Simple, honest pricing
Flat monthly per tenant — pay for the team, not the seat. Every paid plan starts with a 14-day free trial, no card required to sign up.
Free
The essentials — always free for solo use.
- ✓Anonymous SSL check + PFX converter
- ✓Encrypted cert vault — up to 10 certs
- ✓Live SSL monitoring — up to 3 hosts
- ✓Free Let’s Encrypt / ZeroSSL issuance
- ✓Email nudges 30 days before expiry
- ✓Solo account (1 member)
Starter
Multi-CA + small team. Pull certs from GoDaddy et al.
- ✓Everything in Free
- ✓+ Paid CA pull (GoDaddy, Sectigo, DigiCert)
- ✓+ 3-seat team with invites
- ✓+ 10 monitored hosts · 50 vault certs
- ✓+ 2 CA provider credentials
Team
Set-and-forget automation for ops teams.
- ✓Everything in Starter
- ✓+ Push certificates to devices directly
- ✓+ Unattended DNS-01 auto-renew (Cloudflare API)
- ✓+ CA bookmarklet ingest (dcc.godaddy.com etc.)
- ✓+ 10-seat team
- ✓+ 100 monitored hosts · 200 vault certs
Enterprise
Unlimited scale with SSO for larger teams.
- ✓Everything in Team, unlimited
- ✓+ SSO via SAML
- ✓+ 50-seat team
Compare plans
| Feature | Free | Starter | Team | Enterprise |
|---|---|---|---|---|
| Monitored hosts | 3 | 10 | 100 | Unlimited |
| Vault certificates | 10 | 50 | 200 | Unlimited |
| Team members | 1 | 3 | 10 | 50 |
| Push targets | 3 | 10 | 50 | Unlimited |
| CA providers (GoDaddy, Sectigo, DigiCert) | — | 2 | 10 | Unlimited |
| ACME (Let’s Encrypt / ZeroSSL) | ✓ | ✓ | ✓ | ✓ |
| Scheduled push to devices | — | — | ✓ | ✓ |
| DNS-based unattended auto-renew | — | — | ✓ | ✓ |
| SSO via SAML | — | — | — | ✓ |
| Email alerts on status changes | ✓ | ✓ | ✓ | ✓ |
Frequently asked questions
Can I try before I buy?
Yes — every paid plan includes a 14-day free trial. Free tier never expires and gives you the essentials for solo use.
What happens if I downgrade?
Your existing data stays put. You just can’t add more past the new tier’s cap until you’re back under it. No data is deleted.
Can I cancel any time?
Yes, from Settings → Billing. You keep access until the end of the current billing period, then drop to Free automatically.
Do you store my private keys?
Yes — in an encrypted vault. Every cert is sealed with AES-256-GCM using a per-tenant data key wrapped by a master key-encryption key. Only you can decrypt your material; we use tenant isolation + row-level security as defence-in-depth.
How does the DNS auto-renew work?
You store a Cloudflare API token (encrypted). When a Let’s Encrypt cert approaches expiry, the scheduled job starts a new ACME order, publishes the _acme-challenge TXT record, validates, finalises, and stores the fresh cert — without you touching DNS.
Is there a free tier forever?
Yes. Free gives you cert vault (10 certs), SSL monitoring (3 hosts), ACME issuance, anonymous SSL check + PFX convert tools. Good for solo hobbyists or testing before you invite a team.