Open at the bottom, governed at the top.
Free for developers and open source. Paid tiers add governance, compliance and support. Every tier runs managed on Upwarden Cloud today, with self-hosting inside your perimeter coming soon — same product, your choice of who operates it.
Managed today, self-hosted soon. Upwarden Cloud is live — it's the zero-infra path, we run the firewall. Self-hosting keeps everything inside your network with no telemetry and is coming soon; the tiers below will apply to both.
Packaging is being finalised. Upwarden is under active development. The four tiers — Free, Team, Org and Enterprise — match the engineering capability matrix, and features marked roadmap are in development, not yet shipped. Team and Org are per-seat list prices shown monthly — save 17% with annual billing; Enterprise is a custom annual contract — talk to us.
Per seat. EUR and USD prices are equivalent; GBP is an indicative conversion. Annual billing saves 17%.
Free
Developers, OSS & evaluation. Managed now, self-hosted soon.
- All ecosystems incl. bun
- Advisory feeds + similarity scanner
- Silent rollback, transitive at any depth
- 7-day audit log · 1 seat
- Safe-default policy, no telemetry (self-host)
- Docs + best-effort email support
Team
Small teams (5–50 devs). The first paid tier.
- Everything in Free
- Full policy editor & allow-listing
- 30-day audit log & dashboard
- Webhooks & upstream registries
- Org MFA enforcement
- Email support — 2 business days
Org
A whole organisation — 50+ devs, multiple teams.
- Everything in Team
- Unlimited scans
- Bring your own scanner (BYOS)
- 1-year audit log + export
- Org-wide MFA (owner + members)
- Priority support — 1 business day, guided setup & shared channel
Enterprise
Large organisations & government.
- Everything in Org
- SSO (SAML / OIDC)
- IP allowlist · infinite audit retention
- SBOM (CycloneDX / SPDX)
- SLA-backed support, named contact & shared channel
- Dedicated / isolated deployment for government & regulated; air-gapped roadmap
What's in each tier
Free covers individual developers and OSS. Team, Org and Enterprise add policy, scale, governance and support. Roadmap = in active development.
| Capability | Free | Team | Org | Enterprise |
|---|---|---|---|---|
| All ecosystems incl. bun | ✓ | ✓ | ✓ | ✓ |
| Advisory feeds + similarity scanner | ✓ | ✓ | ✓ | ✓ |
| Silent rollback, transitive any depth | ✓ | ✓ | ✓ | ✓ |
| Monthly scan volume | 1,000 | 100k | Unlimited | Unlimited |
| Policy editor & allow-listing | — | ✓ | ✓ | ✓ |
| Audit log retention | 7-day | 30-day | 1 year | Infinite |
| Audit export (CSV / JSON / NDJSON) | — | — | ✓ | ✓ |
| OCSF audit export | — | — | — | ✓ |
| Webhooks & upstream registries | — | ✓ | ✓ | ✓ |
| Bring your own scanner (BYOS) | — | — | ✓ | ✓ |
| Org-wide MFA enforcement | — | ✓ | ✓ | ✓ |
| CI actor attribution (OIDC) | ✓ | ✓ | ✓ | ✓ |
| Role-based access & step-up auth | ✓ | ✓ | ✓ | ✓ |
| Typosquat detection | — | ✓ | ✓ | ✓ |
| Org rename (with redirect window) | — | — | ✓ | ✓ |
| Seats | 1 | Per seat — add anytime | Per seat — add anytime | By contract |
| SSO / OIDC (SAML) | — | — | — | ✓ |
| IP allowlist | — | — | — | ✓ |
| Support channel | Docs + best-effort email | Priority email + shared channel | Named contact & shared channel | |
| First-response target | — | 2 business days | 1 business day | Contractual, by severity |
| Wrongly-blocked build support | ✓ | ✓ | ✓ | ✓ |
| Guided setup & migration | — | — | ✓ | ✓ |
| Uptime SLA & service credits | — | — | — | ✓ |
| SBOM (CycloneDX / SPDX) | — | — | ✓ | ✓ |
| Dedicated / isolated deployment (gov) | — | — | — | ✓ |
| Air-gapped (no external egress) | — | — | — | roadmap |
| Signed Sigstore provenance attestations | — | — | ✓ | ✓ |
| Audit streaming to SIEM (JSONL.gz webhooks / targets) | — | — | ✓ | ✓ |
| SIEM streaming — self-serve config UI | — | — | — | roadmap |
| Programmable roles & policy-as-code | — | roadmap | roadmap | roadmap |
Four tiers — Free / Team / Org / Enterprise — aligned to the engineering tier matrix. Final packaging and prices are being finalised ahead of launch; capabilities marked roadmap are in active development. Enterprise covers large organisations and government; government and other regulated buyers run as a dedicated, isolated deployment rather than on the shared cloud. Response times below Enterprise are targets we intend to beat, not contractual SLAs — see support for the full picture, including our commitment to fix a wrongly-blocked build on every tier. See the enterprise and security pages for what's shipped today.
Common questions
Is the free tier really free?
Do I need to talk to sales to get started?
What does it cost for Team, Org or Enterprise?
Do you support government or air-gapped deployments?
What's the license?
Managed, self-hosted, or both?
Start free. Scale when you need to.
Start free on the managed cloud, or talk to us about Team and Enterprise. Self-hosting is coming soon.