Start with a free 45-day Done-for-You design-partner pilot covering joiner, mover, and leaver workflows across the integrations enabled for the pilot: Okta, GitHub, Salesforce, and Zoom, with Slack approval for sensitive actions.
Discuss a deployment path that fits your environment and readiness requirements.
A free, 45-day Done-for-You pilot for a maximum of two concurrent design partners.
For organisations that need a separately scoped deployment and commercial agreement.
This calculator uses an editable EUR 5 per employee/month assumption, not a published product price. It counts EUR 2,130 per leaver/year: six reclaimed licences averaging EUR 25.83/month for 12 months (EUR 1,860), plus six operator hours at EUR 45 (EUR 270). Incident avoidance, audit time, and breach risk are excluded.
| Compare | Self-Host | Done-for-You | Enterprise |
|---|---|---|---|
| Runs in | Your cloud | Your cloud | Your cloud · multi-region |
| Who deploys + operates | You | We do | We do |
| Credentials leave your env | Never | Never | Never |
| Gemini API key | You bring | Included | Included |
| Portal connectors | All built-in | All built-in | All · custom |
| OPA policy authoring | Custom Rego | Custom Rego | Custom policy packs |
| Audit log retention | You control | You control | You control · export tooling |
| HITL multi-approver | single approver | ✓ | ✓ |
| SSO for admins | roadmap | roadmap | SAML · OIDC · SCIM |
| SOC 2 / ISO 27001 | Controls implemented; certification on the roadmap — not yet held | ||
| Upgrades | You run --upgrade |
We run them | We run them |
| Support | Email + community | Priority + SLA | Named architect |
| Minimum seats | 25 | 50 | Negotiated |
Yes. The whole stack runs in your cloud account, on every tier. The only choice is who operates it: Done-for-You, the hands-off option where we deploy and run it inside your account, or Self-Host, where you run the one-command deploy yourself. There is no shared SaaS that holds your data — that's the point.
Same software, same bytes — different labor. Self-Host is a versioned set of Docker images plus a one-command deploy script you run against your own cloud; you bring your own Gemini API key. Done-for-You is us doing the deploy, the upgrades, and the on-call ops inside your account, with the Gemini key included and an SLA. Your IAM credentials stay in a Vault in your infrastructure either way.
Headcount is self-reported from your HRIS and trued up annually in your order — the same honor-plus-contract model used by self-managed enterprise software everywhere. Contractors and part-time staff in HRIS count; people you've already terminated don't. No per-action fees: you pay for the surface area under management, not each provision, move, or revocation.
No. Every deployment runs in infrastructure you own, and long-lived tokens stay in a Vault we deploy into your account. On Done-for-You we have operational access to run and upgrade it — and you can revoke that access at any time. We never hold your credentials in our own infrastructure.
No. The deployment calls Okta, Microsoft Graph, Salesforce, and the rest using your credentials, from your own cloud. We pay nothing to them and neither do you for the calls. Your existing license agreements are unchanged.
The AI only parses — it never decides. Every action goes through deterministic risk scoring and OPA policy. Anything above 0.75 is routed to HITL by default, and every executed action is reversible within its grace period (Salesforce: 30 days; Okta/M365: immediate reactivation via audit replay).
Self-Host is an annual license with image-registry access. Done-for-You adds a one-time setup fee and an operations agreement with an SLA. Enterprise is a one- to three-year MSA with a data processing addendum and optional BAA. All tiers include a mutual NDA and our incident-response commitment. SOC 2 / ISO 27001 controls are implemented; the certifications are on our roadmap and not yet held.
Yes — the first design partners each quarter get a hands-on pilot. Request a pilot.
Bring a BambooHR or Workday sandbox and one non-critical Okta tenant. We'll wire them up live, parse a Slack message, and walk you through the audit log at the end. If it doesn't click in the first ten minutes, we both move on.
