| Plan | Status | Scans / mo | Quota | Activated | Actions |
|---|
Grant or restrict Professional & Enterprise features to individual tenants or API keys — independently of their billing plan. You can also run time-limited global launch promotions.
📧 Email Template Tester
Send a live test email for any platform template. Uses real SendGrid — goes to the specified address.
Controls how governance scans handle tenants with multiple Azure subscriptions. Serial runs one subscription at a time (safer, less Azure API pressure). Parallel runs up to the limit concurrently (faster for large tenants).
All tenant scan reports are AES-256-GCM encrypted at rest using the PMK stored in
guardia-ai-saas-kv (secret: guardia-report-encr-creds).
This applies to every plan including Free Trial. Professional & Enterprise tenants
may additionally configure their own CMK.
✏️ Fields are editable — enter alternative values and click Test to validate before updating your Container App env vars.
guardia-ai-saas-kv → Secrets → guardia-report-encr-creds,
then update the GUARDIA_VAULT_URL environment variable on the Container App
and redeploy. Existing encrypted reports will remain decryptable as long as the old
secret version is not disabled in Key Vault.
Every scan report is archived to Azure Blob Storage at write time per internal retention policy,
independent of the customer-facing Cosmos DB TTL. Audit events (manual deletions, governance history clears,
tenant purges) are appended to the audit-log container.
controls_registry.json to the develop branch and triggers a staging deploy via GitHub Actions. Takes ~3–5 min to go live.