Billed per human seat. Machine identities are free.

You pay for the people who sign in, never for machines.

Free

For a team of up to 3 people.

$0forever

Start free

Up to 3 human seats
Unlimited machine identities
OIDC sign-in for CI
5 projects, 5 environments each

Show all includes

Envelope encryption under AWS KMS
2 integration connections, 3 dynamic secret engines
Insert-only audit log, 14 days

Pro

Unlimited projects and environments, with 180 days of audit history.

$18per seat per month, billed annually

Start free

Everything in Free, plus
Unlimited human seats, projects and environments
Write-only environments: only CI and deploys read values
Custom roles
Insert-only audit log, 180 days

Show all includes

Alerts in Slack, Teams, Discord, Google Chat, PagerDuty or a webhook
Unlimited connections and dynamic secret engines
2000 reads and 300 writes per minute per identity
Priority email support

Enterprise

SSO, an SLA, and a signed DPA.

Customper seat, annual

Contact sales

Everything in Pro, plus
SAML SSO and SCIM directory sync
Your own AWS, GCP, Azure or Vault wrapping key
Audit log streaming to your SIEM, in signed batches
SLA and a named engineer

Show all includes

Alerts routed to each project's own channel
Custom audit retention and rate limits
Compliance commitments by contract

Billed per human seat. Machine identities are free. Every plan gets the same encryption.

What each plan includes

Limits9 rows

Projects5UnlimitedUnlimited

Environments per project5UnlimitedUnlimited

Human seats3UnlimitedUnlimited

Machine identitiesUnlimitedUnlimitedUnlimited

Integration connections2UnlimitedUnlimited

Dynamic secret engines3UnlimitedUnlimited

Custom rolesNoUnlimitedUnlimited

Requests per minute per identity, read / write240 / 602000 / 300Custom

Requests per minute per workspace, read / write600 / 150No capNo cap

Encryption and isolation5 rows

Envelope encryption under AWS KMSYesYesYes

Ciphertext bound to its address (AAD)YesYesYes

Postgres row-level isolation per workspaceYesYesYes

Write-only environmentsNoYesYes

Your own wrapping key (BYOK)NoNoAWS, GCP, Azure or Vault

Delivery5 rows

OIDC and AWS IAM sign-in for CIYesYesYes

Bound keypairs for serversYesYesYes

Syncs to deploy targetsYesYesYes

Short-lived dynamic credentialsYesYesYes

Whole-environment read for External Secrets OperatorYesYesYes

Audit and recovery5 rows

Insert-only audit logYesYesYes

Audit retention14 days180 daysCustom

Point-in-time version historyYesYesYes

Rotation schedules with overdue alertsYesYesYes

Audit log streamingNoNoSigned batches

Alerts3 rows

Email alerts to the members you chooseYesYesYes

Channels: Slack, Teams, Discord, Google Chat, PagerDuty, signed webhookNoUp to 10Unlimited

One project's alerts to its own channelNoNoYes

Access and sign-in5 rows

2FA, and requiring it for the workspaceYesYesYes

Google, GitHub and Microsoft sign-inYesYesYes

Verified email domainsYesYesYes

Reveal approvals for coding agentsYesYesYes

SAML SSO and SCIM directory syncNoNoYes

Support2 rows

SupportCommunityPriority emailSLA and named engineer

Compliance commitmentsNoNoBy contract

Pricing questions

What counts as a seat?

A person who signs in to the console. Machine identities are free and unlimited on every plan.

Is Free encrypted the same way as Pro and Enterprise?

Yes. Every plan gets AES-256-GCM envelope encryption under a data key no other workspace shares, wrapped by AWS KMS, with address-bound ciphertext and row-level isolation.

Is keyless CI included on Free?

Yes. CI signs in with the OIDC token its platform issues. No stored key.

Are there add-ons on top of the seat price?

No. Every control is included in the plan that lists it.

Can I upgrade later?

Yes. Start on Free, then upgrade in the console under Settings, Billing.

Start on Free.

3 seats, unlimited machines and OIDC for CI, with no card.

Start free Compare vendors