Simple, per-project pricing.
Start free. Upgrade a single project to Pro for £4 a month when you need private repos, hourly refresh or alerts. Change quantity or cancel any time in the Stripe Customer Portal.
For public projects that want honest proof.
- 3 projects, 5 badges each
- Public repos and sites
- Daily refresh
- classic · flat · pill styles
- 30 days of history
- Read API (rate-limited)
Pay only for the projects that matter. £40/yr per project.
- Unlimited badges per project
- Private repos
- Hourly refresh (TLS every 6 h)
- All 6 styles + custom labels
- 13 months of history + trends
- Email, Slack and webhook alerts
- 5-minute uptime checks
- Active scans on verified domains
- Securemark mark removed
Up to 15 projects, then £2 each. For agencies and orgs.
- Everything in Pro
- 1-minute uptime checks
- Org branding on badges
- Shared alert channels
- History export
- Full API access
- SSO (coming later)
Exactly what each plan includes.
| Feature | Free | Pro | Team |
|---|---|---|---|
| Price | £0 | £4 / project / mo | £29 / mo (15 projects, then £2) |
| Subjects | Public repos and sites | Public + private repos | Public + private |
| Badges per project | 5 | Unlimited | Unlimited |
| Refresh | Daily | Hourly (TLS 6 h) | Hourly |
| Uptime checks | Daily | 5 min (1 min add-on +£2) | 1 min |
| History | 30 days | 13 months + trend charts | 13 months + export |
| Badge styles | classic, flat, pill | All 6 + custom labels | All 6 + org branding |
| Securemark branding | Small mark in detailed report | Removed | Removed |
| Alerts (email, Slack, webhook) | — | ✓ | ✓ + shared channels |
| Active scans, verified domains | — | ✓ | ✓ |
| API access | Read, rate-limited | Read + upload | Full (+ SSO later) |
Prices in GBP. UK VAT is included where applicable and calculated by Stripe Tax. Annual Pro: £40 per project per year. Team overage: £2 per project above 15.
Billing questions
Why not just use shields.io?
Shields renders whatever a third-party API says, and many badges are simply typed by the repo owner. Securemark runs its own scanners, scores results with a versioned public methodology, and every badge carries the time it was measured and the methodology version that produced it.
Can someone put a badge for my site on theirs?
Passive, public checks (headers, TLS, DNS) work for any public domain, as with any public scanner. Ownership-gated features such as active scans, private data and the verified mark need a DNS TXT record (_securemark.yourdomain) proving you control the domain.
What happens when something can't be measured?
It says so. Missing data shows INSUFFICIENT DATA, never a pass. If less than half of an overall grade's weight is measurable, there's no grade at all.
How fresh are the badges?
Badges are served from the latest stored result at the edge and never trigger a scan on request. Free refreshes daily; Pro hourly (TLS every 6 hours). Each badge's detailed style and tooltip shows when it was measured.
Will badges slow my README or site?
No. They're tiny SVGs served from Cloudflare's edge with ETags and stale-while-revalidate caching, so GitHub's image proxy and browsers get a cached response almost every time.
Do you need access to my code?
Not for website badges. Repository badges use a read-only GitHub App with least-privilege permissions; private repos need Pro.
How does billing work?
Stripe Checkout and the Stripe Customer Portal. Pro is a single subscription whose quantity is the number of Pro projects; change it any time with proration, or cancel at period end. Prices include UK VAT where applicable.
Is my data sold or tracked?
No. This site sets no cookies and loads no trackers or external fonts. The dashboard uses a session cookie only for sign-in. See the privacy policy.