Pricing

Published prices, and what moves them

Six products have a published price: four that run today and two priced ahead of release. Dredd will be quoted and PosturePortal is not priced yet. Below is every factor that moves the number, so you can size it before you ask.

Estimate your monthly cost

Pick who it is for, enter rough numbers and choose what you need. The figures are the ones in the tables below: euros per month, excluding VAT.

The calculator needs JavaScript. Every figure it uses is in the tables below.

Indicative only. This calculator, and every price on this website, is given for information and without obligation: no rights can be derived from it. Prices and calculations can contain errors and can change. What you pay is set by the quote or order you accept and the service agreement that comes with it, and where a price shown on this website is evidently wrong, we are not bound by it.

What each product counts

Every product is priced on the thing that actually drives its cost and its value to you. Those are not the same unit, and forcing them into one would misprice most of the portfolio.

ProductPriced on
ShareCareMicrosoft 365 users
SecurityPortalUsers, at a lower rate with any ShareCare tier · €50 monthly tenant minimum
ConditionalAccessPortalUsers, with the same €50 monthly tenant minimum as SecurityPortal
WebScanMonitored sites · free with every SeQontrol account
MailTrustSending domains; parked domains at a lower rate, five included with each
CompliancePortalPer tenant, banded by how many frameworks are in scope
DreddMonitored configuration scope — quoted, not listed
PosturePortalNot yet priced — still in development

The figures, product by product

Pick the one you are buying. Everything that applies to the whole account — the floor, the volume bands, and what does and does not move your number — is below, outside the tabs, because it applies whichever you pick.

ShareCare

Per Microsoft 365 user, per month

 Visibilitysee itGovernancegovern itAutomationact on it
List€2€4€6.50
100 users€200€400€650
250 users, 10% off€450€900€1,462.50
1,000 users, 20% off€1,600€3,200€5,200

Volume: 10% off above 100 users, 20% above 500, 30% above 2,000. The discount applies to the whole bill, not just the users past the threshold.

  • Visibility — Read-only inventory of sharing and permissions, with risk scoring, findings history, fleet view and daily scheduled scans.
  • Governance — Adds oversharing and advanced detections, policies, access reviews, approvals, waivers, evidence packs, and six-hourly scans.
  • Automation — Adds hourly scans plus OneDrive permission and sharing-link write-back with undo, requiring a separate connector remediation consent.

There is no seat minimum and no platform floor: a twelve-person company pays for twelve people, and nothing is added on top. What each tier includes is in the table below.

What the licence includes

Technologies covered

Microsoft 365
  • SharePoint
  • OneDrive
  • Teams
  • Entra ID app consents
  • Exchange Online forwarding
  • Power Platform
  • Power BI
Beyond Microsoft 365
  • Box
  • Slack Connect
  • Google Workspace — roadmap
CapabilityVisibilitysee itGovernancegovern itAutomationact on it
Price
Per Microsoft 365 user, per month€2€4€6.50
At 100 users, per month€200€400€650
Cadence
On-demand scan, whenever you want oneIncludedIncludedIncluded
Scheduled scan cadenceDailyEvery 6 hoursHourly
Inventory and detection
Sharing and permission inventory across every connected workloadIncludedIncludedIncluded
Risk scoring by sensitivity, exposure and reachIncludedIncludedIncluded
Findings history and reportsIncludedIncludedIncluded
Fleet view across managed tenantsIncludedIncludedIncluded
Oversharing detection — org-wide links and company-wide groupsNot includedIncludedIncluded
Advanced detections — anonymous links, dormant guests, over-permissioned appsNot includedIncludedIncluded
Governance
PoliciesNot includedIncludedIncluded
Owner-delegated access reviews and recertificationNot includedIncludedIncluded
ApprovalsNot includedIncludedIncluded
Waivers and risk acceptance, with mandatory expiryNot includedIncludedIncluded
Evidence packsNot includedIncludedIncluded
Write access
Automated remediation write-back, with grace window and undoNot includedNot includedIncluded

Environment size is a quote-time band, not a meter. The invoice stays on seats, but at quote time we ask roughly how large the SharePoint and OneDrive environment is — storage volume and site count. Almost every tenant sits in the standard band. A tenant whose environment is far larger than its seat count suggests — the 40-user firm with twelve terabytes — is banded accordingly, so it is priced for what it actually costs to crawl rather than discovering that later. Nothing about this is metered, gated or counted after the fact.

