Zuplo

What Zuplo actually is

Zuplo is a fully managed, programmable API gateway that runs at the edge. It sits in front of your backends and handles the layer most teams rewrite at least twice: authentication, API keys, rate limiting, request validation, routing, and the developer documentation that goes with it. The programming model is the differentiator. Policies are TypeScript modules that live in your own repository, so a rate-limit rule or an auth check is a code review away rather than a block of XML or a Lua plugin someone copy-pasted in 2019. If you have ever maintained an Apigee policy config or a Kong plugin cluster, the appeal is immediate: version control, tests, and IDE support for gateway logic.

The product bundles three gateways under one roof. The API Gateway is the core, OpenAPI-native routing and security layer. An AI Gateway routes traffic to providers such as OpenAI, Anthropic, Google and Mistral, with semantic caching, prompt-injection protection, secret masking and spending budgets. An MCP Gateway authenticates, routes and governs MCP servers. All three, plus the hosted developer portal, are included on every plan including the free one — an unusually clean packaging decision in a category that loves add-ons. Security controls cover API keys, JWT, Basic Auth, mTLS, bot detection, rate limiting and schema validation, and Zuplo states that SOC 2 Type 2 compliance, audit logs and policy-enforcement evidence are built into the platform.

For teams shopping our serverless platforms and edge computing categories, the deployment story is the other half of the pitch. Gateways are auto-scaled across 300-plus edge locations, with no cluster to size and no node to patch; Zuplo claims a deploy takes about a minute from commit. Configuration flows through GitOps — GitHub on the lower tiers, with GitLab, Bitbucket and Azure DevOps on Enterprise — and per-branch preview environments are unlimited on every plan. Enterprise customers can run dedicated or self-hosted deployments when data residency or network topology demands it.

The company behind it was founded in 2021, raised a $9 million seed in 2023, and is small — which cuts both ways, and we return to that below.

Pricing: what you really pay

Zuplo publishes its pricing, including the Enterprise floor, and we credit that in a category full of "contact us" pages. The Free plan is $0 per month for 100,000 requests, with 300 data centers, unlimited environments, 100 consumers and API keys, 2 projects or services, 2 developer seats, GitHub GitOps, and a day of analytics with live logs and traces. No credit card, no time limit. The honest constraint list: no custom domains, no SLA, community support only, and a two-person cap on the team that can edit the gateway.

Builder costs $25 per month and is explicitly not a team plan. It includes the same 100,000 requests as Free — the fee buys you production features, not capacity: 2 custom domains, 10 environments, 1,000 consumers and API keys, still 2 developer seats. Additional requests run $100 per 100,000, with a hard ceiling of 1 million requests per month. That overage rate is where the arithmetic gets sharp: 500,000 requests a month is $425 on Builder, and the full 1 million ceiling is $925. Above the ceiling you are on Enterprise, which starts at $1,000 per month on an annual contract and includes 1 million requests, a 99.5 percent SLA and one observability integration, with volume discounts above that.

In other words, there is a valley between Builder and Enterprise where a growing API pays more than its traffic justifies, and we would model expected request volume before picking Builder over going straight to a conversation with sales. Also note that analytics beyond live logs is a 14-day trial on the lower tiers, and SSO/RBAC, premium support, audit logs, secure tunnels and upgraded DDoS protection are add-ons or Enterprise-gated. Billing is monthly on Free and Builder; no per-seat pricing anywhere, which is a genuine relief next to per-seat API platforms.

Performance & infrastructure

There are no servers for you to provision here, so our usual benchmark numbers do not apply; what matters is edge placement and autoscaling. Gateways run across 300-plus edge locations with serverless autoscaling and no stated request-per-second ceiling on self-serve plans, which means traffic spikes are absorbed by the platform rather than by your capacity planning. For an audience spread across continents, requests terminate at a nearby edge location instead of crossing an ocean to a single origin gateway — the same argument that drives the wider edge computing category.

