Pricing
The gate is free. Cloud is for teams that need the history, the dashboard, and org-wide agent-governance policy.
Free
Risk-only gate, runs entirely in your CI
- 17-factor risk score, unlimited PRs
- CI-aware release-ready gate mode
- Security & supply-chain risk factors
- No API key, no account, no store
Pro
Most popular5,000 evals/mo, hosted history
- Everything in Free
- 5,000 stored evaluations / month
- Hosted trend dashboard
- Up to 3 seats included
- API keys for CI ingest
Team
Agent governance for orgs shipping AI-authored PRs
- Everything in Pro
- 50,000 stored evaluations / month
- Org-wide rollup dashboard across repos
- SSO
- Agent-governance policies: provenance classification, sensitive-path gates, session-burst detection, trust profiles, escalation SLAs
- Up to 10 seats included
How quota works
Going over your monthly evaluation limit does not stop your gate. Evaluations keep being stored and the response carries an upsell header until usage reaches 3× your plan limit — at that point ingest is hard-capped (402/429) as an abuse backstop until the next billing cycle or an upgrade. You will see the quota warning in your CI logs well before that happens.
Frequently asked questions
What counts as an eval?
One stored evaluation per PR check run that Trailhead's gate posts to your Cloud store — i.e. one per pull request update that runs the gate, not per risk factor or per API call.
What happens if I go over my quota?
Nothing breaks. Over-quota evaluations are still stored and your CI run still gets a decision; the response includes an upsell header and message until you hit 3x your plan limit, which is a hard cap.
Can I self-host the evaluation store instead of using Cloud?
Yes. Bring-your-own-store is supported via the evaluation-store-url and evaluation-store-secret inputs on the Action — Cloud is optional hosted storage, not a requirement to use Trailhead.
How do API keys work?
A Cloud subscription issues one API key at checkout, shown once on the /welcome page. Add it as the TRAILHEAD_API_KEY secret in your repo or org and pass it to the Action via the trailhead-api-key input — it auto-configures the store URL and auth.
How do I cancel or change plans?
Billing is managed entirely through the Stripe customer portal — open it from your dashboard. There's no separate account system to manage; possession of your API key is what authenticates billing-portal access.
Do I need Trailhead Cloud to use the risk gate?
No. The GitHub Action's risk-only and release-ready gate modes run entirely in your CI with no API key. Cloud only adds hosted history, dashboards, org rollup, and SSO.