Plans and billing
All plans are for professional use. Current prices are on the pricing page, in euros or US dollars. Prices exclude applicable VAT.
| Plan | EUR/month | EUR/year | Included active certificates | Sentinels | Local accounts | User rules |
|---|---|---|---|---|---|---|
| Free | 0 | 0 | 50 | 2 | 1 | 3 |
| Team | 59 | 588 | 100 | 10 | 5 | 5 |
| Pro | 215 | 2,148 | 300 | Unlimited | 10 | 10 |
| Business | 419 | 4,188 | 300 | Unlimited | 20 | 20 |
The default email rule is outside the user-rule quota. Free includes email and one generic Discord channel without asset details. Team, Pro and Business add Slack, Teams and detailed Discord alerts. Public and internal discovery are available on all plans, within authorized scopes.
Activity events default to 365 days (12 months) on all published plans. An agreed organization policy can specify different durations; Activity displays the applicable duration and any 30-day grace period before a reduction. Extending retention does not restore expired events. This is an audit trail, not a promise of raw scan history or TLS change history.
What Business adds
Section titled “What Business adds”- The compliance workspace: the failing check, the assets it affects, evidence and remediation, accepted risks, CSV exports.
- Single sign-on.
- Roles. On Team and Pro every new member you add is an operator; assigning the viewer role, and restricting a viewer to certain tags, needs Business.
- Twenty local accounts and twenty notification rules, against ten of each on Pro. Existing roles and tag scopes survive a downgrade without being broadened.
Need more, or an invoice rather than a card? Contact us about the Custom plan. It is not purchasable in the app.
How certificates are counted
Section titled “How certificates are counted”A certificate is active when NoCert has seen it deployed in the last six days, on an endpoint, on disk, or in a Kubernetes secret, and no newer certificate has replaced it. CA certificates never count.
Counting is per certificate, not per place it sits. One wildcard on forty hosts, in a file and in a Kubernetes secret, is one active certificate.
Two consequences:
- A renewed certificate leaves the count once NoCert has seen its successor everywhere it was deployed. One you decommission without a successor leaves once it has been silent for six days.
- A certificate you upload but that is never observed anywhere does not count at all.
Excluding a certificate from the inventory takes it out of the count straight away, which is the lever for something you will never decommission but do not want to pay for. It stops counting toward the bill 48 hours after you exclude it. See Certificates.
On paid plans, going over the included allowance does not block discovery. Discovery, scanning and alerting carry on, the additional certificates appear on your usage invoice, and NoCert emails the owners when the count crosses the included volume, at most once a day. Settings → Billing shows the current count, the included volume, and the estimated overage, plus the billed count while a recent exclusion has not reached it yet.
On annual billing the base fee is charged yearly and the additional certificates monthly, since usage is metered per month.
Changing plan
Section titled “Changing plan”Owners can subscribe and change plan from Settings → Billing. Nobody else sees the billing screen.
Subscribing ends the trial and starts billing immediately.
Upgrades show the exact immediate charge before confirmation. A paid downgrade is scheduled for the next base-plan renewal; annual prepaid time is retained. A scheduled downgrade can be cancelled before it starts.
When payment fails
Section titled “When payment fails”NoCert does not cut your access when a payment fails. You get a banner asking you to update the payment method, and monitoring keeps running while Stripe retries.
Cancelling keeps the subscription live until the end of the base period you have paid for. Afterwards the organization continues on Free, with monitoring and email alerts. Excess members, rules and paid channels pause; excess Sentinels have a fixed 30-day grace period. Configuration, roles and scopes are retained.
Above 50 active certificates for seven days on Free, expansion pauses while reduction and repair remain available. Data is not automatically deleted because a trial or paid subscription ends.