Dregs vs Rupt

Rupt and Dregs both go after fake accounts, trial abuse, multi-accounting, and bots on products that need real users. Rupt is built around an evaluation: you ask for a verdict on a specific action, and the product can answer with a hosted challenge. That loop is especially developed for account sharing, where the extra user on a subscription can be sent toward a separate signup. Dregs scores the identity as activity arrives and prices the account, not the checkpoint. Both publish pricing. Here is where each one fits.

At a glance

What Rupt does well

Rupt publishes prices and a 7-day trial, and Premium has a public registration page at app.rupt.dev/register, alongside a demo path. The product is a full loop rather than a score you still have to operationalize. One evaluation collects device and network signals, derives checks from those signals and from the user's history, scores named risks, matches your policies, and returns a verdict. When that verdict is challenge, the SDK can send the user to a hosted email or SMS challenge, with the wording tied to why it fired: sharing, takeover, multi-accounting, a fake account, a repeat trial, or KYC.

Account sharing is the clearest example of that loop, and it is a genuine strength. Rupt's account-sharing guide describes policies on concurrent sessions, impossible travel, and device count, plus a success URL pointed at signup so the extra user becomes a separate customer. Phone intelligence ($0.003, once per number) and hosted KYC ($0.33 per check, selfie or government ID plus selfie) are add-ons Dregs does not offer. Custom risks, weighted from the indicators Rupt already collects, are on the published Premium plan. The pricing matrix also lists scraping and payment fraud beside the account-abuse risks. This page stays on the overlap that matters for SaaS accounts: fake signups, trial abuse, multi-accounting, and sharing.

Where Dregs takes a different approach

Evaluations and continuous scoring

Rupt's docs define an evaluation as the assessment of a single action by a single user from a single device at a single moment. You call evaluate() for the actions you choose to protect. Documented actions include login, signup, and access, and the pricing FAQ sizes a bill from the events you protect, typically logins, signups, and checkouts. A later check of the same account is another evaluation. Checks on that call are derived from the signals on the request and from the user's history. The commercial unit is still the call.

Dregs prices by active identity. An account that generates at least one tracked event in the billing month counts once, and Dregs keeps scoring that identity as further events arrive: Humanity, Authenticity, Uniqueness, and Behavior. Badges, escalations, and webhooks follow when the picture changes, moments after new activity, and you can train the scoring on accounts you already trust. That monthly count is the set of accounts you are watching for abuse. It maps to that ongoing work, which is a different quantity from a stack of evaluations. Lining an identity count up against an evaluation total treats two units as the same thing. The same distinction is on the pricing page.

Scores you can open

Rupt returns named risks, each with a severity from low to maximum, built as a weighted sum of checks. Policies match those checks. Matching a policy on the severity itself is documented as coming soon. The verdict answers the action you evaluated. In Dregs, every score is a standing reading of the account, composed of observations, each with a value, a confidence, and a plain-English explanation, and you can open the score to see exactly why it moved. False positives are part of fraud detection. Seeing the observation behind a flag is how you keep them from costing a real customer, and how a team ends up doing less manual review.

Ninety days of history on the entry plan

Premium keeps 30 days of data. Enterprise goes up to 18 months. Trial cycling and repeat signups often take longer than a month to show: a new email, a quiet gap, the same device. Dregs Starter keeps 90 days of event history, Growth 180, and Advanced 365. Linking accounts across that gap is what free trial abuse and duplicate accounts detection depends on.

The response lives in your application

Rupt's hosted challenge is the response, and for sharing monetization that is the point. Dregs raises badges and escalations and calls webhooks, so your application decides whether to step up, limit, or leave the account alone. Custom rules and lists are part of that: badge rules and escalation rules on every plan, and on Advanced your own analyzers and datasets inside the scoring pipeline. Rupt's custom risks are the parallel idea on the Premium plan. The difference is where the result lives.

Rupt pricing vs Dregs pricing

Rupt pricing facts checked September 29, 2026 against https://www.rupt.dev/pricing. Dregs pricing is current at dregs.com/pricing. If you spot something out of date, email dregs@dregs.com and we'll correct it.

These numbers do not convert into each other. Forty thousand evaluations are not forty thousand identities, and one active identity is not one evaluation. If you only want a verdict at a few chosen actions, Rupt's credit pool can be the smaller bill. If every active account should keep a score as it is used, per-identity pricing matches that work. Rupt also lets you set monthly spend caps, and says it does not bill failed requests. Run both models against the actions you actually protect.

The bottom line

Rupt is a strong choice when the decision has to land on the action, and when a hosted challenge is the outcome you want, especially one that turns account sharing into another subscription. Dregs is the stronger choice when you want continuous, explained scores on the accounts themselves, with months of history on a self-serve plan from $17/month. That is the shape of fake signups, free trial abuse, and duplicate accounts. Comparing another product that returns a verdict in the request path? See Dregs vs Castle.

Frequently Asked Questions