Plans That Scale With You

Start free. Add workspaces and teams as you grow. No surprises.

Basic

$49/month

 

For very small organisations trying Kostavo on a single workspace

  • 1 Databricks workspace
  • All resource and configuration policies
  • Scans every 12 hours
  • Notifications, no automated remediation
  • Microsoft work account SSO
  • 30 days of findings history
  • Email support, 72 hour response
Join the Waitlist
Most Popular

Team

$349/month

 

For small platform teams running a handful of workspaces

  • Up to 8 workspaces, more as add-ons
  • Everything in Basic, plus:
  • Automated remediation (Fix)
  • Scans every 2 hours
  • Tag-based policy assignment
  • Static egress IP for allowlisting
  • 90 days of findings history
  • 48 hour support response

  • + Additional workspaces ($45/workspace/mo)

    + SAML/OIDC SSO ($199/mo)

Join the Waitlist

Business

$799/month

 

For established platform teams managing a real estate

  • Up to 20 workspaces, more as add-ons
  • Everything in Team, plus:
  • Automated remediation (Remove)
  • Scans every hour
  • 180 days of findings history
  • 24 hour support response

  • + Additional workspaces ($45/workspace/mo)

    + SAML/OIDC SSO ($199/mo)

    + Azure Private Link ($400/mo)

Join the Waitlist

Enterprise

from $1,750/month

 

For regulated organisations that need Kostavo inside their security perimeter

  • Up to 30 workspaces, more by agreement
  • Everything in Business, plus:
  • Azure Private Link included
  • SAML and OIDC SSO (Entra, Okta)
  • SCIM directory sync
  • Scans every 30 minutes
  • 1 year of findings history
  • 12 hour support response with a named contact
Contact Sales

Feature Comparison

FeatureBasicTeamBusinessEnterprise
Monthly price (USD)$49$349$799from $1,750
Workspaces included182030
Extra workspacesNot available$45/mo each$45/mo eachBy agreement
Seats (Kostavo users)3102550
Scan frequency12 hours2 hours1 hour30 minutes
Resource + config policies
Remediation modesNotifyNotify, FixNotify, Fix, RemoveNotify, Fix, Remove
Tag-based assignment—
Static egress IP—
Findings history30 days90 days180 days1 year
SSOMicrosoftMicrosoft (+ add-on)Microsoft (+ add-on)SAML/OIDC included
SCIM directory sync———
Private Link (Azure only)——$400/mo add-onIncluded
Support response72h48h24h12h + named contact

Frequently Asked Questions

How does the 14-day trial work?

Start with full access to all features. No credit card required. After 14 days, add payment details to continue or your account will be paused.

How does annual billing work?

Annual plans are billed as ten months — two months free, roughly 17% off. Add-ons on an annual subscription are billed annually too.

Can I upgrade or downgrade anytime?

Yes! Changes between Basic, Team and Business are self-serve with prorated charges. Enterprise plans go through our billing team.

What happens when my trial ends?

We'll remind you before it ends. If you don't add payment details, your account will be paused (read-only). Add payment anytime to resume.

What currencies can I pay in?

USD, GBP and EUR — pick your currency at signup. All major credit cards, ACH transfers, and invoicing for Enterprise customers.

Is Private Link available on AWS?

Private Link is Azure-only today. On AWS, the static egress IP (Team and up) can be added to a Databricks IP access list for network-restricted workspaces.

Ready to Enable Your Teams?

Give workspace teams autonomy with guardrails. Join the waitlist for early access.

Join the Waitlist