (Belgium), ppsn_ie (Ireland) and isikukood_ee (Estonia) are confirmed by their check digit or letter, and by the date of birth where the number holds one. nif_pt (Portugal) and svnr_at (Austria) count only after a word that names them, such as NIF or SVNR, on the same line. Each country's code (at, be, ee, ie, pl, pt) can be named in a rule on its own.

ahv_ch finds 13-digit AHV/AVS numbers starting 756, confirmed by their check digit, in a new Switzerland region (ch).

nhs_gb counts a ten-digit number only after NHS, NHS number or NHS no. on the same line, and confirms its check digit.

Rules set to eu detect the VAT numbers and the six EU identity and tax numbers from this release, and rules set to gb detect NHS numbers. Rules that name identifiers one by one are unchanged.

steuer_id_de (German tax ID), nir_fr (French social security number), codice_fiscale_it, and dni_es and nie_es (Spain) are confirmed by their check digit or letter, and the codice fiscale also by the date of birth it holds. A Dutch BSN (bsn_nl) counts only after BSN or burgerservicenummer on the same line, and must pass the 11-proef.

nino_gb counts a number only after National Insurance, NI number or NINO on the same line, and ignores prefixes that are never issued.

Tick All of European Union or All of United Kingdom in the rule editor, or name eu or gb in a rule's patterns list. eu also covers IBAN and the Danish, Finnish and Swedish numbers. A country code such as de covers that country's identifiers. /docs/detection lists them.

iban finds bank account numbers from the SEPA countries, spaced or written as one run, and confirms each by the length its country uses and the mod-97 check digits. Rules set to the Global region detect IBANs from this release.

personnummer_se (including samordningsnummer), fodselsnummer_no (including D-nummer), hetu_fi and kennitala_is are confirmed by the date of birth and check digits. Danish numbers have no check digit, so cpr_dk counts a number only after the word CPR on the same line, and redacts the number alone.

Tick All of Nordics in the rule editor, or name nordics in a rule's patterns list, to detect all five. A country code such as se detects that country's identifiers. /docs/detection lists the names.

/docs/detection lists every identifier the PII rule detects, with the name to use in a rule, an example and how a match is confirmed.

Each release lists what was added, improved, fixed and secured. Filter the page to one kind, jump to a release from the list beside it, and link to any release directly, as in /changelog#v0.15.9.

Data protection, transport, access control, retention and infrastructure are set out row by row, with a table of every sub-processor and what it receives.

Posts are grouped by topic, show how long they take to read, and carry a list of their sections that follows you down the page.

Subscribe to the changelog at /changelog/feed.xml and to the blog at /blog/feed.xml.

Responses from the Claude 4 and Claude 5 models, Haiku 4.5 through Fable 5.1, are priced at Anthropic's list prices. Claude Haiku 5.5 is priced by the request's prompt length.

A new app opens on a four-step page: app created, save your API key, send a request, see it arrive. The request step is a ready-to-paste cURL command for OpenAI or Anthropic that reads the key from SIGNALVAULT_API_KEY, so your first request needs no code change. Setup completes when a request of your own gets a response. Skip for now is remembered, and you can return to the page from Setup guide on Events.

Selecting an event opens its detail beside the list. The open event is part of the URL, so you can link to it, reload the page, or close it with the back button.

Apps, Billing, Profile and Security now have their own sections, separate from any single app. The full app list is under Account › Apps.

Your monthly total, next charge and apps on trial, with plan, price and renewal date for each app.

Finds apps as you type, and shows each app's plan with its last event or trial progress.

When a model proposes a tool call whose arguments contain PII, secrets or other rule violations, SignalVault redacts the arguments, substitutes a refusal, or forwards the call unchanged — before it reaches your agent.

Guardrails inspect tool results and tool inputs, so detections carry through multi-turn loops where tool output feeds the next model turn.

The documentation at /docs covers response codes and error shapes, rate limits, streaming behaviour, tool-use guardrails, export formats, payload limits and what the default rules do on a first request.

Development, staging and production API keys are available on Starter.

Development, staging and production API keys are included on the Starter plan. Trial apps gained this in 0.13.2; it now carries through when you subscribe.

You get an email when your last free trial request is used, so a paused integration is never a surprise.

Trial-limit responses carry an upgrade_url field alongside the existing error type and code, so your client can link a developer straight to billing.

One-click filters for the last hour, 24 hours and 7 days, a live indicator while events are arriving, and new rows highlight as they land.

Tool calls in non-streaming proxy mode are captured and audited, alongside streaming requests.

Structured Anthropic content blocks (text, tool_use, tool_result) are each evaluated independently.

Guardrail rules evaluate tool call inputs and outputs on both streaming and non-streaming paths, and violations are recorded for both. In this release, enforcement — blocking or rewriting a proposed tool call — applies to non-streaming responses.

Captured when proxying OpenAI or Anthropic, for streaming and non-streaming requests. No SDK changes required.

A "Tools Offered" section shows which tools were exposed to the model on each request.

The JSON path of the offending field is surfaced on every violation.

Sensitive values are masked while sibling fields stay readable for debugging.

Filter the events list by tool calls alongside requests, violations, errors and budget.

With labels, last-used tracking and revocation.

New events appear in the dashboard without a page reload.

With configurable sensitivity: standard and strict modes.

With label support and execution timeout protection.

Case-insensitive, word-boundary matching.

Restrict which AI models an app may use.

Point your existing OpenAI or Anthropic client at SignalVault with a one-line URL change. No SDK required.

Block and redact rules stop requests before they reach the upstream provider.

Streaming (SSE) is supported for both providers. Chunks are forwarded in real time and the response is logged after the stream completes.

For both streaming and non-streaming responses.

Send alerts to any HTTPS endpoint. Slack URLs get rich Block Kit messages, all others get plain JSON.

Rules with the redact action mask matched content in stored payloads before write.

See your retention period, total stored events, oldest event date and next purge cutoff.

For policy violations, budget breaches and AI errors, on the Growth plan.

Event types, minimum severity, cooldown and recipient.

Set monthly cost and daily token limits per app, with dashboard alerts when budgets are exceeded.

Export audit logs as CSV or JSON.

Request volume, violation rate and cost tracking.

For Starter and Growth plans.

AI request and response logging with a full audit trail.

PII detection, secret scanning, token limits and model allowlists.

Filtering, sorting and request detail views.

With an OpenAI-compatible wrapper and mirror mode.