Causal intelligence,
priced to deploy.
Every plan includes causal chain analysis, behavioral baselining, evidence grading, and post-quantum encrypted transport.
Starter
14-day trial · 30-day money-back guarantee
Data: 30-day live · 90-day retained · 1-year archive
AI: 200 credits/month (Sonnet default)
- Causal chain analysis (4-heuristic linking)
- Behavioral baselines & anomaly detection
- Campaign detection (MITRE stage progression)
- 64 built-in Sigma rules + 20 custom
- Post-quantum encrypted transport
- Mandatory 2FA & row-level tenant isolation
- CISA KEV, NVD, GitHub Advisory feeds
- Weekly digest & monthly PDF reports
- 1 collector · 3 data source integrations
- Email support (24h response, Mon–Fri)
Professional
30-day trial · 30-day money-back guarantee
Data: 30-day live · 180-day retained · 3-year archive
AI: 500 credits/month + 50 autonomous investigations/month
- Everything in Starter, plus:
- Autonomous AI investigations (70+ score campaigns)
- SSO (SAML + OIDC — Azure AD, Okta, Google)
- 100 custom Sigma rules + community import
- Ticketing (Jira, ServiceNow, PagerDuty)
- Compliance reports (HIPAA, PCI, SOC 2, NIST CSF, CIS)
- Tamper-evident audit trail
- Scheduled exports (S3, SFTP, email)
- 3 collectors · 10 data source integrations
- Email + chat support (4h response, Mon–Fri)
MSSP Starter
Minimum 5 client seats
Per client: 100–500 endpoints · 500K–2.5M events/day
Console: Cross-client dashboard · unified alert queue
- Multi-tenant management console
- Per-client tenant isolation
- Client provisioning & deprovisioning
- Bulk Sigma rule deployment
- Billing visibility per client
- Email + chat support (4h response)
MSSP Professional
Autonomous investigation included
Console: Cross-client threat correlation · SLA tracking
Compliance: All templates included for all clients
- Everything in MSSP Starter, plus:
- Cross-client threat correlation
- Campaign tracking across portfolio
- Ticketing (Jira, ServiceNow, PagerDuty)
- Bulk compliance reporting
- Email + chat + phone (2h response)
MSSP Enterprise
White-label branding included
Console: Multi-SOC · API-driven provisioning · SIEM forwarding
Archive: 5 years on Professional seats
- Everything in MSSP Professional, plus:
- White-label branding (logo, colors, domain)
- Multi-SOC / follow-the-sun support
- API-driven client lifecycle
- SIEM forwarding per client
- Dedicated CSM · 24/7 support (1h response)
Enterprise
30–60 day POC, no cost, up to 500 endpoints
Retention: 5 years standard, extendable to 10+
SLA: 99.99% uptime · 30-min critical response
- Everything in Professional, plus:
- Dedicated single-tenant infrastructure
- Dedicated Customer Success Manager
- 24/7 support with 30-minute critical response
- Unlimited AI investigations (all models)
- SOC 2 Type II report available
- 3 custom integrations/year included
- On-site onboarding + training (up to 3 days)
- Cross-region failover
Federal / Government
1 base year + 4 option years typical
Crypto: FIPS 203/204 post-quantum (shipping today)
SLA: 99.99% · 30-min critical · cross-region failover
- Everything in Enterprise, plus:
- GovCloud deployment (AWS/Azure Government)
- FIPS 203 (ML-KEM-768) & FIPS 204 (ML-DSA-65) today
- STIG-hardened infrastructure
- FedRAMP security documentation package
- US-person support staff
- ATO support documentation
- Air-gapped deployment support
- GSA Schedule / SEWP / CIO-SP3 procurement
Where TRA-CE fits
in your stack
TRA-CE is not a SIEM replacement. It sits beside your existing tools and answers the question they cannot.
Small Business
You have a firewall, maybe an EDR, and no dedicated security team. TRA-CE replaces the analyst you cannot afford. It ingests events from your existing tools, builds causal chains, and tells you in plain language what happened and what to do about it.
