Two products.
One mission.
DEC-1 stops data from leaving. Observer catches the act itself. Transparent pricing — no per-server fees, no surprise costs.
VaultDEC-1
Layer 2 bridge appliance that monitors egress traffic and physically severs connections when exfiltration thresholds are breached. No cloud. No subscriptions required.
Pre-configured hardware. One year of firmware updates included.
Continued firmware updates and new detection rules after your first year.
Your DEC-1 continues to function without a subscription. Updates are optional but recommended to stay current with new detection capabilities.
Multi-device deployments with volume pricing and priority support.
Observer
AI-powered log security that watches your containers, classifies threats in real time, and learns from every line it sees. Open core — the engine is free forever.
Open source binary. Run it on your server, manage it yourself.
You bring your own LLM API key (OpenAI, Ollama, etc.) and manage Observer via SSH, systemd, and sqlite3.
Hosted dashboard. Unlimited servers. No per-instance fees.
We don't charge per server because monitoring your 20th server costs us the same as your first — basically nothing. We're not going to pretend otherwise.
Free during launch · No credit card required
Team access, SSO, and dedicated support for security operations.
Complete defense in depth
DEC-1 monitors egress at the network layer — it sees every packet leave. Observer monitors logs at the application layer — it sees every request arrive. Together, nothing gets in or out undetected.
Detects and kills unauthorized data transfers at the network layer. If the attacker tries to move data out, DEC-1 physically severs the connection in milliseconds.
Watches every log line from every container. Classifies threats using AI, captures response evidence, and verifies outcomes. Catches the intrusion attempt that triggered the exfiltration.
The cost of not having VaultGuardian
Change Healthcare
Total breach cost
MGM Resorts
Operational disruption
Caesars
Ransom paid for data alone
VaultGuardian DEC-1: $349. Observer Pro: $29/mo.
Frequently asked questions
Do DEC-1 and Observer require each other?
No. Each product works independently. DEC-1 monitors network egress. Observer monitors application logs. Together they provide complete defense in depth, but neither depends on the other.
Why is Observer Pro unlimited servers?
Because monitoring your 20th server costs us the same as your first — the dashboard is a lightweight proxy to your own infrastructure. We're not going to charge you per server for something that doesn't cost us per server.
What counts as a 'server instance' for Observer?
One running Observer binary connected to the hosted dashboard. It could be monitoring 1 container or 100 on the same host — it's still one instance.
Does the DEC-1 require a cloud connection?
No. The DEC-1 operates completely offline. No cloud accounts, no internet dependency, no telemetry. Firmware updates are applied locally via the management dashboard.
What if I stop paying for firmware updates?
Your DEC-1 continues to function with the last installed firmware. You just won't receive new detection rules, threshold optimizations, or dashboard improvements. You can re-subscribe at any time.
What LLM does Observer use?
You bring your own. Observer works with any OpenAI-compatible API — OpenAI, Ollama (local/offline), Groq, Together, or any other provider. Your logs, your API key, your choice.
Is Observer open source?
The core engine will be open source. The hosted dashboard (app.vaultguardian.io) is the paid product. You can always self-host the binary for free and manage it via SSH and the local API.
What about enterprise / high-volume deployments?
Contact us. If you're running 100+ DEC-1 units or need team access, SSO, mTLS, or SLA-backed support for Observer, we have enterprise options.
Start protecting your infrastructure
DEC-1 for your backup servers. Observer for your application logs. Or both — they're designed to work together.