Pricing by active certificate count
Try Business for 30 days, no card required. Then continue for free or choose a paid plan. No paid subscription starts automatically.
Choose your plan
Free
no card, no time limit
- Active certificates included
- 50
- Sentinel agents
- 2
- Local accounts
- 1
Email alerts and one generic Discord channel.
Team
billed annually · €588/year
- Active certificates included
- 100
- Sentinel agents
- 10
- Local accounts
- 5
Shared inventory, 5 notification rules, email, Slack, Teams and Discord alerts.
Additional usage: €1.00 per additional active certificate per month.
Pro
billed annually · €2,148/year
- Active certificates included
- 300
- Sentinel agents
- Unlimited
- Local accounts
- 10
Public and private discovery, DNS discovery and an aggregate Compliance preview.
Additional usage: €1.00 per additional active certificate per month.
Business
billed annually · €4,188/year
- Active certificates included
- 300
- Sentinel agents
- Unlimited
- Local accounts
- 20
Detailed Compliance analysis, SSO, RBAC and timestamped evidence.
Additional usage: €1.00 per additional active certificate per month.
Enterprise / Custom
starting atbilled annually · €16,200/year
Unlimited Sentinels, custom certificate capacity, hosted or self-hosted options, SLA, support, and negotiated terms.
Additional usage is billed monthly in arrears, whether your subscription is monthly or annual.
Prices are shown excluding VAT. French businesses are charged 20% VAT; eligible EU businesses outside France can be invoiced under reverse charge with a valid VAT ID.
Feature comparison
Scroll horizontally to compare plans
| Feature | Free | Team | Pro | Business | Enterprise / Custom |
|---|---|---|---|---|---|
| Limits | Free | Team | Pro | Business | Enterprise / Custom |
| Active certificates | 50 | 100 included + €1.00/certificate beyond | 300 included + €1.00/certificate beyond | 300 included + €1.00/certificate beyond | Custom |
| Sentinel agents | 2 | 10 | Unlimited | Unlimited | Unlimited |
| Local password accounts | 1 | 5 | 10 | 20 | Custom |
| Product boundary | Free | Team | Pro | Business | Enterprise / Custom |
| Works alongside your existing CA, ACME client, or CLM | Included | Included | Included | Included | Included |
| Private-key custody | Never | Never | Never | Never | Never |
| Discovery | Free | Team | Pro | Business | Enterprise / Custom |
| Public endpoint discovery and scanning | Included | Included | Included | Included | Included |
| Internal network scanning | Included | Included | Included | Included | Included |
| Filesystem and Kubernetes TLS Secret scanning | Included | Included | Included | Included | Included |
| SNI-aware endpoint detection | Included | Included | Included | Included | Included |
| Read-only DNS zone import | Included | Included | Included | Included | Included |
| Manual certificate upload | Included | Included | Included | Included | Included |
| Alerting | Free | Team | Pro | Business | Enterprise / Custom |
| Discord webhook | 1 generic channel | Included | Included | Included | Included |
| Email notifications | Included | Included | Included | Included | Included |
| Slack | No | Included | Included | Included | Included |
| Microsoft Teams | No | Included | Included | Included | Included |
| Notification rules | 3 | 5 | 10 | 20 | Custom |
| Escalation rules | Included | Included | Included | Included | Included |
| Certificate and endpoint filters | Included | Included | Included | Included | Included |
| Compliance & Evidence | Free | Team | Pro | Business | Enterprise / Custom |
| Compliance workspace | Preview | Preview | Preview | Included | Included |
| Problem categories and affected counts | Included | Included | Included | Included | Included |
| Status and review count per visible certificate or endpoint | Included | Included | Included | Included | Included |
| Certificate and TLS compliance scores | No | No | No | Included | Included |
| Machine and certificate compliance details | No | No | No | Included | Included |
| Rule-level findings for ANSSI, BSI, NIST, and Mozilla/TLSRef | No | No | No | Included | Included |
| Post-quantum readiness tracking | No | No | No | Included | Included |
| Timestamped CSV evidence (5 datasets) | No | No | No | Included | Included |
| Access Control & Audit | Free | Team | Pro | Business | Enterprise / Custom |
| Role-based access control (RBAC) | No | No | No | Included | Included |
| SSO (OpenID Connect) | No | No | No | Included | Included |
| Activity audit trail | Included | Included | Included | Included | Included |
| Support & SLA | Free | Team | Pro | Business | Enterprise / Custom |
| Email support | Included | Included | Included | Included | Included |
| Dedicated account manager | No | No | No | No | Included |
| Enterprise SLA | No | No | No | No | Included |
Email support for product problems is best-effort on self-service plans. Custom support and availability commitments are agreed separately. Compliance findings and exports support review; they do not establish compliance or certification.
