Pricing
Priced on what you protect, not on who is allowed to look.
Read-only seats are unlimited on every plan, including the cheapest one. Charging engineers to see their own security posture makes estates less safe, and we would rather have the argument here than in a renewal call.
- GBP, excl. VAT
- Annual saves 17%
- 30-day notice on Team
- No setup fee
Team
£900
per month, billed annually
£1,080 billed monthly
For a security function of one to four people who are also the platform team. Meridian Public Works runs 310 workloads on this and we talked them out of upgrading.
Start on TeamWhat you get
- 3 cloud accounts, subscriptions or projects
- 400 workloads
- 250M normalised events a month
- 90-day hot retention, queryable, no restore job
- 5 responder seats · unlimited read-only seats
- All 412 detections, forked into your Git repo
- Slack and email alerting
- Support 08:00–18:00 UK, next business day
Not included
- Automated Git sync of detections — you edit the fork by hand
- Reach graph (IAM blast-radius view)
- Automated egress containment
- PagerDuty, Opsgenie or Teams
- SSO enforcement and SCIM provisioning
- 24/7 response desk
- Most customers
Business
£3,400
per month, billed annually
£4,080 billed monthly
For a dedicated security team with an on-call rota. The plan most customers are on, including Northwind Freight at 1,412 workloads across eleven AWS accounts.
Talk to us about BusinessWhat you get
- 25 cloud accounts, subscriptions or projects
- 3,000 workloads
- 3B normalised events a month
- 13-month hot retention, queryable, no restore job
- 25 responder seats · unlimited read-only seats
- Detections-as-code with two-way Git sync and CI fixtures
- Reach graph and forming-situation live view
- Automated egress containment, opt-in per namespace
- PagerDuty, Opsgenie, Teams, signed webhook
- SSO enforcement and SCIM provisioning
- Continuous OCSF export to your own object storage
- 24/7 response desk · 30-minute P1 response
Not included
- Customer-managed encryption keys (BYO-KMS)
- Private ingest over PrivateLink or Private Link
- Contractual data residency guarantees
- A named response engineer
- Custom OCSF field mapping
- Reserved burst capacity for seasonal peaks
Enterprise
from £11,000
per month, annual term
Annual commitment only
For regulated estates, contractual residency, and anyone whose traffic multiplies by eleven for nine days in November. Helix Bank and Vexel Commerce are both here, for opposite reasons.
Request a scoping callWhat you get
- Unlimited accounts and workloads, under a fair-use schedule
- Contracted event volume with reserved burst capacity
- Retention to 7 years, hot tier configurable
- Unlimited responder seats
- Customer-managed keys — we cannot read your data
- Dedicated ingest with PrivateLink or Private Link
- Contractual residency: UK, EU, US or AU
- Custom OCSF field mapping for in-house sources
- Named response engineer, introduced before signature
- 15-minute P1 response, 24/7
- Quarterly purple-team exercise against your detections
- Evidence packs for DORA, PCI DSS 4.0, SOC 2 and ISO 27001
Not included
- Endpoint detection on employee laptops or phones
- A managed SOC — we page your team, we do not staff it
- Archival of non-security application logs
- Vulnerability scanning or SBOM analysis
- Additional normalised events
- £0.11 per million
- Additional workloads
- £0.42 each per month
- Additional responder seat
- £64 per month
- Read-only seats
- £0, on every plan
- Extended hot retention
- £240 per TB per month
How overage works
You get an email at 80%, not a bill at 400%
Every plan has a monthly event allowance. Cross 80% of it and the billing contact and every admin gets an email that day, with the workloads driving the increase named. Cross 100% and overage bills at the rate above — we do not throttle ingest and we do not sample your events, because the week you burst is the week you most need the data.
A single month over allowance is billed. Three consecutive months over is a conversation about moving you up a plan, initiated by us, usually at a lower effective rate than the overage you have been paying.
- No ingest throttling, everIncluding during an incident and including on Team
- No samplingEvery event is retained for the full hot window
- Annual plans can be downgraded at renewal without penaltyTeam can be cancelled on 30 days' notice mid-term
Side by side
The full comparison, including the empty cells
A dash means the feature is genuinely not available on that plan. There is no asterisk, no "contact sales", and no hidden add-on price.
| Feature | Team | Business | Enterprise |
|---|---|---|---|
| Accounts / subscriptions / projects | 3 | 25 | Unlimited |
| Workloads | 400 | 3,000 | Unlimited |
| Normalised events per month | 250M | 3B | Contracted |
| Hot retention (no restore) | 90 days | 13 months | Up to 7 years |
| Responder seats | 5 | 25 | Unlimited |
| Read-only seats | Unlimited | Unlimited | Unlimited |
| Detection library (412 patterns) | Yes | Yes | Yes |
| Detections-as-code Git sync | — | Yes | Yes |
| Reach graph | — | Yes | Yes |
| Automated containment (opt-in) | — | Yes | Yes |
| Alert destinations | Slack, email | + PagerDuty, Opsgenie, Teams, webhook | All, plus custom |
| SSO enforcement + SCIM | — | Yes | Yes |
| OCSF export to your bucket | Manual, monthly | Continuous | Continuous + custom mapping |
| Customer-managed keys | — | — | Yes |
| Private ingest / peering | — | — | Yes |
| Contractual data residency | — | — | UK, EU, US, AU |
| Support hours | 08:00–18:00 UK | 24/7 | 24/7 |
| P1 response SLA | Next business day | 30 minutes | 15 minutes |
| Named response engineer | — | — | Yes |
| Quarterly purple-team exercise | — | — | Yes |
Before you buy
Four things we tell prospects that our competitors probably do not
Do not buy Business for the reach graph alone
If your team holds the whole estate in their heads — roughly under 500 workloads and under six engineers — the graph will not earn its £30,000 a year. We have talked three customers down a tier for exactly this reason and none of them have left.
The first fortnight is deliberately quiet
Baselines need forty days to be good and fourteen to be usable. We run new deployments in observe-only and you will feel like nothing is happening. Teams in the middle of an incident find this maddening, and it is still the right call.
Enterprise residency has a hard consequence
Customer-managed keys mean we genuinely cannot read your data. If you lose the keys, the history is gone — there is no shadow copy and no support escalation that recovers it. This is in the runbook, in bold, before signature.
Migrating from a per-rule SIEM feels like a downgrade for a month
You will go from two hundred alerts a week to eleven and assume something broke. Everything is still in the event stream and still queryable — it just will not ring a phone. Budget a month of scepticism.
No pressure, no trial countdown
Tell us the estate and we will tell you the plan.
Number of accounts, rough workload count, and whether anyone is on call. That is enough for us to name a tier and a price in the first call, including the tier below the one you asked about if that is the honest answer.