How $49 works.

01 / 06 — Per-event cost

What one event costs to process

An event is a single alert — one HTTP POST from Prometheus AlertManager, a Datadog monitor, PagerDuty, or a custom webhook, saying “this thing fired.” Each event walks the same six-step pipeline. Five of the six are functionally free at our volume; one of them — the LLM call — is where the cost actually lives.

The blended number. Across the full pipeline at baseline assumptions (a 150-to-1 event-to-incident clustering ratio, 1.5 RCA calls per incident, 95% of those on Haiku 4.5 and 5% escalating to Sonnet 4.6, all via Anthropic’s Batch API with prompt caching), the all-in cost is $0.0000404 per event. Source: ADR-018 §“COGS estimate formula.”

That blended number hides real variance. An event that doesn’t trigger an RCA — the common case — costs microcents: it’s an embedding call and a vector lookup and nothing else. An event that triggers a Sonnet 4.6 escalation under the explicit “Deep Analysis” click costs about $0.0101 for that one call. The blended figure is what the math is built on, but the worst single event is roughly 250× the average.

02 / 06 — Volume

How many events per service per month

A typical microservice in a production SaaS environment emits millions of log lines per month and tens of thousands of metric data points, but produces only a few hundred to a few thousand actual alert events. Culprit consumes the alerts — the output of your existing observability stack — not the raw telemetry.

Source for the three thresholds: CLAUDE.md “Heavy-account monitoring (graduated)” and PRICING_V4.heavyAccountThresholds in packages/shared/src/constants.ts.

03 / 06 — Margin

How $49 actually works

Three reference scenarios. All assume a single-service account on the base $49/svc/mo tier. Volume-discount tiers (5% off at 10+ services, 10% off at 25+) compress these margins roughly proportionally; the worst case at the deepest discount tier is in the bottom row.

Read this honestly. At a typical service volume the margin is comfortable. At the fair-use envelope it’s thinner but still healthy. At 1,000,000 events on a single service at the deepest self-serve discount tier (25+ services, $44.10/svc/mo effective), ADR-018’s 2026-04-28 amendment models the net margin at 3.3% — positive, but close enough to zero that any single-variable stress break (Sonnet escalation rate > 5%, clustering ratio < 150-to-1, RCA calls per incident > 1.5) pushes it into the red. That is the point where the heavy-account flag mechanic exists to convert the customer to Enterprise via ToS §4.4 before sustained negative-margin exposure accumulates.

A note on fixed costs. The numbers above are variable cost only — per-event LLM and embedding spend, plus the per-invoice payment-processor fee. Fixed infrastructure (Supabase Postgres, Cloudflare Workers, monitoring, domain, transactional email) runs on free or near-free vendor tiers today and costs in the low double digits per month total. Allocating those across the customer base is fuzzy at this scale; honest framing is “fixed cost rounds to zero per service until volume demands a tier upgrade somewhere.” Source: docs/business/cost-model.md.

04 / 06 — Posture

Why flat-rate, not metered

Usage-based pricing creates an incentive to send less data. For an alerting product that is the wrong incentive: the more telemetry you route to Culprit, the better the correlation and the root-cause analysis get. A customer who is rate-limiting their own alert stream to manage their bill is a customer whose product is making them worse at their job.

Flat-rate makes “send everything” the default. The margin compression at the high end of the fair-use envelope is the price of that posture. It’s a deliberate trade, codified as CLAUDE.md rule #7: “Pricing is flat per service, no usage caps, no overage. The business model depends on customers sending more data, not less.”

05 / 06 — Failure modes

When the math breaks

Three failure modes, listed honestly because pretending they don’t exist is what gets pricing pages debunked.

• Pathologically noisy service. A service that sustains millions of events per month crosses the fair-use envelope. The graduated heavy-account monitoring (logged at 250,000, internal review at 350,000, Enterprise outreach at 500,000) flags it before the COGS exposure compounds. The conversation that follows is “help reduce noise OR migrate to Enterprise terms,” not a surprise invoice.
• LLM provider price hike. Anthropic and OpenAI together drive the dominant variable cost. The base model has roughly 30% of headroom against an Anthropic input-token price increase before $49 needs to move; beyond that, the heavy-account thresholds tighten or the pricing changes. ADR-018 §“Revisit when” sets “Anthropic or OpenAI base prices change more than 20%” as one of the explicit re-open triggers.
• Real-time “Deep Analysis” abuse. The Sonnet 4.6 escalation path bypasses the Batch API discount and is the most expensive single thing the platform can do ($0.0101/call vs Haiku batch $0.0033). It’s gated behind an explicit user click for that reason. If a customer pattern emerges of clicking it dozens of times per incident, the immediate response is a per-tenant monthly Sonnet budget — not a charge, a budget that throttles the user-initiated escalation once exhausted.

06 / 06 — What to do with this

What to do with this information

If the math holds up under scrutiny, send Culprit a real alert and see what the pipeline does with it. If the math doesn’t hold up, point out the broken assumption — the page will get updated.