Solutions
Enterprise here is a conversation, not a tier
There is no enterprise edition to be upgraded into, because there is no self-serve edition to upgrade from. Every account gets its plan the same way: an email, a straight answer, and pricing agreed in writing before anything is charged. What changes at volume is the conversation, not the product.
What we do not offer
Named plainly, because a procurement checklist will find them anyway. No SLA and no service credits: the Terms provide the Service without a contractual uptime guarantee and say in as many words that we do not currently offer one. No SOC 2, no ISO 27001, no PCI, and no published uptime, latency or success-rate figure, because we measure none we would agree to be held to. No single sign-on, SAML or SCIM. No dedicated, reserved or residential egress. Three regions only — us-east, us-west and europe. If any of those is a hard requirement, the answer is no and you have it in week one rather than week six.
What the word usually gates, and why nothing here is gated
In most products enterprise marks a tier: capability withheld until you talk to somebody. Nothing is withheld here, because there is nothing to withhold it from. Every plan today is activated after an email exchange about what you intend to fetch, and card checkout is being enabled through our payment provider for accounts that would rather not have one.
So a first account and a large one get the same API, the same three regions, the same keys and the same meter. What a larger account brings is volume, invoicing and whatever procurement needs in writing — better agreed before you build than after.
Billing, which is where the real differences sit
This is the part built for somebody who needs a paper trail rather than a receipt in an inbox.
Invoices at period close
Issued with their line items at period close, due 30 days from issue unless we agree otherwise. The dashboard's print view is the invoice document itself.
No card held by us
We store no card details at any point — where a card is used, it is collected by our payment provider acting as merchant of record, never by us. How you pay is settled in the same written agreement as what you pay.
Prepaid credit
Credit paid in advance sits as a balance on the account, shown alongside your invoices: a budget approved once rather than monthly.
Credit notes
The correction path when money has already moved and something needs putting right, rather than a quiet adjustment on a later invoice.
Volume quotes
The catalog plan is 25 US dollars a month including the first 50,000 requests, then 50 cents per 1,000; /pricing reads it live. Anything else is agreed in writing — email billing@roamingproxy.com with your volume and targets.
The meter is the number worth auditing
Usage is metered per request and queryable back over the API, so the count in your own logs reconciles against the count you are invoiced for. Un-invoiced usage is priced against the rate card before the period closes, so a run that quietly doubled is visible early.
Two behaviours protect that number. A failed fetch is not recorded as a served one, and an Idempotency-Key makes a retry after a timeout safe: the stored response returns marked Idempotency-Replayed: true, neither re-executed nor billed twice.
Billing events can be pushed to you as well: register an endpoint, choose its events, read the delivery log. Deliveries are HMAC-signed.
Keys, scopes, and the limit that surprises teams
Keys are scoped, revocable one at a time, and shown in full exactly once. Minting one takes a signed-in dashboard session: an rp_ key is refused with session_required at the key-management endpoints. So a key leaked from a CI log cannot issue its own successor, and revoking it ends it.
Rate limits are per account, not per key — the fact most likely to catch out a team splitting keys by environment. Extra keys separate blast radius, not throughput.
What a security reviewer will ask, answered up front
An egress node fetches arbitrary URLs on a stranger's behalf, so these are the right questions to ask.
SSRF checked after DNS, on every hop
Nodes resolve the hostname and check the resolved address, on every redirect hop rather than only the first. Private ranges and cloud metadata endpoints are refused where the connection would be made.
Egress is authenticated
Nodes verify an HMAC signature on their caller and refuse unsigned requests, so a node is not an open proxy for whoever finds it.
We do not log what you fetched
Target URLs and response bodies are not written down. Metering records request and byte counts, which is what an invoice needs. That cuts both ways: we cannot reconstruct a past run for you.
Webhook endpoints are revalidated
A billing webhook URL is SSRF-validated when you register it and again at every delivery, because a hostname that resolved publicly yesterday can resolve internally today.
The questionnaire items we fail
A security review will ask for a SOC 2 report and an uptime SLA with service credits. We hold neither, and will not describe an internal aspiration as a commitment. What we can set out instead is what the code enforces, and let your reviewer judge it.
The only two response commitments we publish are the two we hold ourselves to: the Terms say we aim to answer abuse reports within two business days, and the Privacy Policy commits to answering a data-rights request within 30 days. Any other number would be one we have not measured.
Questions
- Is there an enterprise tier with extra features?
- No. There is one product and one rate card. Because every account is granted after a conversation anyway, what a larger account negotiates is volume and terms — not access to capability other accounts cannot have.
- Can you sign an SLA with service credits?
- No. The Terms state that the Service is provided without a contractual uptime guarantee and that we do not currently offer an SLA with service credits. We also publish no uptime or latency figure, because we measure none we would agree to be held to. If a signed SLA is a hard requirement, say so in the first email and you will get a no rather than a negotiation.
- Do you have SOC 2 or ISO 27001?
- No. We hold no certifications, and the compliance page says so rather than hinting at an audit in progress. What we can answer in detail is what the service actually does: SSRF enforced after DNS on every redirect hop, HMAC-authenticated egress, size and timeout caps, and no logging of target URLs or response bodies.
- Is single sign-on available?
- No. Sign-in is an ordinary dashboard account and there is no SAML or SCIM provisioning. Separation is done with scoped, individually revocable API keys instead, and those are worth using properly: one key per environment, revoked the moment it is out of your control.
- Can we have dedicated egress addresses, or a fourth region?
- Dedicated or reserved egress is not something we sell today. A new region is a scripted provision and deploy, so it is a question of demand rather than of engineering effort — tell us what you need and you will get a straight answer about whether and when, not a date invented to close a deal.
- How do we start?
- Email billing@roamingproxy.com with the domains you intend to fetch, the region you need, and roughly how many requests a month. You will get either a plan on your account or an honest no, and the no usually arrives because your targets refuse datacenter addresses, which no plan we sell can fix.
Get a key
Create an account and mint an API key in the dashboard. The full endpoint reference — request shapes, parameters and error codes — is published at https://api.roamingproxy.com/v2/docs.