Counted on users rather than on shares or resources — metering the resource count would punish the messiest environments, which are exactly the ones that need it most, and it could not be quoted before a discovery scan. Write-back is live for OneDrive permissions and sharing links; Exchange forwarding, SharePoint site roles, Power Platform and delegated-admin relationships are detected but not yet revoked app-only.

SecurityPortal

Per user, per month

€1.50 per user with any ShareCare tier, which is the usual case, or €3.50 standalone. Same denominator as ShareCare, so it adds to an existing line rather than starting a new negotiation.

A €50 monthly minimum per tenant

Charged greater-of, and it exists because roughly half of what this product checks does not shrink with headcount. A 20-seat tenant has about as many Conditional Access policies, app registrations and configuration settings as a 2,000-seat one, and every one of them is evaluated either way. Per-user alone would price a full posture scan of a small tenant at thirty euros. The floor bites below 34 users with a ShareCare tier and below 15 standalone; above that the per-user arithmetic is the whole bill.

What you get — read-only Microsoft 365 and Entra posture scans, on demand or daily, with findings history across managed tenants.

What the licence includes

Technologies covered

Microsoft 365 and Entra
  • Conditional Access
  • MFA enforcement
  • Entra ID app permissions
  • Sign-in risk signals
  • Log Analytics (KQL checks)
CapabilityIncludedone tier
Price
Per user, per month — with any ShareCare tier€1.50
Per user, per month — standalone€3.50
Monthly minimum per tenant, greater-of€50
Capability
On-demand scan, whenever you want oneIncluded
Scheduled scan cadence — dailyIncluded
Microsoft 365 and Entra posture — Conditional Access, MFA, app permissionsIncluded
Log-analytics checks, where activity logs are exportedIncluded
Posture ladder, advanced only by scan evidenceIncluded
Control-reference tags on every findingIncluded
Findings history and reportsIncluded
Fleet-wide across managed tenantsIncluded
Write access to your tenantNot included

One tier, not a ladder: SecurityPortal is scan-only, so there is no write access to sell on a higher tier. Remediation lives in the products built to write safely. The log-analytics checks need the tenant to export activity logs; without that export they report “not assessed” rather than a pass. Public-facing web and domain systems are WebScan, licensed separately and free to run.

ConditionalAccessPortal

Per user, per month · not released yet

On the same denominator and the same €50 monthly tenant minimum as SecurityPortal, because it answers the same question about the same environment.

 Visibilitysee itGovernancegovern itAutomationact on it
Per user, per month€0.60€1.00€1.50
Monthly minimum per tenant, greater-of€50€50€50
  • Visibility — Read-only inventory of every Conditional Access policy, and the access map: which endpoints reach which resources, through which policies, and where a path is allowed or blocked.
  • Governance — Adds baseline coverage gaps, and policy-as-code drift detection: connect a Git repository of policy, compare it against the live tenant on a schedule, and see field by field where the tenant has moved. Adds capture in the other direction too — take a tenant’s live policy set into the repository as a pull request somebody reviews.
  • Automation — Adds approval-gated write-back: enable, disable or move a policy to report-only in your tenant, and deploy the repository’s policy to it. Every change needs an approval from somebody other than the person who requested it, and a separate connector consent.

What the licence includes

Technologies covered

Microsoft 365 and Entra
  • Conditional Access policies
  • Named locations
  • Device filters
  • Authentication strengths
Policy as code
  • GitHub
  • Azure DevOps
CapabilityVisibilitysee itGovernancegovern itAutomationact on it
Price
Per user, per month€0.60€1.00€1.50
Monthly minimum per tenant, greater-of€50€50€50
Capability
Conditional Access policy inventoryIncludedIncludedIncluded
Access map — endpoints, policies, resources, allowed and blocked pathsIncludedIncludedIncluded
On-demand scan, fleet-wide across managed tenantsIncludedIncludedIncluded
Baseline coverage gapsNot includedIncludedIncluded
Policy-as-code drift detection — Git repository, GitHub or Azure DevOpsNot includedIncludedIncluded
Scheduled repository-versus-tenant comparison, with historyNot includedIncludedIncluded
Baseline capture — a tenant’s live policy into the repository, as a pull requestNot includedIncludedIncluded
Approval-gated policy write-back to your tenantNot includedNot includedIncluded
Deploy repository policy into your tenant, approval-gatedNot includedNot includedIncluded

