ELI5: How does Braintrust's licensing work per developer vs per scan?

I'm a junior DevOps engineer at a mid-size fintech with about 50 developers. We use Braintrust per developer for our main microservices repos, integrated into our CI/CD pipelines.

1. **Pricing Predictability vs. Surprise Bills:** Per developer is a known monthly cost, typically $15-25 per seat. Per scan can start around $0.50 per analysis, but costs can spike unpredictably if a pipeline misbehaves and triggers hundreds of scans.

2. **Integration Effort:** Per developer is simpler to manage in a static team; you just add or remove user seats in the admin panel. Per scan requires more initial setup to instrument and track scans, and you need to be careful about tagging them for cost allocation.

3. **Best for Large, Fluctuating Teams:** Per scan is a clear winner if you have a large open-source project with many outside contributors. They can trigger scans without you needing to manage their license access. Per developer models fail here.

4. **Hidden Cost of Underuse:** With per developer, you pay for the seat even if an engineer doesn't run a scan for a month. With per scan, you only pay for actual analysis runs, which can be cheaper for teams that use it sporadically for manual code reviews.

My team went with per developer because we have a stable team size and run scans on every commit and PR. If your team size changes a lot or you mostly run scans manually, then per scan is probably better. To decide, tell us your average team size and how many scans you run daily.

You've covered the basics, but there's a critical operational detail missing from the per-scan model: cost attribution. When you pay per scan, every pipeline, bot, or contributor creates a bill. Without strict tagging and governance from day one, you end up with a cloud-style bill shock, unable to tell if a $500 monthly invoice came from the main CI pipeline or a contributor's experimental fork. Per developer sidesteps this by making the cost ceiling your engineering headcount.

The "unlimited scans" point for per developer is also a double-edged sword. It encourages embedding analysis everywhere, which is good for security posture but can murder your pipeline times if you're not careful about scan optimization. I've seen teams add a Braintrust scan to twenty parallel CI jobs and wonder why their merge times doubled.

Good operational breakdown, especially the point on underuse. Your fintech context actually highlights a subtle risk with the per-developer model: license compliance.

In regulated environments, you often need to prove an individual engineer completed security training before they can access tools like Braintrust. A per-seat license tied to a person, not a service account, simplifies that audit trail. The per-scan model, where a CI service account executes all scans, decouples the action from a named, trained individual.

You also touched on pipeline performance. With unlimited scans, I've seen teams default to running full analysis on every PR commit. That's overkill. A better pattern is a quick, differential scan on PRs and a scheduled full repo scan nightly. It keeps costs predictable *and* pipeline times sane.

That's a helpful starting breakdown, thanks! The per-scan model being better for "large open source projects with many contributors" got me thinking. If an open source project has tons of drive-by contributors, who actually pays for those scans? Does Braintrust expect the project maintainers to cover the bill for every random PR, or is there a way to pass the cost to the contributor?

You've zeroed in on a critical compliance nuance I've seen trip up teams. The point about a per-seat license creating a cleaner audit trail for individual training attestation is absolutely valid for heavily regulated verticals like finance or healthcare.

However, this creates a secondary administrative burden that's often underestimated. In a per-developer model, you now have a formal procurement and access control process tied to employee lifecycle events. Every new hire, contractor onboarding, or departure requires a license action in Braintrust's admin panel and must be documented for auditors. If your IAM isn't tightly synced with HR, you risk paying for dormant seats or, worse, having an untrained individual gain access because a license was provisioned before their training was logged.

The per-scan model with a CI service account does decouple the action from the individual, as you said, but that forces the compliance proof onto the pipeline governance itself. You'd need to demonstrate that only authorized, trained individuals can merge code that triggers the automated scan. It shifts the compliance burden from user management to pipeline access controls, which some organizations find easier to lock down.

That's a great point about scan optimization being critical with the per-developer model. The risk of pipeline slowdown often gets overlooked in the rush to maximize the "unlimited" value.

I'd add that the performance impact isn't just about merge times. When every parallel job triggers a full scan, you can also saturate the Braintrust API connection limits for your organization, causing random scan failures that are tricky to debug. It forces you to think about orchestration, not just cost.

Precisely. That API rate limiting is a hidden scaling cost that only surfaces under load. When you hit those limits, your pipelines don't just slow down, they fail non-deterministically, which breaks the core promise of a reliable CI/CD gate.

This pushes the engineering burden into building a queuing or orchestration layer on your side to throttle scan requests, which negates some of the "simplicity" benefit of the per-developer model. You're trading one form of cost management, the invoice, for another: operational overhead and pipeline fragility.

Yep, that's the core trade-off laid out really clearly. The "unlimited scans" part of the per-developer model is what makes it so attractive for automated pipelines, but I think it's worth calling out a hidden psychological effect it creates.

Teams often feel pressure to maximize the value of that flat fee, so they'll add scans to every conceivable job and hook. This can lead to bloated pipeline times and, ironically, more engineering hours spent managing that performance hit than they'd spend on a per-scan invoice. I've seen it happen! It's not just about which model is cheaper, but which one aligns with your team's behavior to avoid waste.