Compliance, identity, signed audit chain, and optional PHI redaction are included on every paid tier — you choose whether to send PHI under your BAA or strip it before it leaves your environment. Tiers package operational capacity (members, runtime, governance, dedicated data plane). Variable consumption bills against five meters — AI Credits, App Operations, Storage, Agent Actions, and end-user monthly actives. Talk to us — we'll set you up with an evaluation of the full product on non-PHI data.
Assistant + Studio · For teams
Included on every Platform tier
You're billed for thinking and authorized doing. AI Credits cover inference and retrieval; Agent Actions are charged only when an agent identity invokes a tool through the policy gate — pure-inference customers never see an Agent Action charge.
Single practitioner
billed annually — $2,844/yr
Overage
Small clinic / firm / department · ~25 active users
billed annually — $5,604/yr
Everything in Solo, plus…
Overage
Mid-market · ~100 active users
billed annually — $15,288/yr
Everything in Professional, plus…
Overage
Health systems and integrated delivery networks · dedicated data plane
Everything in Business, plus…
Overage
| Feature | Solo | Professional | Business | Enterprise |
|---|---|---|---|---|
| Surfaces | ||||
| Assistant chat Ask questions, draft documents, summarize records, and run governed tools — all through a conversational interface that logs every turn to your audit chain. Send PHI under your BAA, or enable automatic redaction before it leaves your environment — your policy, and every decision is logged. | ||||
| Studio app builder Describe the internal tool you need and HASP builds it — schema, UI, permissions, and audit hooks. Publish to your org's subdomain in minutes, not sprints. Every published app inherits the same compliance posture as the rest of your environment. | ||||
| Compliance & audit | ||||
| PHI redaction before model A policy option your org controls: send PHI to the model under your BAA, or turn on automatic redaction — names, MRNs, dates, addresses, and the other HIPAA Safe Harbor identifiers are detected and stripped inside your environment before a single token reaches the AI provider, then re-identified in the response so the chat still reads naturally. Whichever you choose, every decision lands on your audit chain. | ||||
| BAA (Business Associate Agreement) Signed BAA is included on every paid tier — no upcharge, no Enterprise-only gate. Required for HIPAA-covered entities. | ||||
| Hash-chained audit log When an auditor or regulator asks 'who did what, when, and what data did they touch?' — you have an answer that holds up. Every message, tool call, data access, and auth event lands in a hash-chained, Ed25519-signed log; altering any past entry breaks the chain. | ||||
| Audit retention How long your signed audit log is retained. Longer retention is required for HITRUST and some state-level HIPAA enforcement interpretations. | 7 years | 7 years | 7 years | Custom (10+ yrs) |
| Multi-framework compliance One control set satisfies HIPAA, HITRUST, SOC 2, GDPR, CCPA, and PIPEDA simultaneously. You don't need separate tooling per framework. | ||||
| CSV audit export Download a CSV of your audit log from the dashboard. Useful for external auditors or compliance reviews. | ||||
| External hash anchoring Even if HASP's infrastructure were fully compromised, your audit history would still be provable. The daily digest of your chain is timestamped by an independent RFC 3161 authority — cryptographic proof of when each entry existed, anchored outside our walls. | ||||
| IP address logging Records the IP address for every session and access event — part of the audit trail on every paid plan. Device metadata logging is available as an optional add-on on Enterprise. | ||||
| Identity & access | ||||
| Email magic-link / Google / Microsoft sign-in Standard sign-in methods available on every plan. No SSO contract required. | ||||
| Members + roles Invite multiple users to your org, assign them member or admin roles, and manage shared workspace access. | — | |||
| Guest access Invite external collaborators (e.g., contractors, clients) who can access specific apps without becoming full org members. | — | |||
| SAML SSO Enforce single sign-on through your identity provider (Okta, Azure AD, Google Workspace, etc.) using the SAML 2.0 standard. Users can't log in except via SSO when enforced. | — | — | ||
| SCIM group sync Automatically provision and deprovision users and their group memberships from your identity provider. Eliminates manual offboarding steps. | — | — | ||
| Workflow runtime | ||||