Governance reads, Automation writes. Everything on Governance leaves your directory as it found it; capture writes only to your Git repository, as a pull request somebody has to merge. Automation is the one rung that changes your tenant, and nothing is ever deleted — a policy your tenant has and the repository does not is reported, never removed.

Not released yet. Built, running and close — the price is published so it is not a surprise when it ships, not because you can buy it today. What it does, and what it does not.

WebScan

Per monitored site, per month

 Freewith every accountProkept and scheduled
List€0€20
5 sites€0€100
25 sites€0€500
  • Free — The complete check set on demand, graded with references and fixes — nothing kept once you close the page.
  • Pro — Keeps results, history and audit trail, scans on a schedule, and alerts on expiry, new assets and regressions.

WebScan is priced on its own

WebScan has no minimum charge, so an account that started with a free scan pays only for the sites it keeps. Nothing is added when a second product applies from that point.

Discovered subdomains are free, and stay free until you say otherwise

Pro lists the hostnames it finds under a site you already pay for — the name, whether it still resolves, where it last pointed — and never bills for them, however many turn up. Promoting one to a monitored site is a button you press; only then is it scanned and counted, so nothing here can raise your bill on its own. Coverage is partial and improving — the limits page says how.

Scanning is never counted — only sites you chose to keep, once per billing period each, however often they run.

What the licence includes

Technologies covered

Discovery
  • Subdomain and asset discovery
  • Certificate transparency monitoring
Transport
  • TLS versions and cipher suites
  • Certificate chain and expiry
  • Client handshake simulation
  • HSTS
  • IPv6 and protocol readiness
HTTP
  • Security headers
  • Cookie flags
  • Redirect chain
DNS
  • CAA
  • DNSSEC
  • Nameserver and record hygiene
Content and infrastructure
  • Exposed paths and files
  • Open ports and exposed services
  • security.txt (RFC 9116)
  • Server and technology disclosure
CapabilityFreewith every accountProper monitored site
Price
Per monitored site, per month€0€20
Five sites€0€100
The scan itself
On-demand scan, whenever you want oneIncludedIncluded
The complete check setIncludedIncluded
Scan a site you have not onboardedNot includedIncluded
Subdomain and asset discoveryIncludedIncluded
Certificate transparency lookupIncludedIncluded
Certificate expiry, checked on every scanIncludedIncluded
Graded score with the four result states kept apartIncludedIncluded
Standard and RFC references on every checkIncludedIncluded
Why it matters, and the fix, on every failureIncludedIncluded
Sites you may keep—Unlimited
What happens afterwards
Results kept once you close the pageNot includedIncluded
Scan history and trend over timeNot includedIncluded
Findings, waivers and an audit trailNot includedIncluded
Control-reference tags, feeding CompliancePortal as evidenceNot includedIncluded
Fleet view across sites and managed tenantsNot includedIncluded
Watched on a clock, between scans
Certificate expiry warned before it lapses, not afterNot includedIncluded
Certificate transparency monitoring — alerting on new issuanceNot includedIncluded
Alerting when discovery turns up a new assetNot includedIncluded
Alerting when a passing check regressesNot includedIncluded
Running without you
Scheduled scans, on a cadence you setNot includedIncluded
Write access
Write access to your DNS or web serverNot includedNot included

Two licences, not a ladder, and the reason is that the ladder sold a distinction nobody makes. Keeping a scan and running it on a schedule were separate tiers; but a saved site nobody re-scans is a stale record, and a schedule that keeps nothing is a cron job with no output. Pro grants both.

The free tier is the whole scanner, and that is deliberate. It is not a trial with an expiry date: it is auto-granted to every SeQontrol account, and what it does not do is remember.

