Pricing

The proxy is free. The console is what you pay for.

Aggrete's enforcement engine is open source and always will be. Your IT team can read every line and run it for nothing. The Aggrete Console is the commercial layer for the people who own the policy: rules in plain language, an audit trail Legal can sign, review workflows, and identity resolution across your systems.

What you get

The console, screen by screen.

Open the live demo A sample company, read only, no sign-up.

This is what the Team and Enterprise tiers add on top of the free proxy. Same rules underneath. Written for HR, Legal and managers: sentences and names, no identifiers. IT flips to Advanced when it needs the details.

Aggrete Console: Overview — **Overview**One sentence with the numbers, what needs you today, who is close to a line, and the last two weeks.

Aggrete Console: Policy, in plain language — **Policy, in plain language**Every clause from the handbook as a card: the wording, whether it is enforced or still in warning mode, and two examples in words.

Aggrete Console: Decisions — **Decisions**One line per question an assistant asked on someone's behalf. Open one and read what happened as a sentence; the technical details sit behind a toggle for IT.

Aggrete Console: Refusal receipts — **Refusal receipts**A signed receipt for the employee and for HR: the clause, what was already held, what was not fetched.

Aggrete Console: Exceptions — **Exceptions**Time-limited review sessions with a stated reason, approved in the console or Slack, every retrieval logged.

Aggrete Console: Test a new handbook — **Test a new handbook**Upload a draft and see what it would have done over ninety days of real questions, before a single rule goes live.

Aggrete Console: Close to a line — **Close to a line**Who is one question away from something the handbook forbids, and the nudge they would see.

Aggrete Console: How exceptions are used — **How exceptions are used**Recurring review sessions can become standing roles; sessions used off-purpose narrow themselves.

Aggrete Console: After a grievance — **After a grievance**HR sees whether the named manager starts pulling records about the complainant beyond their own baseline. Nothing is blocked.

Aggrete Console: People — **People**Directory sync so an email, an employee number and a Slack ID are one person.

Plays through the console on a sample company. Hover to pause, click a screen to enlarge. Names and numbers are illustrative.

What it stops

Six ordinary afternoons that end badly.

Each question was allowed. The last one completed a picture the handbook forbids.

The layoff list nobody asked for

A manager asks four reasonable planning questions. Together they name the people about to be managed out.

Headcount planBackfill-only rolesRecent joinersOn-call gaps

Who earns what

Pay bands are fine. A list of senior engineers is fine. Side by side, it's a named pay ranking.

Pay bandsSenior engineersPaid below band?

Comparing timesheets

Approving the team's hours is expected. Asking how your own compare is benchmarking colleagues.

Team timesheetsMy timesheet vs theirs

Legal hold stays sealed

People who can open held documents by hand still shouldn't have an assistant summarise them.

Search the driveSummarise the hold folder

The "who's leaving" guess

Exit notes, calendar gaps and ratings each look harmless. Stacked, they predict resignations by name.

Performance ratingsRecent 1:1 notesInterview-panel calendar

Absence meets the promotion list

Promotion candidates are fine. Absence totals are fine. Asking who's on long-term sick leave turns a promotion decision into a health record.

Promotion candidatesAbsence this yearWho's on long-term sick?

Community

Free

For one team, installed by IT

The Aggrete proxy. Every rule type, every assistant
Handbook-to-rules CLI
Helm chart, Docker image, GitHub support
Audit log as a file (audit.jsonl)

Get it on GitHub

Apache-2.0. No key, no account, no call.

Team

$4 per employee / month

50 to 500 employees · billed annually

Everything in Community
Aggrete Console: rules with enforce toggles, handbook tests, audit trail with evidence and CSV export
Policy replay, inference distance, refusal receipts, purpose leases
Review requests: time-limited exceptions approved in the console or Slack
Directory sync and identity resolution
Hosted by us or installed by you · email support

Open the live demo Talk to us

Start in warning mode. Pay when you enforce.

Enterprise

From $25k / year

500+ employees · $2.50 per employee / month above the floor

Everything in Team
SSO / SCIM, multi-tenant, role-based access
SIEM export (Splunk, Datadog), evidence packs for auditors
Plugins for the gateway you already run
DPA, 99.9% SLA, a named contact

Talk to us

Compliance add-on: retention policy and regulator-ready exports, +$1 per employee / month.

Compared

Seven risks nobody else covers, and why.

These are internal risks created by AI-generated answers, checked against the tools people already use. Every one of them needs something that sits between the assistant and the systems with a memory of what each person has seen. That is the part only Aggrete has.

