Simple, transparent pricing
Start free. Scale when you need to. No surprises.
- 3 users
- 10 alerts / month
- 5 cases / month
- 50 observables / month
- Community support
- 10 users
- 200 alerts / month
- 50 cases / month
- 500 observables / month
- Email support
- 50 users
- 3,000 alerts / month
- 500 cases / month
- 5,000 observables / month
- Priority email support
- Unlimited users
- Unlimited alerts
- Unlimited cases
- Unlimited observables
- Priority support & SLA
- Custom integrations
- Dedicated account manager
All plans include
Every tier runs the same binary. Playbooks, the enrichment catalog, regulatory notifications, webhooks, two-factor authentication and the registers are in the Free tier too. Only the monthly caps differ.
Frequently asked questions
Can I try before I buy?
Yes. The Free tier is fully functional with no time limit. Deploy it, test it, and upgrade when you're ready.
How do I upgrade?
Contact us at [email protected]. We'll update your license tier - no reinstallation needed, the change applies within the hour.
What if mlab.sh goes down?
A 48-hour grace period keeps your platform running if the license server is unreachable. Your data is always on your infrastructure.
Where is my data stored?
100% on your infrastructure. ir.mlab.sh is self-hosted. We never access, store or process your incident data.
Is the Free tier feature-limited?
No. Every tier runs the same binary, so playbooks, the nine-source enrichment catalog, DORA and NIS2 notifications, webhooks and two-factor authentication are all there. Only the monthly caps and the support level differ.
Can you deploy air-gapped?
The standard licence needs outbound HTTPS to mlab.sh once an hour, with a 48-hour grace window. For a genuinely disconnected environment, talk to us on the Corporate tier before you plan the rollout.
What counts against my quota?
Alerts, cases and observables created in the calendar month. A deduplicated redelivery does not create an alert, so it does not count. Users are a standing limit, not a monthly one.
Not sure which plan?
Two-minute questionnaire - we recommend the right tier for your team size and alert volume.