Counted per site rather than per domain, because a site is what gets scanned: one domain can front several, and each is its own configuration to grade. Nothing caps how many sites you may add; the count is trued up, never a hard stop.

Pro is €20, against paid comparables that start around three times that. They run from there to several hundred per asset per month, and they include active vulnerability testing that WebScan does not do. At the other end the free graders charge nothing and retain nothing. The gap between those two is where this sits.

WebScan never writes anywhere; SPF, DKIM and DMARC belong to MailTrust.

MailTrust

Per domain, per month

 Visibilitysee itGovernancegovern itAutomationact on it
Sending domain€15€30€40
Parked domain€3€3€3
3 sending, 40 parked€120€165€195

Five parked domains included with every sending domain — the example above prices the remaining 25.

  • Visibility — Daily and on-demand scans of SPF, DKIM, DMARC, BIMI and MTA-STS, plus DMARC aggregate report ingestion.
  • Governance — Adds guided staged rollout toward enforcement, deliverability and authentication alerting, multi-domain fleet view, and six-hourly scans.
  • Automation — Adds hourly scans; DNS write-back, on separate connector consent, live for Azure DNS and DNSimple only.

Why a parked domain costs €3 and not €15

Most organisations own far more domains than they send from: acquisitions, retired brands, defensive and typo registrations. Those are exactly the ones worth spoofing — no real mail flows, so nothing breaks and nobody notices.

Charging full rate for them makes the rational decision protect fewer domains, which is the behaviour this product exists to prevent. The classification is measured, not asserted: a domain is parked when it has produced no DMARC report volume and no DKIM signing for a full period, and it reclassifies itself the moment you start sending from it.

If you are a provider: partner rates

The list price above is a retail price, and a provider is not a retail buyer: the partner does the onboarding, the sender inventory and the support conversation, then sets their own retail.

 Visibilitysee itGovernancegovern itAutomationact on it
Sending domain, across your whole book€5€10€13
Parked domain€1€1€1

A third of list, rounded to the euro. Minimum ten managed tenants, on a provider agreement — the same bar as pooled compliance, and for the same reason: below it the arithmetic stops describing wholesale and starts describing a discount. Five parked domains still included with every sending domain, and domains pool across your managed tenants.

What that comes to

Sixty clients averaging three sending domains each is 180 domains. On Governance that is €1,800 a month against €5,400 at list. Your resale price is yours to set.

What Automation writes, and where it does not

DNS write-back is live for Azure DNS and DNSimple. Anywhere else, Automation gives you a staged rollout and the exact records to apply yourself — guidance, not automation. That is why the tier is €40 rather than the €50 the capability would be worth if it wrote everywhere. Cloudflare and Route 53 are next, and the price moves when they ship, not before.

What the licence includes

Technologies covered

Standards
  • SPF
  • DKIM
  • DMARC
  • BIMI
  • MTA-STS
DNS write-back — live
  • Azure DNS
  • DNSimple
DNS write-back — not yet
  • Cloudflare
  • Route 53
  • Everything else — guided steps
CapabilityVisibilitysee itGovernancegovern itAutomationact on it
Price
Per sending domain, per month€15€30€40
Per parked domain, per month€3€3€3
Parked domains included, per sending domain555
Cadence
On-demand scan, whenever you want oneIncludedIncludedIncluded
Scheduled scan cadenceDailyEvery 6 hoursHourly
Assessment
SPF, DKIM, DMARC, BIMI and MTA-STS postureIncludedIncludedIncluded
DMARC aggregate report ingestion and sender analysisIncludedIncludedIncluded
Findings history and reportsIncludedIncludedIncluded
Unlimited domains on every tierIncludedIncludedIncluded
Parked domains watched for silent record changesIncludedIncludedIncluded
Governance
Guided staged rollout toward enforcementNot includedIncludedIncluded
Deliverability and authentication alertingNot includedIncludedIncluded
Multi-domain fleet viewNot includedIncludedIncluded
Write access
DNS write-back for supported providersNot includedNot includedIncluded

Report volume carries an allowance. Ingesting, parsing and storing DMARC aggregate reports is a real cost that scales with how much mail a domain sends, not with how many domains you have — so each domain includes an allowance sized to normal sending volume, and unusually high-volume domains buy additional blocks. Same test as the deliverability allowance: a genuine external cost, optional, and bursty. Posture, findings and reports stay uncapped.