Reliability claims need the usual discount applied to a vendor with a short track record. Zuplo has reported zero production downtime since it began running customer workloads and now serves large request volumes, but the company is five years old and the independent incident record is thin. On the plus side, SOC 2 Type 2 attestation, audit logs and policy-enforcement evidence are listed platform features, and the GitOps model means your gateway configuration is recoverable from your repository even if the vendor has a bad day. Logging integrations are broad — AWS CloudWatch, Datadog, Dynatrace, New Relic, Google Cloud Logging, Loki, Splunk, Sumo Logic and VMware Log Insight — so the gateway can feed the observability stack you already run.

The security floor deserves one precise note: basic DDoS protection is included on Free and Builder, with stronger protection sold as an add-on on Enterprise. That is a reasonable baseline, but it is a baseline — teams with real adversarial traffic should price the add-on rather than assume the edge absorbs everything.

Where it falls short

The overage pricing is the first honest complaint. $100 per additional 100,000 requests works out to $1 per thousand requests at the margin, which is defensible at low volume and absurd next to raw compute pricing once traffic is steady — a plain API gateway on general-purpose cloud infrastructure will serve the same bytes for a fraction of that. If your request count is predictable and large, Zuplo's model taxes growth exactly where it hurts.

Second, the free and Builder tiers are deliberately constrained in ways that push real teams upward: two developer seats on both, community support only, no SLA of any kind until Enterprise, and analytics that revert to live logs after a 14-day trial. A 99.5 percent SLA on a $1,000-per-month annual contract is also modest by enterprise standards; the path to 99.999 percent is a negotiation. Third, the company itself: founded 2021, venture-backed but small, with a community that is active in documentation rather than the sprawling plugin ecosystem a Kong or an AWS API Gateway can point to. If Zuplo's roadmap stalls, migrating TypeScript policies elsewhere is real work — the lock-in is in the code, not the contract.

Who should pick this

We'd pick Zuplo for API-first product teams that want gateway policy, key management, documentation and a hosted developer portal in one managed place, especially where OpenAPI is already the source of truth and developers want policy code they can review. The AI and MCP gateway features make it a timely pick for teams putting an AI surface in front of APIs who need rate limits, secret masking and spending budgets without assembling five services. A solo developer or a small business with modest traffic fits the free tier comfortably, and Builder is worth its $25 when the two custom domains and higher key limits matter more than raw requests.

We'd look elsewhere when request volume is steady and large — the overage math above favors self-hosted or commodity gateways — or when you need an SLA, SSO or a large editing team on day one, because all of those land at Enterprise pricing. Teams that want maximum control over the runtime, or a vast plugin ecosystem, will still prefer Kong or a cloud provider's native gateway.

Key takeaways

• Programmable API gateway with TypeScript policies in your own repo, plus AI and MCP gateways and a hosted developer portal included on every plan.
• Free is genuinely usable: 100K requests/month, 300 edge locations, unlimited environments, no credit card — capped at 2 developer seats and no custom domains.
• Builder is $25/month with the same 100K requests, then $100 per additional 100K, capped at 1M requests/month — model volume before committing.
• Enterprise starts at $1,000/month annually (1M requests, 99.5% SLA, up to 99.999% custom) and is the only path to SSO/RBAC and any SLA.
• Auto-scaled across 300+ edge locations with GitOps deployment; basic DDoS protection included, SOC 2 Type 2 stated.
• Best fit: API-first product teams and AI/MCP gateway use cases; look elsewhere at high steady volume or when you need enterprise guarantees on day one.

Sources

• https://zuplo.com/docs/pricing
• https://thegeeksclub.com/platforms/zuplo
• https://zuplo.com/blog/announcing-9M-raise
• https://pitchbook.com/profiles/company/496261-90
• https://tracxn.com/d/companies/zuplo/__LLzx_Vr1KKdJRSiHAwZ7G6-kXS-9IJPHcfLM_-xSZU0
• https://apigatewaycost.com/zuplo