Attestree
Run it free
PRICING

Pricing built for every fleet.

Free for homelab. Request access for everything else — we're in design-partner mode through GA.

01Free / Apache-2.0

Homelab

For the engineer who runs their own infra.

  • Self-host on a single node
  • winget attestations
  • Local Postgres evidence store
  • Local users, roles, and TOTP MFA — zero cloud dependencies
  • Community support
Run it free
02Request access

Small business

For 5-100 endpoints without a dedicated security team.

  • Managed control plane
  • SSO (Entra ID / Azure AD) — included, like every commercial tier
  • Pooled fleet attestation tree
  • Slack / Teams routing
  • GitOps-driven policy bundles
  • Email support, business hours
Request access
03Request access

Mid-market

For platform teams running 100-5,000 endpoints.

  • Multi-tenant org structure
  • On-prem AD connector
  • Custom roots of trust
  • API + webhook integrations
  • Configurable signed audit retention — 7-year capable for SOX / NYDFS
  • Priority support
Request access
04Request access

Enterprise

For 5,000+ endpoints across regions and BUs.

  • Dedicated tenancy
  • Region-pinned data residency
  • Custom signing policies
  • Hardware-backed roots
  • Named solutions architect
  • Recovery SLOs
Request access
05Request access

Financial services

For banks, brokers, and insurers under heavy audit load.

  • Auditor-ready evidence bundles
  • Evidence bundles designed to support GLBA / SOX; 23 NYCRR 500.15 control attestation
  • On-prem appliance with vTPM keys
  • Air-gapped evidence sync
  • SIEM streaming: Sentinel + Splunk (others via webhook)
  • 90-day proof-of-evidence engagement
Request access

Pre-GA pricing. Commercial tiers move to listed pricing at general availability.

The SSO pledge. SSO is a security baseline, not a revenue lever. Every commercial tier includes SSO (Entra ID / Azure AD) at no additional charge — it will never be the reason you upgrade. The free Community Edition uses local login because it runs with zero cloud dependencies, not as a paywall. If you ever find us on the SSO Wall of Shame, hold us to this paragraph.

sso.tax
EVERY TIER

What you get at every tier.

Provenance at ingest

Every artifact gets a signed in-toto attestation before it ever touches a fleet node.

GitOps reconciliation

Desired state lives in Git. The control plane reconciles drift continuously.

Signed evidence

Every state transition emits a signed receipt — exportable as a portable bundle.

OSS interoperability

in-toto, SLSA, CycloneDX, Sigstore — open formats, no vendor lock-in.

FAQ

Questions, answered.

When does Attestree go GA?
We have not committed a public GA date. Every commercial tier is in design-partner mode through GA — we are taking on a small number of design partners and giving them direct access to the founder.
Is there a free tier I can run today?
Yes — the free Community Edition, though it is in early access: request access rather than a public download right now. It is the full platform, self-hosted with docker compose for up to 50 endpoints (free under a closed-source EULA; the installer shim is Apache-2.0 OSS). It runs without Azure, covers winget ingest plus Chocolatey inventory and management today (more managers landing), generates signed attestations, and keeps a Postgres-backed evidence store.
How does Attestree compare to other tools in the space?
Most existing tools either scan after install (so you find out about a bad artifact once it is already on your fleet) or require you to pre-build everything in their own pipeline. Attestree attaches signed provenance to artifacts at ingest, before they reach a node, and works with the package managers you already use.
Can I run this fully on-prem?
Yes. Mid-market, Enterprise, and Financial Services tiers ship a self-hosted control plane. FinServ adds a hardware-rooted appliance with vTPM-bound keys and air-gapped evidence sync for regulated environments.
What is covered under the OSS license vs the commercial license?
Apache-2.0 covers the control plane core, ingest adapters for public package managers, the attestation format, and the CLI. The commercial license adds multi-tenancy, SSO (Entra ID / Azure AD), custom roots of trust, SIEM connectors, and the on-prem appliance.
Does SSO cost extra?
No, and it never will. Every commercial tier — starting with Small business — includes SSO (Entra ID / Azure AD) at no additional charge. We consider SSO a security baseline, not an upsell, and we have no intention of ever appearing on the SSO Wall of Shame (sso.tax). The free Community Edition uses local login because it is designed to run with zero cloud dependencies — an architectural choice, not a paywall. And local does not mean lesser: the free edition ships four policy-enforced roles, TOTP two-factor with recovery codes, and break-glass recovery. Access control is not the thing we hold back.
How do I become a design partner?
Fill out the access request form. Tell us about your fleet, your compliance posture, and what is broken about your current attestation story. We respond within a few business days, and we keep room for smaller teams (under 1,000 endpoints), not just large fleets.

Ready to attest your fleet?

We're in design-partner mode through GA. Get on the list — we'll route you within two business days.

Or tell us more about your fleet and we'll route you faster.