No tier caps how many domains you may add — the count is a commercial measurement, trued up on the next invoice, never a hard stop. Ingesting DMARC reports needs a mailbox to receive them; that is part of onboarding.

CompliancePortal

Per tenant, per month · banded by frameworks in scope · not released yet

 1 frameworksingle regime3 frameworksthe usual mixUnlimitedevery regime
Evidence€300€600€900
Attested€450€900€1,350

Priced per tenant rather than per user, because a framework is the same amount of work to prove whether you have forty people or four hundred.

  • Evidence — On-demand assessments run automated probes; crosswalked results populate the evidence repository, with time-boxed auditor access.
  • Attested — Adds attestation and sign-off with four-eyes and expiry, automated evidence capture, control ownership and remediation tasks.

Two questions, two axes

How many frameworks you need is scope. Whether you want sign-off and automatic capture is depth. Those used to share one number, which meant a company doing SOC 2 alone had to buy every framework in the catalogue to reach attestation — paying for twenty-three regimes it would never open, to get one capability.

Evidence is the catalogue, the crosswalk, automated probes, assessments, the evidence repository and time-boxed auditor access. Attested adds attestation and sign-off with four-eyes and expiry, control ownership, and automated evidence capture — at half again the band price, whichever band you are on.

If you are a provider: pooled framework licences

Per-tenant compliance pricing does not survive a fleet. Sixty clients on the entry band would be €18,000 a month, which providers will not pay. So for providers the two cost drivers are separated and charged for individually.

 Priceper month
Framework licence, across your whole book€750
— or every framework, across your whole book€3,000
Per managed tenant — Evidence€50
Per managed tenant — Attested€75
Retention36 months included · 84 months +€10 / tenant

Minimum ten managed tenants, on a provider agreement. Below that the arithmetic stops describing pooling and starts describing a discount.

What that comes to

Sixty tenants on one framework with sign-off: €750 + 60 × €75 = €5,250 a month, about €88 a client. Thirty tenants on two frameworks without sign-off: €1,500 + 30 × €50 = €3,000, €100 a client. Compare the first with the €27,000 the same book would cost at per-tenant rates.

Two things this page will not pretend about

Provider-scoped licences are not built. Entitlements in this platform resolve per tenant. A licence saying "this provider may assess SOC 2 against any client in its book" is granted at the provider and enforced at the tenant, and that shape does not exist in the catalogue today. The prices above are what you will be quoted; the gate behind them is work in progress.

Assessments do not run on a schedule yet. You raise one when you want one. What is continuous is the evidence underneath — SecurityPortal, ShareCare, WebScan and MailTrust scan on their own schedules, and their control-tagged findings are what an assessment reuses.

What the licence includes

Technologies covered

Microsoft
  • Entra ID
  • Exchange Online
  • SharePoint
  • Teams
  • Intune
  • Azure
  • Purview
  • Power Platform
  • Power BI
Other clouds
  • Google Cloud
  • Amazon Web Services
Engineering
  • GitHub
  • Azure DevOps
Frameworks — 24 in the catalog
  • SOC 2
  • ISO 27001
  • ISO 27002
  • ISO 27017
  • ISO 27701
  • NIST CSF
  • PCI DSS
  • HIPAA
  • GDPR
  • NIS 2
  • DORA
  • FedRAMP
  • CMMC
  • CSA STAR
  • Essential Eight
  • Cyber Essentials
  • NEN 7510
  • MITRE ATT&CK
  • OWASP
  • A first-party set
Capability1 frameworksingle regime3 frameworksthe usual mixUnlimitedevery regime
Price
Evidence — per tenant, per month€300€600€900
Attested — per tenant, per month€450€900€1,350
In every band
On-demand assessment, whenever you want oneIncludedIncludedIncluded
Recurring scheduled assessmentsNot includedNot includedNot included
Framework and benchmark catalogIncludedIncludedIncluded
Multi-framework crosswalk — one piece of evidence, many controlsIncludedIncludedIncluded
Automated control probes across the connected servicesIncludedIncludedIncluded
Google Cloud and AWS coverage via read-only connectorsIncludedIncludedIncluded
Evidence reuse from SecurityPortal, ShareCare and MailTrustIncludedIncludedIncluded
Assessment workflow and immutable snapshot trailIncludedIncludedIncluded
Evidence repository and provided-by-client requestsIncludedIncludedIncluded
Time-boxed auditor accessIncludedIncludedIncluded
Scales with the band
Frameworks in scope13Unlimited
Evidence retention12 months36 months84 months
Attested adds, at any band
Attestation and sign-off, with four-eyes and expiryIncludedIncludedIncluded
Automated evidence captureIncludedIncludedIncluded
Control ownership and remediation tasksIncludedIncludedIncluded

