Simple, transparent pricing
Monitor 5 certificates free. Scale to thousands. No hidden fees. No surprises.
Free
For personal projects and small teams getting started.
Free forever
- 5 external endpoints
- 1 scan region (US East)
- 1 CT monitored domain
- 24-hour check frequency
- Email alerts
- 2 team members
Starter
For teams connecting their first cloud accounts.
- 50 external endpoints
- 1 scan region (US East)
- 2 cloud accounts (any provider)
- 5 CT monitored domains
- 12-hour check frequency
- Email, Slack + Discord alerts
- 5 team members
- 2 API keys
Pro
For platform teams managing certificates across multiple cloud accounts.
- 250 external endpoints
- 3 global scan regions
- 10 cloud accounts
- 25 CT monitored domains
- 1-hour check frequency
- All alert channels
- 20 team members
- 5 API keys
- Compliance reports
Business
For infrastructure teams with serious multi-cloud estates.
- 1,000 external endpoints
- 3 global scan regions
- 50 cloud accounts
- 100 CT monitored domains
- 15-minute check frequency
- All alert channels incl. PagerDuty
- 50 team members
- 10 API keys
- Full compliance reports
- Priority support
Need more than 50 cloud accounts?
Custom plans for large infrastructure teams with dedicated support and SLAs.
Compare plans
Frequently asked questions
Yes. 5 endpoints, 1 CT domain, email alerts. No credit card required. No time limit. Use it forever.
One AWS account, one Azure subscription, or one GCP project. If you have 70 AWS accounts and 150 Azure subscriptions, that's 220 cloud accounts - you'd want the Business tier or a custom plan.
We don't cut you off. You'll see a notice to upgrade, and new additions beyond your limit will be queued. Existing monitoring continues uninterrupted.
Yes. Every paid tier starts with a 14-day free trial. Connect your cloud accounts, see the full dashboard, set up alerts. If it's not worth it, cancel before the trial ends and pay nothing.
Pay upfront for 12 months and save ~17%. Annual plans are non-refundable but can be upgraded mid-cycle with prorated credit.
For AWS, we use cross-account IAM role assumption with an external ID - we never see or store your AWS credentials. For Azure, we use a service principal with minimal Key Vault read permissions. All credential material is encrypted at rest with envelope encryption. We only request read-only access to certificate data.
All cloud credentials are encrypted with AES-256-GCM envelope encryption. We only request read-only access to certificate data. All connections use TLS 1.3. We can provide our security practices documentation and architecture overview on request.
Monthly plans cancel immediately at end of billing period. No cancellation fees. Your data is retained for 30 days after cancellation in case you change your mind.
Yes. Open-source projects with active maintainers get free Pro tier. Startups under 50 employees get 50% off the first year. Email us.