mallcop

Start free. Scale for donuts.

Full mallcop functionality at every tier. Bring your own API key for $0, or let us handle inference for less than you'd pay Anthropic directly.

How Donuts Work 🍩

Mallcop runs on donuts. Scanning and detection are free. Investigations cost donuts.

1🍩

Patrol

Quick check: is this finding normal or does it need a closer look?

Triage + basic investigation
8🍩

Call for Backup

Multiple guards coordinate to investigate a suspicious finding together.

Multi-agent investigation
15🍩

Check the Cameras

Deep dive across event history and cross-finding correlation.

Deep investigation
7-55🍩

Mallcop Academy

Mallcop drafts an improvement and tests it against your real history. A new rule costs ~7🍩. A prompt overhaul costs ~55🍩.

Self-improvement + validation. See breakdown

Plans

Connectors and events are unlimited on every tier. Scanning and detection are always free.

Mallcop monitors for anomalies. It does not guarantee detection of all security threats.

Model Sovereignty

You choose your comfort level. We route accordingly.

All models, including Chinese-origin models on the Open tier, run on AWS Bedrock in US regions. Your data does not leave AWS infrastructure.

TierMultiplierProviders

BYOK Cost Calculator

See what you'd pay on each tier vs. bringing your own Anthropic key.

$ /month

Managed tiers route to optimized models at lower cost per token.

Frequently Asked Questions

What's a donut? 🍩
One unit of mallcop compute. A patrol costs 1🍩, calling for backup costs 8🍩, checking the cameras costs 15🍩. Donuts cover tokens and model pricing so you think in operations, not API calls.
What happens when I run out of donuts?
Scanning and detection keep running. Those are free. Investigations pause until your next billing cycle. Findings still get flagged and delivered to your notification channel with full context. They just skip the investigation step. You can always add a donut pack mid-cycle if you need more capacity.
Can I switch tiers?
Yes. mallcop upgrade handles tier changes. Upgrade mid-cycle and your new donut allocation starts immediately. Downgrade takes effect at the next billing cycle.
Why is BYOK more expensive than Starter?
BYOK uses whatever model your API key connects to, typically Anthropic Sonnet at $3/$15 per million tokens. Managed tiers route to optimized models (GLM 4.7, Llama 4 Scout) at 8-40x lower cost. We route smarter, you pay less.
Is the free tier really free?
Yes. Full mallcop functionality. Unlimited connectors, events, detectors. You bring your own API key for investigations. Anthropic, OpenAI, Bedrock, or any OpenAI-compatible endpoint. Your tokens, your cost, your choice.
What about Chinese models? Are they safe?
The Open tier routes to the best price/performance model available, which sometimes means Chinese-origin models like GLM 4.7 or Qwen3. These models run on AWS Bedrock in US regions. Your event data does not leave AWS. If this still concerns you, Allied and US-only tiers exclude Chinese-origin models entirely.
Why donuts and not just tokens? 🍩
Tokens are meaningless to most users. "Your investigation used 12,847 tokens" tells you nothing. "Your investigation used 3🍩" tells you exactly how many investigations you have left this month. Donuts also let us improve pricing as model costs drop. We route to cheaper models and pass the savings along without changing your plan.