Simple, transparent pricing
Start free. Scale as you grow — add-on packs when you need more. No hidden fees.
Growth
per month, or $249/mo billed annually
500 SBOMs, REST API, full compliance coverage, and open-source license policy enforcement — expandable with SBOM, AI, seat, product, and SSO add-ons as you grow.
Get startedEnterprise
per month, billed annually ($17,988/yr) · or $1,799/mo month-to-month
High-volume capacity sized to your contract, SSO + SCIM, BYOK, dedicated support — including the controls regulated financial institutions need.
Get startedCompare plans
| Starter | Growth | Enterprise | |
|---|---|---|---|
| Core | |||
| SBOMs stored | 10 | 500 † | 50,000 †‡ |
| Products | 3 | 50 † | 1,000 ‡ |
| Team members | 3 | 15 † | 250 ‡ |
| Share links | 5 | 250 | 5,000 ‡ |
| Vault AI queries / month | 50 | 500 † | 2,000 † |
| Audit log retention | 30 days | 1 year | 10 years |
| Dependency analysis & SBOM generation | |||
| Generate SBOM from source (16 ecosystems) | |||
| OSV + NVD/GHSA vulnerability matching | |||
| VaultScore prioritization (EPSS + KEV) | |||
| Remediation advisor + manifest fix PRs | |||
| SBOM quality score | |||
| Supply-chain (malicious / typosquat) detection | |||
| AI supply-chain discovery (LLM SDKs, MCP servers) | |||
| AIBOM generation (CycloneDX) | |||
| Package firewall (inventory + CI gate) | |||
| Dynamic RBOM (agentless runtime analysis) | |||
| Function-level reachability (npm symbol-level) | |||
| Binary analysis (deps in compiled artifacts + images) | |||
| Runtime BOM ingestion + correlation | |||
| VEX export / import + per-project vuln diff | |||
| API & integrations | |||
| REST API keys | 3 | 10 | 100 ‡ |
| GitHub, GitLab & Slack | |||
| CI pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket, CircleCI) | |||
| Pipeline security posture (GitHub + GitLab, incl. self-hosted) | |||
| Ticketing & paging (Jira, ServiceNow, Teams, PagerDuty, Opsgenie) | |||
| SIEM streaming (Splunk, Sentinel, Chronicle, Kafka) | |||
| GRC push (Archer, OneTrust, Brinqa, Vulcan, Nucleus) | |||
| Private container registries (ECR, GCR, ACR, Harbor, Quay, Nexus) | |||
| SARIF / CSV export for CI | |||
| Trust Portal (customer SBOM sharing) | |||
| Compliance & governance | |||
| NTIA minimum-elements check | |||
| EU CRA, FDA, DoD, EO 14028 frameworks | |||
| PCI DSS + ISO 27001 frameworks | |||
| Custom compliance policies | |||
| License Center (inventory, obligations, conflicts) | |||
| Third-party attribution / NOTICE export | |||
| License policy enforcement (allow / flag / block) | |||
| Third-party risk management (TPRM) | |||
| Enterprise & security | |||
| SSO (SAML/OIDC) | Add-on | ||
| SCIM provisioning | |||
| BYOK / customer-managed KMS | |||
| ABAC + dual-approval (SoD) workflows | |||
| Vendor SBOM intake at scale | |||
| FS-ISAC consortium sharing | |||
| FRB SR 11-7 AI governance pack | |||
† Growth add-ons, billed with your subscription and prorated immediately: SBOM Pack (+250 SBOMs, $49/mo), AI Query Pack (+500 queries/mo, $25/mo), Seat Pack (+5 members, $49/mo), Product Pack (+25 products, $29/mo), and SSO (SAML/OIDC, $99/mo). SBOM & AI packs are available on Enterprise too.
‡ Default Enterprise ceiling. High-volume deployments are sized to your committed capacity under contract — talk to us.
Retention of your SBOMs and data requires an active subscription. If you cancel or downgrade, we may delete data not covered by your plan after a 30-day export window — see the Terms.
Need something specific? Talk to us about volume discounts, on-prem / private-cloud deployment, or custom compliance exports.
Start managing your SBOMs today
Free forever on Starter. Upgrade anytime — your data comes with you.
Start for free