Editions & pricing

Tessera is free to self-host: the broker runs entirely inside your perimeter at no cost; paid editions add the governance, provisioning and support that security teams need. Paid plans are priced per seat, billed monthly or annually. See Licensing & activation for how editions are applied to a controller.

Plans

	Community	Pro	Ultimate	Enterprise
Price	$0	$19 /seat/mo ($15 annual)	$40 /seat/mo ($36 annual)	Contact us
SSH · Kubernetes · database · RDP brokering	✅	✅	✅	✅
Credential injection · TOFU host-key pinning	✅	✅	✅	✅
Stable target names, per-command audit log	✅	✅	✅	✅
Multi-account desktop client + CLI	✅	✅	✅	✅
Import / export infra	✅	✅	✅	✅
Seats / targets	1 seat · 5 SSH / 1 k8s / 1 db / 5 RDP	purchased seats (min 3) · 100 targets · 50 concurrent sessions	purchased seats (min 3) · unlimited targets	unlimited
RBAC & live RW→RO roles	—	✅	✅	✅
Just-in-time access + approval	—	✅	✅	✅
Read-only policy (SSH)	—	✅	✅	✅
OIDC single sign-on	—	✅	✅	✅
Session recording + live watch	—	✅	✅	✅
Force-close sessions · Telegram	—	✅	✅	✅
SCIM provisioning	—	—	✅	✅
Audit export to SIEM	—	—	✅	✅
Database query audit (on by default; turning it off needs Ultimate)	✅	✅	✅	✅
White-label branding	—	—	✅	✅
Configurable Kubernetes & database read-only policies	—	—	✅	✅
Custom features & integrations built for your environment, dedicated SLA & support	—	—	—	✅

Why per-seat

Per-resource pricing becomes unpredictable once you have thousands of Kubernetes objects, and it punishes consolidation. Per seat is transparent, easy to forecast, and makes ROI obvious versus per-server tools.

Downgrades

When a subscription lapses the controller falls back to Community — nothing is deleted, and targets beyond the new caps are locked until you upgrade again. Details in Licensing & activation.

Get started

Run Community for free, then start a Pro or Ultimate subscription in the Tessera portal. For Enterprise, get in touch.