Pricing · v1.0.0

Simple, transparent pricing

Start free. Scale when you need to. No surprises.

Free
For individual analysts and small evaluations.
0 / month forever free
  • 3 users
  • 10 alerts / month
  • 5 cases / month
  • 50 observables / month
  • Community support
Get Started Free
Lite
For small teams needing core IR capabilities.
99 / month excl. VAT
  • 10 users
  • 200 alerts / month
  • 50 cases / month
  • 500 observables / month
  • Email support
Contact Sales
Corporate
Unlimited access for large security operations.
Custom tailored to your needs
  • Unlimited users
  • Unlimited alerts
  • Unlimited cases
  • Unlimited observables
  • Priority support & SLA
  • Custom integrations
  • Dedicated account manager
Contact Sales
All plans include

Every tier runs the same binary. Playbooks, the enrichment catalog, regulatory notifications, webhooks, two-factor authentication and the registers are in the Free tier too. Only the monthly caps differ.

Self-hosted
Your infrastructure
2FA
TOTP & passkeys
Compliance
DORA, NIS2, RGPD
API
REST & webhooks
Enrichment
Nine sources
48h Grace
License resilience

Frequently asked questions

Can I try before I buy?

Yes. The Free tier is fully functional with no time limit. Deploy it, test it, and upgrade when you're ready.

How do I upgrade?

Contact us at [email protected]. We'll update your license tier - no reinstallation needed, the change applies within the hour.

What if mlab.sh goes down?

A 48-hour grace period keeps your platform running if the license server is unreachable. Your data is always on your infrastructure.

Where is my data stored?

100% on your infrastructure. ir.mlab.sh is self-hosted. We never access, store or process your incident data.

Is the Free tier feature-limited?

No. Every tier runs the same binary, so playbooks, the nine-source enrichment catalog, DORA and NIS2 notifications, webhooks and two-factor authentication are all there. Only the monthly caps and the support level differ.

Can you deploy air-gapped?

The standard licence needs outbound HTTPS to mlab.sh once an hour, with a 48-hour grace window. For a genuinely disconnected environment, talk to us on the Corporate tier before you plan the rollout.

What counts against my quota?

Alerts, cases and observables created in the calendar month. A deduplicated redelivery does not create an alert, so it does not count. Users are a standing limit, not a monthly one.

Not sure which plan?

Two-minute questionnaire - we recommend the right tier for your team size and alert volume.