No SIEM required. Deploy one collector, connect your data sources, and TRA-CE does the rest.
Medium Business
You have a SIEM and a small SOC team drowning in alerts. TRA-CE sits beside your SIEM and transforms correlated alerts into proven causal chains with evidence grades. Your analysts investigate real threats instead of chasing false positives.
Behavioral baselines learn what normal looks like for your environment. Anomalies surface automatically.
MSSP
You manage security for multiple clients with different tools and maturity levels. TRA-CE provides a unified causal intelligence layer across your portfolio with per-client tenant isolation.
Cross-client threat correlation detects when the same attacker hits multiple clients. White-label your dashboard. Push enriched chains back into each client's SIEM.
Enterprise
You have a mature SOC, multiple SIEMs, and cross-domain visibility challenges. TRA-CE normalizes events from all sources into a single causal graph. Investigations that took hours now take minutes with autonomous AI triage and formal evidence chains.
Federal / Government
You need provable evidence chains for incident reporting, FIPS-compliant cryptography, and deployment in classified environments. TRA-CE ships FIPS 203/204 post-quantum encryption today — ahead of the 2035 mandate.
Deploy on GovCloud, on-premise, or air-gapped. STIG-hardened. ATO documentation provided.
How deployment works
One container, outbound only. No agents on endpoints. No firewall changes.
Deploy the Collector
A lightweight Docker container (~512MB) that runs inside your network. Outbound only — no inbound ports, no firewall changes. Configure your data sources through a guided wizard.
Encrypted Transport
All data leaving your network is encrypted via Avon — our post-quantum transport using ML-KEM-768 + X25519 hybrid key exchange with ML-DSA-65 signatures. Session keys rotate every 30 seconds.
Causal Intelligence
Events flow into the TRA-CE platform where they are linked into causal chains using four inference heuristics. Each link is evidence-graded. Behavioral baselines learn your normal. AI investigation runs automatically on high-confidence campaigns.
Security & encryption
We protect your security data with the same rigor we apply to analyzing it.
Post-Quantum Transport
All collector-to-platform communication uses ML-KEM-768 + X25519 hybrid key exchange with ML-DSA-65 digital signatures. AES-256-GCM encrypts every payload. Session keys rotate every 30 seconds. FIPS 203/204 compliant — shipping today.
Tenant Isolation
Every customer's data is isolated at the database level using PostgreSQL row-level security policies. No tenant can see another tenant's data, even in error. Mandatory 2FA on all accounts. Full audit trail of every action.
Data Protection
AES-256-GCM encryption at rest. Automated backups with point-in-time recovery. Your data is processed for security analysis only — never mined, never used for AI model training.
Frequently asked
questions
Why no free tier?
TRA-CE processes sensitive security telemetry and builds causal chains that reveal real attack paths. Free tiers attract noise and create support load that takes away from paying customers. We invest in making the product exceptional for teams that are serious about security.
How does the trial work?
Starter plans include a 14-day trial. Professional plans include a 30-day trial. Full platform access, your real data, no credit card required. We help you set up during onboarding.
What is a causal chain?
A directed sequence of security events linked by proven causation, not just time proximity. Each link is evidence-graded: PROVABLE when backed by direct system evidence, MIXED when correlated across sources, INFERRED when pattern-matched. You always know what is proven and what is not.
Can I self-host?
Enterprise plans support deployment in your VPC or on-premise. Federal plans support air-gapped and GovCloud deployments. The collector always runs on your infrastructure.
What data sources are supported?
Elastic, Splunk, Microsoft Sentinel, CrowdStrike, SentinelOne, Okta, Google Workspace, AWS CloudTrail, and more. The collector normalizes events from any source into a unified format.
Is there a discount for nonprofits?
Yes. We offer reduced pricing for verified nonprofits, NGOs, and educational institutions. Contact us at jrandolph@tra-ce.ai.
Ready to know why?
Request access and our team will walk you through a personalized demo, recommend the right plan, and help you deploy in days.
Request Access →