A fixed price per tier. Transparent, not quoted.
Every package is a fixed price for your whole team, however many people join - published here, not quoted after a sales call. Start with a free 14-day trial of everything - no card needed - then pick the package that fits.
Team
Free 14-day trial · cancel anytime · 14-day money-back
- Unlimited people How many people in your workspace can request and be granted access. We never bill per person, on any package.
- Up to 3 AWS accounts How many AWS accounts / Identity Center estates you can connect for JIT access.
- Just-in-time access (time-boxed, approved, auto-expiring) Every grant is requested, approved, scoped, and revoked automatically when its window closes. The core engine, on every package.
- Slack & CLI requests Request access where you already work - a Slack command or the AWS credential_process - no portal context-switch.
- 90-day history How far back you can open the audit trail and the widest period an evidence export can cover.
- Break-glass emergency access Pre-approved emergency access: granted without waiting for a human, recorded with its own separate break-glass audit entry, and still expiring on its own - an incident never means standing admin.
- Multi-approver quorum Require two or more distinct approvers for sensitive access, with no self-approval.
- Email support Support is by email on every package. Priority means your messages are answered first.
Organization
Free 14-day trial · cancel anytime · 14-day money-back
- Everything in Team, plus:
- Org-wide (whole AWS Organization) How many AWS accounts / Identity Center estates you can connect for JIT access.
- 1-year history How far back you can open the audit trail and the widest period an evidence export can cover.
- Signed evidence pack The identity-stamped audit trail as one file organized for an auditor, signed by CloudGrant so a change after download is detectable. That is our attestation, not independent proof of who clicked approve. The audit log itself, and its CSV export, are on every package.
- On-call auto-approve (PagerDuty) Tie approvals to your PagerDuty rotation, so whoever is on call gets access without waiting on a human.
- Policy-as-code Manage eligibility and approval rules as one reviewable JSON file - export from the Rules page, test in CI with the CLI, preview and apply it back.
- SIEM / webhook audit export Stream every request, approval, grant and revocation to your SIEM via signed webhook.
Enterprise
Free 14-day trial · cancel anytime · 14-day money-back
- Everything in Organization, plus:
- 2+ year history How far back you can open the audit trail and the widest period an evidence export can cover.
- SCIM / enterprise IdP provisioning Provision and de-provision users AND their group memberships automatically from your identity provider (SCIM 2.0 Users + Groups).
- Priority email support Support is by email on every package. Priority means your messages are answered first.
Self-Hosted
We deploy the first one with you
- Everything in Enterprise, plus:
- Runs in your own AWS account The Self-Hosted package runs CloudGrant entirely inside your own AWS account, for data-residency or air-gap requirements - and we deploy the first one with you.
Need to pay by invoice? If your finance team cannot use a card, we can invoice you instead - with a purchase order number, your VAT details and normal payment terms. Create your CloudGrant account, then ask from your billing page, or email us first.
Compare plans
| Team | Organization | Enterprise | Self-Hosted | |
|---|---|---|---|---|
| People | Unlimited people | Unlimited people | Unlimited people | Unlimited people |
| AWS accounts | Up to 3 AWS accounts | Org-wide (whole AWS Organization) | Org-wide (whole AWS Organization) | Org-wide (whole AWS Organization) |
| Just-in-time access (time-boxed, approved, auto-expiring) | ✓ | ✓ | ✓ | ✓ |
| Slack & CLI requests | ✓ | ✓ | ✓ | ✓ |
| Audit history | 90-day history | 1-year history | 2+ year history | 2+ year history |
| Break-glass emergency access | ✓ | ✓ | ✓ | ✓ |
| Multi-approver quorum | ✓ | ✓ | ✓ | ✓ |
| Signed evidence pack | - | ✓ | ✓ | ✓ |
| On-call auto-approve (PagerDuty) | - | ✓ | ✓ | ✓ |
| Policy-as-code | - | ✓ | ✓ | ✓ |
| SIEM / webhook audit export | - | ✓ | ✓ | ✓ |
| Connect a whole AWS Organization | - | ✓ | ✓ | ✓ |
| SCIM / enterprise IdP provisioning | - | - | ✓ | ✓ |
| Runs in your own AWS account | - | - | - | ✓ |
| support | Email support | Email support | Priority email support | Priority email support |
All prices are in US dollars. Every package is a fixed price for your whole workspace - we never bill per user or per seat, and the price is published here, never quoted after a call. Choose monthly or annual billing - paying annually saves you about 3 months (roughly 29%). Every new workspace starts with a free 14-day trial of everything, no card needed; when it ends nothing is deleted - you keep read-only access to your workspace and audit trail until you choose a package. Self-Hosted is billed annually by invoice. Taxes may apply and will be calculated at checkout. We sell through Paddle, our merchant of record. Questions? hello@buri.cloud