Self-hosted guardrails, licensed per node.
PRIOR is a guardrail for the open-weight LLMs you run yourself. It stops prompt injection, jailbreaks, and data leaks by enforcing your policy from inside the model as it generates, rather than filtering the text after the model has already decided what to say. Every plan ships the full capability set and runs entirely in your environment. The engine verifies its license locally against a baked-in public key, and your prompts and model data never leave your box. Connected plans make a lightweight periodic license check-in, carrying a license ID and a node ID and never your data, which is how cancellation takes effect. Need zero outbound calls? An air-gapped license is available: talk to us. Evaluate free for 30 days, then license per node when you go to production.
Per node, per year. That's the whole model.
Every tier ships the full capability set. Tiers differ only by how many nodes you run. A node is one deployment, and each license binds to its host on first use. Evaluate free for 30 days →
- 1 node-locked deployment
- Every capability
- Your prompts and model never leave your box
- Email support
- 5 node-locked deployments
- Every capability
- Your prompts and model never leave your box
- Priority support
- 12 node-locked deployments
- Every capability
- Your prompts and model never leave your box
- Priority support
By completing a purchase, you agree to the Subscriber Agreement.
Every license is node-locked and runs entirely in your environment. Air-gapped, more than 12 nodes, or procurement and SLA? Talk to us about Enterprise →
Pick a deployment, not a feature tier. They're all complete.
The plans above are Private licenses, priced by node count. Every license verifies the same way and ships the full capability set. What changes is the validity window and the binding, not the features. Talk to us if you're not sure which fits. We'd rather scope it right than oversell it.
Evaluate PRIOR on your own model
A 30-day key for proof-of-concept work. You get full capabilities, so you can run a pack against your own traffic and measure the delta before you commit. Unlike the paid licenses, the trial isn't node-bound; it simply expires after 30 days.
30 days · all capabilities · not node-locked, expiry-only
Self-hosted, on your infrastructure
An annual key for a dedicated host or cluster you control. It includes the full capability set: every steering mode, manifold safety, batch processing, and the complete admin surface.
365 days · All capabilities
Disconnected and classified environments
The same full capability set as Private, issued for hosts with no outbound network at all. Verification is local by design, so the engine never needs to reach us, not at install and not at runtime.
365 days · All capabilities · No network required
Purchase, place the key, and it's live.
Start a trial or pick a plan
Start a 30-day trial below, or choose a plan above. We email you a license.bin. A multi-node pack arrives as a zip with one file per node, and there's no fingerprint to send first.
Drop it on a persistent volume
Place license.bin on the engine's state volume, or upload it from the console. Keep state on a named volume so it survives restarts and upgrades (more on that below).
It binds on first use
On first boot the engine verifies the signature locally, binds the license to that host, and enables every capability. Binding is fully local, with no activation call-out.
First boot binds the license to that host.
A self-serve license ships unbound and locks to the first host it runs on, then stays there for its annual term. Node count is enforced the simple way: you get exactly as many license files as nodes you bought, and each one is licensed to a single host. One license won't steer a second node.
Because the license verifies locally, PRIOR keeps steering through short network interruptions. Your subscription runs for its annual term; if it lapses or is cancelled, steering falls back to plain inference until you renew, and you are never locked out of your model. Need to run with no network at all? The air-gapped tier is built for that, and Enterprise licenses can be pre-bound to a host you specify.
Try it for 30 days.
Full capabilities, no card. We email you a license.bin that runs the full engine and expires in 30 days. Unlike the paid licenses, the trial isn't node-bound, so you can evaluate on any machine you like.
Give it a durable place to keep its state.
PRIOR keeps its packs, calibration, audit log, and the license binding in a state directory, PRIOR_STATE_DIR (default /var/lib/prior). Mount a named volume there so everything, including the binding, survives restarts and image upgrades:
docker run -v prior_state:/var/lib/prior … prior:latest
Running as non-root? Point PRIOR_STATE_DIR at a writable mount (e.g. /data). A non-root container can't create /var/lib/prior, so the engine falls back to the host machine-id for identity.
On Kubernetes, run self-serve nodes as a StatefulSet with a per-pod PVC mounted at PRIOR_STATE_DIR. Each pod then keeps a stable identity across reschedules, so its license stays bound: one license per pod. Sharing a single license across an autoscaling replica set is an Enterprise capability (via PRIOR_CLUSTER_ID); self-serve licenses are strictly one node each.
Full deployment reference (volumes, auth, Kubernetes probes) is in the documentation.
Questions to answer before checkout.
What leaves my network?
Your models, prompts, policies, and audit logs stay on your infrastructure; we never receive them. Connected tiers do periodically validate the license with our server to confirm the subscription is active; that exchange carries only your license id and a node identifier, never your data. The air-gapped tier contacts nothing at all, at install or at runtime. Full details are in the Subscriber Agreement.
Does it work with OpenAI, Anthropic, or other closed APIs?
No, and that's structural, not a roadmap gap. Enforcing behavior from inside the model requires access to the model, so PRIOR works with the self-hosted open-weight models you run yourself (Llama, Qwen, Gemma, Mistral, and more). If your stack is entirely closed-API, PRIOR isn't the right tool.
Which models are supported?
Calibrated GGUF builds out of the box, up to 31B: Llama, dense Qwen3 (including abliterated), the Qwen3-Next hybrid linear-attention class, Phi-4, Mistral-Nemo, Ministral, a DeepSeek-R1 distill, Gemma-3/4, and SmolLM3, with steering also running on mixture-of-experts and hybrid state-space architectures. Each build is calibrated once and graded certified or beta before it's trusted; your policy packs are written model-independently, so they carry to a new model unchanged.
Do I need ML expertise to write policy?
No. In the console (a separate, optional dashboard container) you hand PRIOR a plain-language policy document and it builds the pack. No code, no training runs. Packs hot-reload with no restart, and the sensitivity thresholds are operator-owned dials, not baked-in constants.
What hardware do I need?
PRIOR runs wherever llama.cpp runs: a workstation GPU, a server, or an air-gapped box. Size the GPU for your model as usual: lightweight steering mode uses a pre-distilled direction and adds minimal memory, while high-fidelity mode budgets roughly a third more GPU memory than the bare model (varies by model). A steered 4B-class model fits an 8 GB card with headroom. Latency is unchanged when no policy fires.
What happens at renewal, or if my network goes down?
Verification is local, so PRIOR keeps steering through short network outages; steering only pauses if a connected node stays unable to reach the license server for an extended period, or if the subscription lapses. Renewals happen automatically while your subscription is active, and the air-gapped tier has nothing to reach in the first place. Either way, you are never locked out of your model: the engine keeps serving plain inference and only the policy enforcement pauses until a valid license is applied. Your traffic doesn't stop on our account.
These cover buying. For how PRIOR works, the models, and the proof, see the full FAQ → Something else? Ask us directly → We'd rather scope it right than oversell it.