Pricing
Priced per person. Machines included.
You pay for the humans in your organization. The service accounts, API keys, CI/CD tokens, and AI agents they own come with the plan — because a platform that charges you more for finding more is a platform you will use less.
Team
For teams standardizing on one identity provider.
500 machine identities included
Billed annually
- Unlimited users
- 500 NHIs managed
- All cloud integrations
- 90-day audit retention
- Advanced JIT access
- Email support
- SAML SSO
- Manual credential rotation
Business
Most chosenFor organizations governing identity across several clouds.
5,000 machine identities included
Billed annually
- Unlimited users
- 5,000 NHIs included
- All integrations + SIEM
- 1-year audit retention
- Multi-approval JIT
- Priority support
- SAML + SCIM
- Automated rotation
Enterprise
For regulated and multi-entity organizations.
From $50,000 / year
- Unlimited everything
- Unlimited NHIs
- Custom integrations
- Custom retention
- AI Agent security
- Dedicated support + SLA
- Custom deployment options
- Compliance assistance
Evaluating on your own first? There is a free tier for up to 3 users and 50 machine identities — ask for access and we will set it up.
What separates the tiers
| Capability | Team | Business | Enterprise |
|---|---|---|---|
| Workforce users | Unlimited | Unlimited | Unlimited |
| Machine identities included | 500 | 5,000 | Unlimited |
| Directory providers | 1 | All | All + custom |
| Provisioning | SAML SSO | SAML + SCIM 2.0 | SAML + SCIM + custom |
| Threat detection | Basic alerts | Full ITDR | ITDR + auto-response |
| Offboarding cascades | Semi-automated | Fully automated | Custom workflows |
| Credential rotation | Manual | Automated | Automated |
| SIEM export | — | Included | Included |
| Audit retention | 90 days | 1 year | Custom |
| Support | Priority | Dedicated | |
| SLA | — | 99.9% | 99.99% |
Questions we get asked
What counts as a machine identity?
Service accounts, API keys, CI/CD tokens, bot accounts, AI agents, and cloud workload identities — anything that authenticates without a person behind it. Workforce users are billed per seat and are not counted against this number.
Does discovering more identities increase my bill?
Not within your tier. You are billed per workforce seat, and each tier includes a generous machine identity allowance. We notify you at 80% of the allowance so nothing is ever cut off by surprise — you can then archive retired identities or move up a tier.
Do you offer a discount for annual billing?
Yes — annual billing is roughly 20% below monthly. Enterprise agreements can be structured over multiple years with custom terms.
Is there a startup discount?
Startups with under $5M raised may qualify for 50% off the first year. Mention it on your call and we will walk through eligibility.
Can I change plans later?
Yes. Upgrades take effect immediately with prorated billing; downgrades apply at the start of the next billing cycle.
How do payments work?
Major credit cards via Stripe for Team and Business. Enterprise customers can be invoiced with NET-30 terms.
Not sure which tier fits?
Tell us how many people you have and which clouds you run. We will tell you what your machine identity count is likely to be before you commit to anything.
Book a design partner call