| Agent tool calls Agents can invoke tools (e.g., data lookups, API calls) inline within a conversation turn or from a running workflow. Every invocation passes the policy gate and lands on the audit chain. | ||||
| Long-running & background agents Agents that run beyond a single request — queued workflows, multi-step pipelines, and background jobs that complete asynchronously. Included on every paid tier. | ||||
| Multi-agent chains Orchestrate multiple specialized agents in supervised pipelines. One agent's output becomes another's input, with the policy gate applied at each step. | ||||
| Workflow capacity Operational caps on the workflow runtime: how many workflow executions can run at once, and how large each workflow can be (steps and parallel branches). Higher tiers raise the caps — the capability itself is the same everywhere. | 10 concurrent · 20 steps / 2 parallel | 50 concurrent · 50 steps / 4 parallel | 250 concurrent · 200 steps / 10 parallel | Custom |
| Governance & analytics | ||||
| Usage-meter dashboards Real-time view of your AI Credits, App Operations, Storage, Agent Actions, and End-User MAU consumption vs. your included allotment. | ||||
| MAU / DAU / WAU trends Monthly, daily, and weekly active-user trend charts (30, 90, and 365-day windows). Useful for understanding adoption and planning team growth. | — | — | ||
| Per-user credit limits Org admins can cap how many AI Credits any individual user can consume per billing period — prevents runaway usage from a single account. | — | — | ||
| Governance analytics Audit-sourced dashboards for schema changes, publish events, role changes, and access-denial reports. Answers 'who changed what and when' questions without writing queries. | — | — | ||
| Infrastructure | ||||
| Managed subdomain Your apps are published at `[your-org].usehasp.run`. No DNS setup required. | ||||
| Custom org hostname Publish your apps on your own domain (e.g., tools.yourclinic.com) — bring your own domain via DNS delegation. One hostname per organization. | — | — | 1 hostname | 1 hostname |
| Dedicated data plane A per-organization database isolated from all other tenants. Logical row-level-security isolation is replaced with physical database isolation — required for some enterprise security policies. | — | — | — | |
| Custom data residency Negotiate where your data at rest is stored (e.g., US-only, EU). Requires dedicated data plane. | — | — | — | Negotiated |
| Support | ||||
| Email support Standard email support with best-effort response time. | ||||
| Priority support SLA Guaranteed response time SLA with a named support contact who knows your deployment. | — | — | — | |
| Custom DPA / SLA terms Negotiate custom Data Processing Agreement and Service Level Agreement terms into your contract. Required by some large health systems and IDNs. | — | — | — | |
Compliant inference + agent identity · For developers
Compliant inference for builders. Send PHI to the model under your BAA or redact it before it leaves your environment — your choice per request, and every call lands in your signed audit chain. Works with leading BAA-covered inference providers — same agent identity layer, same compliance + audit layer, no compliance bolted on after the fact.
Production-ready integrations
billed annually — $2,544/yr
Overage
Heavier production volume
billed annually — $9,168/yr
Overage
High-volume integrations
billed annually — $18,348/yr
Overage
Custom contract. Talk to us.
Overage
Billed in AI Credits — same unit as the platform tier. 1 credit ≈ 1,000 base-model input tokens. Faster/cheaper models bill at a lower multiplier; larger/heavier models bill higher. Per-model multipliers are published in the model catalog.
An estimate for planning — your real mix and traffic decide the bill.
The negative space
Six things you'll never see on a HASP invoice.
No per-seat pricing.
Active-user counts are capacity guidance, not invoiced.
No per-app pricing.
Publish unlimited apps on any tier.
No per-agent base pricing.
Agent activity is metered. Agent existence is not.
No compliance upcharge.
Signed BAA and tamper-evident audit chain on every paid tier. Send PHI to the model under your BAA, or redact it pre-model — your policy choice, not a paywall.
No surface gating by tier inside a plan.
Every Platform tier gets Assistant + Studio. Every API tier gets Public API + Agent SDK. Pick the plan(s) you need; tier differences are operational (limits, governance), never feature locks.
No third-party AI gateway.
Direct integration with BAA-covered inference providers under HASP-direct BAAs.
Tell us about your team and your compliance requirements, and we'll set you up with an evaluation — every surface across both plans, on non-PHI data. When you're ready to go live, sign the BAA in-app, pick the plan(s) you want, and you're done.