Frequently asked questions
What counts toward my certificate limit?
Each distinct non-CA certificate fingerprint with a deployment observation in the last 144 hours counts once, regardless of the number of locations. Excluded certificates and certificates identified as replaced do not count. Rotation can temporarily count both generations. Team includes 100; Pro and Business include 300. Extra active certificates cost €1.00 or $1.15/month, billed monthly in arrears, including on annual plans.
Which plan should I choose?
Free covers a small professional inventory. Team shares up to 100 included active certificates across 5 accounts and 10 Sentinels, with alerts in team tools. Pro includes 300, unlimited Sentinels, 10 accounts and 10 rules. Business adds detailed Compliance, SSO, role and tag permissions, and evidence exports.
Can I evaluate Nocert before subscribing?
Every new organization gets a full 30-day Business trial without a card. It then continues on Free: 50 active certificates, 2 Sentinels, the owner account, 3 user rules, email and one generic Discord channel. Slack, Teams, detailed Compliance and other paid features pause. Excess Sentinels have a fixed 30-day grace period. No paid plan starts automatically.
Is there a free plan?
After the 30-day trial, Free continues with 50 active certificates, 2 Sentinels, one local account and 3 user rules, plus the default email rule. Above 50 for seven days, expansion pauses; reads, monitoring, alerts and actions that reduce or repair the configuration remain available.
Does Nocert handle private keys?
No. Nocert observes certificates and TLS endpoints after issuance. Your existing CA, ACME client, vault, or CLM remains responsible for issuance, renewal, deployment, and private keys.
Can I switch plans at any time?
Team → Pro → Business upgrades and switching to annual billing are self-service, with an exact charge preview before payment. Paid downgrades are scheduled in the app for the next base-plan renewal, preserving the prepaid annual period. You can cancel a scheduled downgrade before it starts.
Can I cancel at any time?
Yes, from the billing settings, with no notice period. A monthly subscription ends at the end of the paid month and an annual subscription at the end of the prepaid year; neither renews after cancellation. Afterwards the workspace continues on the free plan, within its limits. You do not need to cancel the trial: when it ends, the workspace automatically continues on the free plan, and no card is on file.
Can I pay by bank transfer?
Team, Pro and Business are paid by card through Stripe, and every charge produces an invoice. Custom agreements can be invoiced for payment by bank transfer, with terms set in the signed order.
Where is my data hosted?
For hosted plans, application data is hosted primarily in the European Union on OVHcloud infrastructure in France and Germany, with limited sub-processor transfers documented in the DPA and protected by appropriate safeguards. A self-hosted deployment option can be scoped in a signed Custom order.
What happens to my data if I stop using Nocert?
At the end of a paid subscription the workspace continues on Free. Data and configuration stay in place; excess members, rules and paid channels pause. Excess Sentinels have 30 days to be selected or reduced. Discovery and email alerts continue. Deletion remains an explicit request.
Do agents require inbound connections?
No. Agents initiate outbound communication to sentinel.nocert.io using signed HTTP requests. No inbound firewall rules or open ports are required.
Are support response times guaranteed?
Email support for product problems is best-effort on self-service plans. Custom agreements can include separately negotiated support and availability commitments.
Public domain to monitor (optional)
We’ll email you a code to verify your email address.