The CLI and its free rules are open source.
The corpus that catches the rest is what you pay for.

Your migration SQL is analyzed and stored with your check history. Your database is different: tier-2 checks open a short-lived, read-only connection to a shadow database, read catalog metadata (table names, row estimates, indexes, never rows), and disconnect. Nothing from your database is retained. The security page documents the exact boundary.

Yes: the CLI and every free rule listed above are Apache-2.0, source and all. The bolvrk package on npm bundles them with the engine core they run on, which is source-available under the Functional Source License (FSL-1.1): you can read, run and self-host it, but not build a competing service on it, and each version becomes Apache-2.0 two years on. LICENSING.md spells out the split: the CLI and the free rules are Apache-2.0, the engine core is source-available under the FSL, and the rest of the corpus is under the Bolvrk Commercial License and runs only in the hosted service on a paid plan.

Yes. The CLI runs the free rules locally, the outage core and credential hygiene, listed above, with JSON output for scripting, and it never phones home. The rest of the corpus and tier-2 live-schema context need the hosted service on Startup or above, via --remote or the GitHub Action.

Nothing is reported for it. A Free team's checks run the free rules only, and the check page says exactly that, which rules ran, and that the rest of the corpus did not. Findings from the free rules still land in the run log and on the pull request; upgrade to Startup and the next check runs the full corpus.

Yes: that is the point. Point your agent at bolvrk check --json and it has a deterministic verifier to iterate against, free, forever: your model proposes, our checker judges. Validation is never metered, whoever's AI is on the other side.

Both use the stored connection you already have and read structure and counters only, never rows. Migration rehearsal puts a line under each lock or rewrite finding saying how long it would block traffic on your actual table, scaled from the published benchmark by the live row count, in the PR and on the check page. Database health is opt-in per connection: switch it on and once a week the schema is audited for unused, redundant and invalid indexes, foreign keys with no index, constraints left NOT VALID and tables never analysed, with the result in the run log and on your notification channels. A Health button runs one on demand. Nothing runs against your database beyond the same read-only snapshot a connected check takes.

No: prices are in USD and exclude VAT. EU businesses with a valid VAT number are invoiced under the reverse-charge mechanism, so no VAT is added; everyone else is charged VAT at the applicable rate. Enter your VAT number at checkout.

The team drops to Free: checks run the free rules only, and the run log, PR comments and notifications keep working. Nothing is deleted, your check history stays, and stored connections are kept but not used until you subscribe again. The CLI keeps working forever; it is open source and never needed a subscription.