Pricing
You pay for what you cover
Not per seat. The price follows the blast radius under watch, because that is what is actually at stake — two engineers with five production databases have more exposure than twenty with one.
Free
€0
forever
1 protected resource
Enough to produce your exposure report from your own traffic, with nothing to sign.
- Observe only
- Full timestamped evidence chain
- Open-source verifier, works offline
- Self-hosted recorder
Team
Most common€99
per protected resource per month, tax included
1 to 10 protected resources
Enforcement becomes available: a policy can refuse or hold an operation before it leaves.
- Observe and enforce
- Human approvals with expiry
- Exposure reports and compliance exports
- Hosted in Europe
- Email support, next business day
Business
€24,000
per year, excl. tax
up to 25 protected resources
A flat fee is the right shape again at this size: you are committing to an estate, not counting units.
- Everything in Team
- Cloud, or hybrid deployment on your own infrastructure
- Shared Slack channel
- 99.9% availability commitment
Enterprise
from €60,000
per year, excl. tax
beyond 25 resources, tiered
For organizations that answer to an audit and have to prove who approved what.
- Everything in Business
- SSO and SCIM
- Two-person approval
- 4-hour Sev-1 response, dedicated CSM
- Security questionnaire support
Sovereign and air-gapped
A self-hosted control plane on your own infrastructure, up to full network isolation. From €90,000 a year, with onboarding services. Organizations under sovereignty constraints usually raise this first.
What counts as a protected resource
A production database, a repository organization, or a cloud account bound to a policy, in observe or enforce mode. It is the unit the Console already counts, and the one you can see in your settings at any time.
- A production PostgreSQL database
- A GitHub organization
- An AWS account or a workspace
In every plan, the free one included
Recording never stops
A lapsed card removes enforcement and caps new resources. It does not interrupt the evidence chain — cutting a customer's audit trail over a failed payment would destroy something they may be legally obliged to keep.
Verification does not depend on us
The evidence format and the verifier are published under Apache-2.0. Anyone can check a bundle offline, with no account and without asking our permission. That is the condition for the evidence to be worth anything.
Compliance exports are included
They are not an upsell: they are the reason to buy the product.
Common questions
What happens if I go over my plan's resource count?
Recording continues on all of your resources, without exception. It is new resources that are refused, until you move up a plan or remove one. Nothing already covered stops being covered.
Are prices exclusive of tax?
Team is quoted tax-inclusive: you see €99, you pay €99, VAT is carved out of it. Business and above are commercial contracts and are quoted exclusive of tax, as is normal between companies.
Why not charge per user?
Because a per-seat price gives you a reason to limit who can reach the Console — and that is where approvals are granted, exposure reports are read and policies are reviewed. A security product must never price people out of oversight. The agents are the actors; the humans are approvers, and you want more of them, not fewer.
Can I change plan later?
Yes. The quantity follows the number of resources you cover, and you adjust it from the billing portal at any time. The change takes effect immediately.
Can I host everything myself?
The Recorder and the evidence ledger run on your own infrastructure from the free plan onwards. A self-hosted control plane is part of the sovereign offer.
Start in observe mode, decide afterwards
The read-only deployment takes thirty seconds and interrupts nothing. After thirty days you have an exposure report built from your own traffic — and grounds to judge whether anything needs blocking at all.