Pricing

Start free.
Pay per node.

Every plan is the full product — the same identity, enforcement, and audit trail on every node. You scale by adding nodes, not by unlocking features.

Free

The full enforcement engine on a handful of nodes. No card, no trial clock.

$0
free forever · up to 3 nodes
Start Free
Nodes Up to 3
Event retention 1 day
Support Community
Control plane SaaS
Trust domains One

Pro

For teams enforcing a production fleet from one control plane.

$1,000 /mo
includes 20 nodes · $100/mo per additional node
Talk to us
Nodes 20 included
Event retention 3 days
Support Business
Control plane SaaS
Trust domains One

Enterprise

Recommended

For platform organizations with their own boundaries — and their own racks.

Custom
annual agreement
Talk to us
Nodes Custom fleet
Event retention Custom
Support Dedicated
Control plane SaaS or self-hosted
Trust domains Multiple

A node is any host running the Riptides daemon — a VM, a bare-metal server, or a Kubernetes node. Agents, services, and pipelines on a node are not metered, on any plan.

Pricing Questions

What counts as a node?

Any host running the Riptides daemon — a VM, a bare-metal server, or a Kubernetes node. Pricing follows enforcement: one node, one unit. The agents, services, and CI/CD pipelines running on a node are never metered.

What happens when I hit the Free plan's node limit?

Nothing breaks. Your 3 enrolled nodes keep enforcing; additional nodes simply won't enroll until you free a slot or upgrade. There is no trial clock — Free stays free for as long as you run it.

How are additional Pro nodes billed?

Pro includes 20 nodes for $1,000/mo. Each node past that adds $100/mo, prorated to the days it was enrolled. Decommission a node and its billing stops with it.

What does event retention mean?

How long attribution records — which workload, what credential, against which system, on whose behalf — stay queryable in the console. Free keeps 1 day, Pro keeps 3 days, and Enterprise retention is set by contract.

What is a trust domain, and when do I need more than one?

A trust domain is an independent identity root: its own certificate authority, its own SPIFFE namespace, its own policy boundary. One is enough for most platforms. You need more when subsidiaries, regulated environments, or acquisitions must not share an identity root — that's an Enterprise conversation.

Can we run the control plane in our own environment?

Yes — on Enterprise. The self-hosted control plane keeps identities, policies, and event data inside your boundary. Free and Pro use the Riptides SaaS control plane; enforcement happens on your nodes either way.

Secure the agents you're
already running.

Identity, access control, and a full audit trail for every agent and service — enforced on the host, with no code changes. Up and running in an afternoon.