LlamaIndex

"LlamaIndex" refers to two different things a buyer needs to keep separate. The open-source framework (run-llama/llama_index on GitHub, MIT licensed) is a free library for building retrieval-augmented and agentic applications over your own data — you self-host and pay only for whatever LLM/vector-store APIs you plug in. LlamaCloud, including LlamaParse (document parsing/extraction) and Workflows, is the company's commercial hosted platform, sold on a metered credit plan. You can use the framework without ever touching LlamaCloud, or use LlamaParse standalone without the framework — but the vendor's homepage now leads with the commercial platform, not the library, so it's easy to land on a pricing page expecting the free tool.

The core Python repo has 51,773 GitHub stars, 7,977 forks, and was last pushed to within the day (checked 2026-08-21); merges land roughly daily, not sporadically. GitHub's contributor API lists on the order of 1,900+ distinct contributors (including anonymous commits) since the project's November 2022 start as "GPT Index." The TypeScript package saw about 526,000 npm downloads in the trailing month (2026-07-21 to 2026-08-19). This is a genuinely large, still-active OSS project, not an abandoned one riding on early stars.

Pricing is public and credit-based, at a consistent rate of roughly $1.25 per 1,000 credits across tiers: Free ($0/month, 10K credits), Starter ($50/month, 40K credits included, pay-as-you-go up to 400K credits), Pro ($500/month, 400K credits included, pay-as-you-go up to $5,000/month, plus a stated limited-time bonus of 800K credits for $1,000 one-time), and Enterprise (custom, with volume discounts on credits — no published number). What a "credit" buys (pages parsed, tokens extracted, etc.) isn't stated on the pricing page itself, so budget conservatively until you've run your own documents through the free tier.

The company runs a real Vanta-hosted trust center at security.llamaindex.ai, not just a marketing security page. It lists a SOC 2 Type II report (2025) with a bridge letter (2026), a penetration-test executive summary (2026), GDPR and HIPAA compliance badges, a standard DPA and an EU DPA, and a named subprocessor list (AWS, GitHub, Slack, Zoom). That's a fuller disclosure set than most vendors this size publish, and it's the kind of thing that shortens a security-review cycle if you're buying LlamaCloud for enterprise use.

OSV/GitHub Security Advisories list 9 distinct disclosed vulnerabilities in llama-index between August 2023 and October 2025, all with patched versions available. Two were rated CRITICAL: a SQL injection in the text-to-SQL query engines (CVE-2024-23751, fixed after 0.9.35) and a separate arbitrary-code-execution issue. Others include a HIGH-severity command injection in the RunGptLLM integration, insecure temporary-file handling (HIGH), and denial-of-service and hash-collision issues (MODERATE). None are open/unpatched as far as the advisories show, but the count and severity reflect the risk of a framework with a very large surface of community-contributed loaders and integrations — worth a dependency-scan pass before you rely on text-to-SQL or dynamic-execution features specifically.

As of this check, LlamaIndex's G2 profile shows only about 2 reviews (4.8 average), and the separate "Document Parsing" category listing for LlamaParse shows effectively no reviews. The vendor cites Rakuten, Carlyle, Salesforce, and KPMG as LlamaCloud customers, and Databricks Ventures and KPMG Ventures made minority investments in the company in May 2025 — but these are vendor/press claims, not independent user reviews, and we found no meaningful independent review sample to weigh them against.

The framework moves fast and has broken backward compatibility more than once. The 0.11 release (documented in the official changelog) removed the ServiceContext object entirely in favor of a Settings object, and removed LLMPredictor in favor of the LLM class directly. If you're building something you intend to run in production for years without close maintenance, budget time for periodic upgrade work rather than assuming point-release compatibility.

Founded by Jerry Liu (CEO) and Simon Suo (CTO), both ex-Uber, who published the project (then called GPT Index) in November 2022 and incorporated the company in April 2023. LlamaIndex raised a $19M Series A in March 2025 led by Norwest Venture Partners with participation from existing investor Greylock, bringing disclosed funding to $27.5M total. In May 2025 the company separately announced undisclosed minority equity investments from Databricks Ventures and KPMG Ventures.