Not called Automation, and not an accident. On the ladder products that word is the tier that writes to your tenant. CompliancePortal writes nothing — it maps, scores, evidences and attests. Automated evidence capture reads from the environment; it does not act on it.

The scheduled-assessment row is empty in all three bands rather than quietly ticked. And the scope holds either way — this proves the technical controls on the platforms SeQontrol connects to, not a whole-company compliance programme.

Dredd and PosturePortal

One quoted, one not yet priced

Dredd is still in development, and quoted rather than listed when it lands. Its unit is monitored configuration scope, which is the metric this model understands least, and it is being set against real environments rather than guessed.

PosturePortal carries no price at all, because it is still in development. It will not be a separate line when it arrives — it connects to nothing and reads the shared findings store — but exactly how it is packaged is unsettled, and a price against something still being built is how a price list stops being worth reading.

Everything else on this page is listed in full.

What the Dredd licence includes

Technologies covered

Control planes
  • Microsoft Entra ID
  • Microsoft 365 tenant config — designed
  • Intune — designed

Dredd is still being written, and has no list price. When it lands it will be quoted rather than listed: its unit is monitored configuration scope, the metric this model understands least, and it is being set against real configuration scopes rather than guessed. What it is meant to do is on the Dredd page.

What the PosturePortal licence includes

Technologies covered

Reads from
  • ShareCare
  • SecurityPortal
  • WebScan
  • CompliancePortal
  • MailTrust
  • Dredd
  • Connector health
CapabilityIncludedone tier
Cross-product findings aggregationIncluded
Posture scores, top risks and trendsIncluded
Connector health and coverage visibilityIncluded
Saved views and annotationsIncluded
Fleet overview across managed tenantsIncluded
Write access to your tenantNot included

Still in development, and deliberately not on the price list. PosturePortal connects to nothing itself — it reads the shared findings store — so it costs almost nothing to run and will not be sold as a separate line. Exactly how it is packaged is not settled, and putting a number against something still being built is how a price list stops being trusted. The capabilities listed for it describe what it does; none of them is something you can buy today.

License flavours

See it. Govern it. Act on it.

The three tiers mean the same thing on every product that has them; each tab above lists what they include there.

Each tier contains the one below. Moving up is an entitlement change, not a migration or a reinstall — the capability is already in the product, waiting to be switched on.

Tier 1 · Visibility

See it

Know what is actually there
  • Continuous inventory of the environment the product covers
  • Risk scoring and findings, deduplicated and tracked over time
  • Reporting and export, including scheduled reports
  • Daily scheduled scans, plus on-demand scans whenever you want one
  • Strictly read-only — nothing is written to your tenant on this tier
Tier 3 · Automation

Act on it

Let it fix things
  • Everything in Governance
  • Hourly scheduled scans — the tightest loop between a change and its finding
  • Automated remediation and write-back into the customer's tenant or DNS
  • Simulate, then execute — with a grace window and undo where the platform supports it
  • Two independent gates: the license entitlement and the connector's own remediation consent. Either one off means nothing is written

Why the top tier is separate

Tiers 1 and 2 read and record. Tier 3 changes your production tenant. That is a difference in kind, not degree, so it is a distinct purchase and a distinct consent — and it stays revocable without losing the visibility and evidence you already paid for.

Cadence is a tier feature. Looking is not.

The tiers set how often a scan runs on a schedule — daily, every six hours, hourly. They never limit how often you may look: an on-demand scan is available on every tier, at any time, as many times as you need. Nothing about an incident should require a purchase order.

