The plans, and what each one includes

There are five plans: Free, Core, Protect, Complete and Enterprise. This article says what each one actually contains, so that you can work out which fits before anybody talks to you about it. The full commercial page is at /pricing; this article is the same content written for somebody who already has an account and is deciding whether to change it.

The five plans at a glance

Pricing is per person per month, billed annually, with no annual floor and no seat cap on any paid plan — the floor and the cap are both gone. What replaces the floor is a small minimum headcount: pay for at least that many people, however many you actually have below it. A twelve-person firm on Core is paying for 12 people; a 4-person firm on Core is paying for Core's minimum of 10.

Enterprise is recorded in the licence catalogue as price-on-application rather than as a rate, which is why your own console will show it without a number. The €28 figure is the published starting point on the pricing page, not a quote.

Core, Protect and Complete each have a published monthly, no-annual-commitment band too (+20% over the annual rate), not just the top two like before — the pricing exists and is real. None of the three is self-serve today, though: self-serve checkout for a paid plan is switched off while it is finished, so signing up creates a Free workspace and Settings → Plan & add-ons points you at [email protected] instead of a checkout. Enterprise has never been a self-serve checkout — it is priced on scope, so the console tells you to get in touch either way.

Which modules each plan turns on

A module is one of the four halves of the product: identity and access, log collection and detection, endpoint detection and response, and privileged access. The plan decides which of them your organisation can reach.

Two things changed from before, and both matter. Core now includes detection, not just identity — the module Starter never had. And privileged access no longer needs the top plan: it moved from being Complete-only to an add-on you can buy on Core or Protect (see the add-ons section below), so a 15-person company can protect its two admins without paying for a plan built for two thousand.

If you are choosing which of the modules you own to switch on first, Choosing which modules to turn on is the article for that decision.

What the autonomy ceiling buys

This is the part of the plan structure most likely to be misread, so it is worth being blunt about it. Sentinel-Q is enabled on every paid plan, including Core. What differs between the paid plans is not whether you get the AI — it is how much the AI is permitted to do on its own. Free is the single exception: it has no Sentinel-Q at all, because model inference costs real money on every call and an unpaid tenant cannot be handed it.

Free

Sentinel-Q is not included. Talk to us about Core, Protect or Complete to have it investigate for you.

Core

L3 Recommend: Sentinel-Q builds the fix and cites its evidence. You approve it in one click; nothing changes until you do.

Protect

L4 Act inside the envelope you declare, opt-in per action class.

Complete

As Protect, plus role-mining and access-review proposals for your approval, and evidence generation.

Enterprise

As Complete, plus custom detection authoring and a response-time commitment.

Three rules hold at every plan, at every autonomy setting, and they are structural rather than commercial. Granting privileged access is never automated — the capability is not exposed to the model at all. Ungrounded means unauthorised: a verdict whose citations do not verify cannot trigger an automated action however confident it reads. And anything irreversible needs a human. None of those three is something a higher plan relaxes. Autonomy tiers explained covers how you set the tier you actually run at.

People and how far back you can search

There is no seat cap on any paid plan — Core, Protect and Complete are all unlimited. Free is capped at 10 people, enforced on the invitation that would cross it; exceeding it does not disable anyone already in place. Seats, and how they are counted explains exactly what counts as a billable person.

The retention figure — 14, 90, 365 or 730 days — is best read as how far back a search can look, because that is what it currently controls. It is applied as a clamp on log queries rather than as a deletion schedule. That distinction matters when your legal obligation to hold records outlasts your plan's window, so it has its own article: Retention settings. You can also buy 1 or 2 extra years of retention as an add-on rather than moving to a bigger plan just for that — see below.

The allowances, and which ones are actually metered

Under the current model, most allowances are genuine fair use with no per-unit bill — that is new. Only one class of usage is still a hard, metered cap.

Because most of the list is fair use rather than a metered cap, you will not find a usage bar for endpoints, non-human identities or AI investigations in the console, and you will not receive an overage invoice for any of them. Infrastructure log volume is the exception, and Settings → Plan & add-ons shows your usage against that allowance with a live percentage, the same number the ingest receivers enforce against.

