PRICING

Pricing built for every fleet.

Free up to 200 endpoints. Request access for everything else. We're in design-partner mode through GA.

01 Free / Apache-2.0 shim

Community Edition

Free. For homelabs and small fleets, up to 200 endpoints.

Self-host on a single node, no Azure
winget detonation, SBOM and attestation — once you attach a Hyper-V or Proxmox host
Chocolatey inventory and management
Local Postgres evidence store, signed bundle export
Local users, roles, and TOTP MFA — zero cloud dependencies
Community support

Get early access

02 Request access

Business

For fleets up to 500 endpoints, with or without a dedicated security team. The dedicated instance runs in your Azure subscription (you need a subscription, a resource group and a DNS record you can publish in) and is available to design partners on request. The Azure bill for it is yours, roughly US$150–350 a month.

A dedicated instance in your own Azure subscription, deployed and upgraded by Attestree
SSO (Entra ID / Azure AD) — included, like every commercial tier
Audit signing with a Key Vault key in your own subscription
Configurable signed audit retention — 7-year capable for SOX / NYDFS
Support terms set in your agreement
Roadmap: a documented API, webhooks, Slack / Teams notifications

Request access

03 Horizon

Regulated and large fleets

For 5,000+ endpoints, and for banks, brokers and insurers under audit.

A dedicated instance in your subscription, in the region you choose
HSM-backed key custody
Evidence bundles designed to support GLBA / SOX; 23 NYCRR 500.15 control attestation
On-prem appliance with vTPM-bound keys, air-gapped evidence sync
SIEM streaming: Sentinel + Splunk (others via webhook)
90-day proof-of-evidence engagement

Talk to us The financial-services page

Pre-GA pricing. Commercial tiers move to listed pricing at general availability.

Regulated and large fleets: Pre-GA and onboarding design partners. These describe where Attestree is heading, not a shipping product today.

The SSO pledge. SSO is a security baseline, not a revenue lever. Every commercial tier includes SSO (Entra ID / Azure AD) at no additional charge — it will never be the reason you upgrade. The free Community Edition uses local login because it runs with zero cloud dependencies, not as a paywall. If you ever find us on the SSO Wall of Shame, hold us to this paragraph.

sso.tax

EVERY TIER

What you get at every tier.

Provenance at ingest

With a detonation host attached, each winget package is detonated and attested at ingest, before it is promoted to a ring.

Continuous reconciliation

Declarative desired state, reconciled continuously. Drift shows up in the console.

Signed evidence

Audit events, ring promotions among them, are signed — and export as a portable bundle that verifies offline.

OSS interoperability

CycloneDX SBOMs and an optional Sigstore Rekor log — open formats, no vendor lock-in.

FAQ

Questions, answered.

When does Attestree go GA?

We have not committed a public GA date. Every commercial tier is in design-partner mode through GA — we are taking on a small number of design partners and giving them direct access to the founder.

Is there a free tier I can run today?

Yes — the free Community Edition, though it is in early access: request access rather than a public download right now. It is the full platform, self-hosted with docker compose for up to 200 endpoints (free under a closed-source EULA; the installer shim is Apache-2.0 OSS). It runs without Azure, covers winget ingest plus Chocolatey inventory and management today (more managers on the roadmap), detonates and attests winget packages once you attach a Hyper-V or Proxmox host, and keeps a Postgres-backed evidence store.

How does Attestree compare to other tools in the space?

Most existing tools either scan after install (so you find out about a bad artifact once it is already on your fleet) or require you to pre-build everything in their own pipeline. Attestree checks artifacts at ingest — with a detonation host attached, each winget package is detonated and attested before it reaches a node — and works with the package managers you already use.

Can I run this fully on-prem?

The Community Edition, yes: it is self-hosted by definition. The Business tier today is a dedicated instance we deploy and upgrade in your own Azure subscription; a self-hosted commercial build is not offered yet. An on-prem appliance with hardware-rooted keys and air-gapped evidence sync is on the horizon for the regulated tier, not built.

What is open source, and what is not?

Attestree is open-core, and we would rather name the core precisely than sound more open than we are. Apache-2.0 covers the installer shim — the component that actually runs on your endpoints, so you can read it, build it from source, and audit exactly what executes at install time. The platform itself is closed source. The Community Edition is a closed-source Docker image under a free-use EULA (up to 200 endpoints, no redistribution of modified binaries), and the commercial tiers are licensed under a Master Services Agreement, which adds the dedicated instance in your own Azure subscription, Entra ID SSO, and a signing key held in a Key Vault there.

Does SSO cost extra?

No, and it never will. Every commercial tier — starting with Business — includes SSO (Entra ID / Azure AD) at no additional charge. We consider SSO a security baseline, not an upsell, and we have no intention of ever appearing on the SSO Wall of Shame (sso.tax). The free Community Edition uses local login because it is designed to run with zero cloud dependencies — an architectural choice, not a paywall. And local does not mean lesser: the free edition ships four policy-enforced roles, TOTP two-factor with recovery codes, and break-glass recovery. Access control is not the thing we hold back.

How do I become a design partner?

Fill out the access request form. Tell us about your fleet, your compliance posture, and what is broken about your current attestation story. We respond within a few business days, and we keep room for smaller teams (under 1,000 endpoints), not just large fleets.

Ready to attest your fleet?

We're in design-partner mode through GA. Get on the list — we'll route you within two business days.

Or tell us more about your fleet and we'll route you faster.