What you pay for

Every price on this page is in euros, per month, excluding VAT. VAT is added where it applies, and SeQontrol is sold to businesses only.

There is no platform minimum. You pay for the products you hold, in the unit each one counts, at any size. The tenancy, auth, audit trail, findings store, reporting and scheduling that every product runs on are included rather than charged separately. A 30-user tenant on ShareCare Visibility computes €60 and pays €60.

What moves the number

  • Which tier you buy. Each product tab above lists what its tiers include.
  • How big the environment is, in the unit that product counts.
  • Whether you are a provider. Users, sites and domains pool across managed tenants — so ShareCare’s volume bands count the users of your whole book, not of each client — compliance frameworks are licensed once across the book, and the per-tenant floor applies as greater-of rather than added on top.

Your own tenant, if you are a partner

€50 a month, every released product, every tier, on the tenant you run your own business from. The same tenant computes somewhere between €260 and €640 at list; this is deliberately below what a tenant costs us to run.

A provider who runs this on themselves every day can demonstrate it from a live tenant instead of a slide, and will find our mistakes before your clients do.

  • Your own tenant — the domain on your provider agreement, checked against it.
  • Requires a provider agreement, accepted online when you sign up as a provider. It is a partner benefit, not a tier you can buy on its own.
  • Everything included, up to 50 users. Above 50 users, normal pricing applies.
  • Not for client tenants, and not resellable. Client tenants are priced as client tenants.
How metering works

We meter the environment, never the activity

The rule we hold ourselves to: never meter the thing we want you to do more of. Metered scanning teaches you to scan less, discover less and get less value — and then to conclude the product never found anything.

Never per scan

Scan as often as you like; an on-demand scan never costs extra. A tier buys how often it runs on its own, never how often you may look. Per-scan pricing would make you widen your schedule to save money, which defeats the entire point of continuous assurance.

Never per finding

Charging per finding makes a worse posture cost more to see. Findings are never counted, and neither are remediation actions.

Environment, not effort

Users, domains, tenants or monitored scope — depending on the product. Each one correlates with our cost and your value, and each is a number you already know at quote time.

Enforcement: two different failures, two different behaviours

SituationWhat happensWhy
Not entitled to a product or capability The capability is refused outright An entitlement is a capability gate. If you have not bought write-back, nothing writes back.
Over your unit count Warning at 100%, a banner at 110%, trued up on the next invoice Units are a commercial measurement, not a kill switch. Growing past your estimate is a billing conversation.
Drifting over it quietly We review overage monthly and come to you A soft cap only works if somebody reads it. The review is ours to run, so the first you hear of a mismatch is a conversation — not a surprise line on a renewal.
Any commercial dispute at all Your scans keep running Hard-capping a security scan mid-incident is a security failure. We do not do it.

Where allowances genuinely apply

Two things carry a real external cost per use, are optional, and are bursty. They get an included allowance rather than being folded into the base price. Everything else — scans, remediation actions, findings, evidence exports — is uncapped.

AllowanceIncludedBeyond that
Deliverability tests50 per month, per domainCharged per test — we send and receive real mail
DMARC aggregate report volumeAn allowance per domain, sized to normal sending volumeAdditional blocks — ingesting, parsing and storing reports scales with how much mail you send, not with how many domains you have
AI remediation guidance and report narrativesFair useAdd-on packs — there is a real per-call model cost

What never moves it

How many products you take. There is no suite discount. Each product is priced on its own and adding one costs what that product costs. What running more than one does get you is structural: one tenancy, one identity, one audit trail, and findings that land somewhere already useful.

How often you scan, how many findings you have, how much you remediate, or how much evidence you export — for the reasons in the cards above.

Nor does how you pay. A year costs twelve months: there is no discount for committing to annual and no penalty for paying monthly. Monthly means monthly: there is no minimum term, and you can cancel at any time, with the subscription ending at the close of that month.

Leaving is part of the deal. Export your findings and evidence before the subscription ends; when it ends, what we hold for that tenant is deleted.

Get a number

Tell us the size of the environment. You will get a real figure back, not a discovery call.

So we can reply. Nothing else is done with it.

Or email support@seqontrol.com directly.