Self-host the full platform under Apache 2.0. The binary the hosted plan runs is the same one you do.
Hosted Identrail for teams who want time-to-value over infrastructure ownership. SAML SSO, scheduled scans, alerting.
Private tenancy, regional controls, named support, and the procurement surface large security organisations expect.
| Capability | Open source | Team | Enterprise |
|---|---|---|---|
| AWS IAM trust-path resolution | Included | Included | Included |
| Kubernetes RBAC + workload identity | Included | Included | Included |
| GitHub Actions OIDC stitching | Included | Included | Included |
| Repo credential exposure scanning | Core detectors | Extended detectors + auto-revoke playbooks | Custom detectors per workspace |
| Policy simulator | Read-only | Read-only + dry-run + canary | All gates + scoped enforcement windows |
| Hosted in our cloud | No (self-host) | US or EU | US, EU, or your region |
| SAML SSO | Self-host any IdP | Included | Included + SCIM |
| Audit log streaming | Local log | Webhook | S3, Splunk, Datadog, Elastic |
| Support | Community Discord | Email, business hours | 24/7 with named TAM and custom SLA |
Because the engine is open source. We are not amortising a private platform investment over every seat — we are charging for the part you genuinely benefit from outsourcing: hosting, hardening, scheduled scans, alerting, support. If you do not need any of those, the OSS edition is the same code, free.
The Open source edition is free forever. The hosted Team plan includes a 14-day trial with no card required. Enterprise pilots are scoped per engagement.
No. Connector setup uses read-only credentials. Policy enforcement is a separate, opt-in surface that requires explicit approval and named operators. You can run Identrail in read-only mode forever.
Hosted Team customers pick US or EU. Enterprise customers pick a region or run a private single-tenant deployment in a region of their choice. Self-host gives you complete control.
Honest answer: not yet. SOC 2 Type I is in progress and on a public roadmap on the /security page. Enterprise customers can review our security posture and receive an MNDA-protected security questionnaire on request.