Risk	What exists today	Aggrete
Retaliation early warning A manager starts looking up the person who filed a grievance. HR is told when it rises above that manager's own baseline.	Grievance intake tools (Jotform, H2R.ai, Spot) record the complaint and read its text. None of them watch what the manager's assistant asks afterwards.	Aggrete sees every retrieval by every assistant, per person, so it can compare a manager's attention to the complainant before and after the filing.
Aggregate-only pay answers Under the EU Pay Transparency Directive an assistant may share averages for a category, never a figure that describes three people.	Viva Insights applies minimum group sizes to its own reports. Pay transparency software (Figures, WTW) produces the statutory reports. Neither governs what an assistant says.	Aggrete counts the people in each answer as it passes and refuses anything below k, with the clause shown.
Privilege containment Privileged material stays with counsel of record and is never summarised into a non-privileged channel.	Law firms advise policies after the 2026 Heppner decision; Purview labels can block a file. A summary of that file carries no label.	Aggrete gates the privileged domain to counsel and refuses a retrieval into chat or mail in the same window as a privileged read.
Protected-attribute firewall An AI-written review cannot draw on the reviewee's absence, health, leave or accommodation records.	DLP stops a file being pasted out. Employment lawyers publish guidance. Nothing gates which sources feed a draft about a named person.	Aggrete refuses the health and absence domains for the person a review is being written about, for the duration of the task.
Embargo windows A restructuring plan is unavailable to anyone outside the planning team until the announcement date, including by inference from adjacent data.	Insider-list tools for listed companies; per-file labels. Neither handles a date on a whole domain or inference from calendar plus org chart plus budget.	Aggrete's wall rule carries a date and an allow list, and the tally catches the adjacent joins that reconstruct the list.
Investigation walls The subject of an investigation cannot reach the case file; investigators cannot mix it with the subject's unrelated records; the walls expire when the case closes.	Case IQ and ethical-wall products wall off their own records. They do not govern what a general assistant assembles from Drive, Slack and HR.	Aggrete's walls follow identities across every connector and log the subject searching for the case name.
Consultation quiet periods While a works-council consultation is open, nobody outside the team may combine site finances with headcount.	Nothing on the market. Works-council obligations are handled by process and memo.	Aggrete refuses the combination for everyone outside the consultation team until the date, and produces the log that shows the company held to it.

All seven ship as ready-made rules in the policy file (min group, walls with dates and allow lists, protected-attribute joins) and, for retaliation warning, as a console screen. Market check August 2026; tell us if we have missed a product.

Only Aggrete

Five things nobody else can do, because nobody else keeps the tally.

Every other control looks at one request. Aggrete knows what each person has already seen, across every assistant and every system. These features come from that, and they are in the Team and Enterprise tiers.

In the console

Policy replay

Upload next year's handbook draft and replay the last ninety days of real traffic against it. See who would have been refused, and whether they were doing their jobs, before a single rule goes live.

In the console

Inference distance

A live measure of how close each person is to a forbidden picture. One question away shows up for HR as a list and for the employee as a nudge, before anyone is refused.

In the console

Refusal receipts

Every refusal can be issued as a signed receipt: the clause, what was already held, what was not fetched. The employee can forward it; HR can verify it. Due process, not a log entry.

In the console

Purpose leases that learn

Exceptions fit themselves to the use. A review session granted every quarter becomes a standing role; a session used for something else narrows itself and flags the mismatch.

In design

The chain of hands

Aggregation across people. Alice reads the budget, pastes it in Slack, Bob asks for the rota on the same names. Neither crossed a line alone; together they did. Aggrete sits on the read path of the collaboration tools too, so it can see the hand-off.

Design stage. Needs the collaboration tools on the read path.

What's where

Open source does the enforcing. The console is what you see.

	Open-source proxy	Aggrete Console
Refuses the question that completes a forbidden picture	✓	✓
Rules from your handbook, in your words	✓ (file)	✓ (plain-language UI, enforce toggles, tests)
Works with Claude, Copilot, ChatGPT, Cursor	✓	✓
Audit trail	One line per decision, as a file	Filter, open the evidence, export CSV / SIEM / PDF
Exceptions for sanctioned reviews	Function call	Request → approve in console or Slack → logged session
Knowing who's who across systems	Email / ID in results	Directory sync, unlinked-identifier queue
Who can use it	IT	HR, Legal, managers. No YAML
Licence	Apache-2.0	Commercial, per employee

Questions about buying

Frequently asked

Can we stay on the free proxy forever?

Yes. The proxy enforces exactly the same rules whether or not you buy the console. You'd be giving up the UI, the review workflow and the exports. Not any protection.

Why per employee rather than per assistant?

Because the value scales with the people protected, not with how many assistants you roll out. And we don't want to tax adoption. Add Copilot next to Claude and the price doesn't move.

Hosted or on-premise?

Both. Team can be hosted by us or installed by your IT team; Enterprise is usually installed in your cloud so no data ever leaves it. The proxy itself always runs inside your company.

What do you store?

The console reads your proxy's audit log and policy file. It never stores the documents your assistants fetch. Only which people appeared in a result, for about a day, so rules can count them.

Is there a trial?

Every deployment starts in warning mode. Rules report what they would refuse without refusing anything. That is the trial. When you flip a rule to enforce, the subscription starts.

See what your handbook would enforce.

Drop it into the policy checker on the open-source site, or ask us for a walkthrough with your own scenarios.

Book a walkthrough