One AI limit is separately metered and enforced: the amount your organisation may spend on model calls in a day. On Free it is a flat $0.60. On every paid plan it scales with your headcount: the greater of $3 or $0.05 per billable person, per day — so a 200-person Complete tenant is not throttled at the same ceiling as a 10-person one. The cap resets at 00:00 UTC; past roughly three quarters of it the assistant switches to a cheaper model and shorter replies to stretch what is left, and once it is spent the assistant stops answering until the reset. Settings → AI spend shows today's usage against your cap; you cannot raise the cap from there, only from a higher plan.

Add-ons — buy exactly the capability you need

This is new. Instead of forcing you onto a bigger plan for one feature, Core and Protect can add specific capabilities individually, priced per person per month (unless noted):

The Privileged Access add-on is the headline change: a 15-person company can protect its 2 admins for €15 per admin per month on top of Core or Protect, with no separate floor — where before, PAM meant Complete's full price for every person, not just the privileged ones.

Extra devices beyond your plan's pool are not sold up front as a toggle — they are billed automatically, at €2/month per workstation or mobile and €5/month per server, in your next true-up if you exceed your pool. Protection never stops while that happens.

Discounts, MSP partners and referrals

Three self-serve discount programmes exist, verified rather than self-certified, and none of them stack with each other or with the MSP partner rate below: Nonprofit and Education are both 40% off any paid plan and add-on, re-verified yearly, with Free extending to 25 people. Startup is 50% off in year 1 and 25% in year 2, for a company incorporated under 3 years ago, 50 people or fewer, and under €5M raised (or holding an accelerator code).

Referrals: refer another workspace and, once it pays, you get one month of your own plan as credit (up to €500); the workspace you referred gets its first paid month free.

If you resell Qorionix, the MSP ladder starts at 30% off from your very first paid client (signed, verified agreement), rising to 40% at 10 paid client workspaces or 150 paid people across your portfolio, and 45% at 1,000 paid people. It is billed monthly at annual rates on one consolidated invoice, and the per-client plan minimum is waived. The partner portfolio has the rest of what a partner account can do. This is set up with your account contact today — it is not yet a self-serve signup option.

What actually happens when you sign up

This changed on 2026-09-28, and it is worth being precise about, because it has changed twice now and people remember the middle version.

• Pick Free at signup, and you get Free. Permanent, no card, ever.
• Pick Core, Protect or Complete, and you still get Free. Self-serve sign-up for a paid plan is not available today; your choice is recorded as an upgrade intent, and the console tells you plainly that the plan isn't self-serve yet. Email [email protected] and we will set it up.
• Pick Enterprise, and you land on Free with your interest recorded as an upgrade intent, because Enterprise is priced on scope and there is no self-serve price to charge in the first place.

None of this affects an organisation already on a paid plan arranged with us directly: plan changes, add-ons and their own 14-day trials (see the add-ons section above) work exactly as described there.

One catalogue, and the drift report

The plan list a prospect reads on the pricing page and the plan list your console reads are the same list, served by the same unauthenticated endpoint. That is a deliberate choice: requiring a session would force the marketing page to keep its own copy, and a second copy is precisely how the console came to contradict the live licence.

Your organisation's own plan view goes one step further. It returns your licence next to the catalogue entry for your tier, and a drift list naming every field where the two disagree. If your console and your invoice ever disagree, that list is where the disagreement is named rather than hidden. Send it to us in a ticket and it is usually the whole diagnosis.

What to do next

1. Work out your real minimum before your per-person rate: 10 people on Core, 5 on Protect or Complete. Most firms under that size are paying the minimum, not the headcount rate.
2. If it is only privileged access you need on top of Core or Protect, check the add-on price before assuming you need Complete.
3. Read Seats, and how they are counted so the billable-person definition does not surprise you mid-onboarding.
4. If you are moving between plans, Changing your plan sets out what happens to your data and to the modules you lose.
5. For a number you can rely on, ask us for a written quote rather than quoting this page back at us. We would rather give you one than have you discover the provisional notice at the wrong moment.