Simple, identity-based pricing

No. The tier-3 agent installs with a single bash command. The connector wizard is self-service with live discovery and pre-filled mapping suggestions. Most customers are running their first sync within 30 minutes of starting. Professional services are available for complex migrations, but not required.

It depends on your deployment mode. In the default tier-3 hybrid deployment, a lightweight agent runs inside your VPC and handles all connector execution there — identity attributes, account data, and entitlement details stay on your infrastructure. The control plane receives task coordination and aggregate metrics, not raw identity records.

In SaaS connector mode (in-process), connectors execute in our EU-hosted control plane, which means identity data is processed there. A data processing agreement (DPA) is required for that mode, which we provide as standard. For organisations that need full data residency, tier-3 agent mode is the right choice.

Yes. The connector wizard supports custom SCIM, REST, and LDAP endpoints alongside the 8 built-in connectors. The wizard's live discovery returns a mapping suggestion from whatever the target exposes — typically 75% pre-filled. Custom connector development is available as part of the Enterprise plan or as a standalone service.

Starter includes classic campaign-based certifications (scheduled, manager-reviews-team). Growth adds smart certifications: event-triggered reviews (e.g., "this identity hasn't used this entitlement in 90 days") and policy-driven continuous certifications. Growth also includes reconciliation snapshots with per-grant reasons — the difference between a count and an audit trail.

Yes, on the Enterprise plan. Full Kubernetes deployment on your own infrastructure, including the control plane. This is typically chosen by organisations with strict data residency requirements beyond what the tier-3 hybrid model covers (e.g., air-gapped environments or highly regulated government deployments).

You'll receive a notification when you approach your limit (at 80% and 95%). We'll work with you to move to the next tier or configure an overage arrangement — no automatic surcharges without agreement. Annual commitments include a buffer zone for seasonal spikes.

We offer a guided 30-day POC instead of a free trial. A sales engineer runs the initial setup with you, you get a working environment with your own data, and you leave with a take-home report for your CISO. This is more useful than a sandbox trial because you're evaluating against your real environment, not demo data.