Simple, transparent pricing
Replace months of FGA engineering with a managed platform. Every paid tier includes sub-10ms evaluation latency, namespace isolation, and DSPT-ready audit trails.
All prices in GBP. Annual billing available (2 months free).
Developer
For evaluation, prototyping, and development. No credit card required.
- 1 sub-tenant (dev environment)
- 1,000 tuples
- 10,000 evaluations/month
- Community support
- 7-day audit retention
- Shared TLS certificate
- FGA Playground
- AuthZEN Playground
- COAZ mappings
- Search APIs
- AI Agent Registry
- Break-Glass (AARP)
- Non-prod environments
Starter
For administrative apps, scheduling tools, and low-risk data pipelines.
- 3 sub-tenants included
- 100,000 tuples
- 5M evaluations/month
- 1 COAZ mapping
- 30-day audit retention
- Shared TLS certificate
- 99.5% SLA
- Email support (48h)
- 1 non-prod environment (dev)
- Search APIs
- AI Agent Registry
- Break-Glass (AARP)
- Hardware HSM
Professional
For clinical applications, EPR modules, and healthcare software vendors deploying to organisations.
- 10 sub-tenants included
- 2,000,000 tuples
- 50M evaluations/month
- 5 COAZ mappings
- 2-year audit retention
- Dedicated TLS certificate
- 99.9% SLA
- Priority support (4h)
- 2 non-prod environments (dev + QA)
- 10,000 search queries/month
- 5 registered AI agents
- Break-Glass (AARP)
- Hardware HSM (add-on)
- Beyond Zero Dynamic Authorization (add-on)
Enterprise
For multi-organisation vendors, clinical AI platforms, and high-assurance workloads at scale.
- Unlimited sub-tenants
- 25,000,000 tuples
- Unlimited evaluations
- Unlimited COAZ mappings
- 7-year audit retention (DSPT)
- Dedicated TLS certificate
- 99.95% SLA
- Dedicated CSM + Slack
- 2 non-prod environments included (dev + QA)
- Unlimited search queries
- Unlimited AI agents
- Break-Glass (AARP)
- Hardware HSM (add-on)
- Beyond Zero Dynamic Authorization (add-on)
Critical Infrastructure
Multi-region active-active with disaster recovery for national-scale and critical healthcare infrastructure.
- Everything in Enterprise
- Multi-region active-active (2–4 regions)
- Disaster recovery: RPO <5min, RTO <15min
- 99.99% SLA (4 nines)
- Dedicated isolated SpiceDB cluster
- Dedicated CockroachDB instance
- Private network (VPC peering / private link)
- 24/7 dedicated SRE + named account manager
- 10+ year audit retention with cold archive
- Quarterly DR failover drills
- ISO 27001 + SOC2 Type II compliance
- On-prem / hybrid deployment option
- Hardware HSM included
- Beyond Zero Dynamic Authorization included
Add-Ons
Extend your plan with additional capabilities as your deployment grows.
Beyond Zero Dynamic Authorization
Machine-speed contextual risk evaluation layered on top of SpiceDB ReBAC. Includes AI agent governance, behavioural anomaly detection, challenges, containments, JIT elevation, device posture, federated identity, and offline PDP for clinical continuity. < 3ms overhead on the evaluation path.
Contact Sales
Professional, Enterprise & Critical Infrastructure
Hardware Security Module (HSM)
Dedicated partition on Thales Luna Cloud HSM (DPoD). FIPS 140-2 Level 3 certified, ISO 27001, SOC 2 compliant. 99.95% SLA with 24/7 support. Used for mTLS certificate signing, JWT token encryption, and audit entry signing. Available via G-Cloud 14.
£1,500/month
Professional & Enterprise
Additional Sub-Tenants
Add organisations or regional deployments beyond your plan allowance. Includes full namespace isolation and independent quota management.
from £250/month
All tiers
Overage Tuples
Additional relationship tuple storage beyond your plan limit.
£50 per 100K/month
All tiers
The ROI Case
Building a DSPT-compliant, sub-10ms authorization engine with break-glass clinical safety, AI agent governance, and 7-year immutable audit requires a team of 3-4 engineers over 6+ months.
£450K+
Build it yourself
(4 engineers × 6 months + 2 BAU staff + cloud infra/year)
£120K
AuthHub Enterprise
(12 months)
73%
Cost reduction
vs. in-house build + BAU + cloud
Frequently Asked Questions
- What counts as an evaluation?
- Every POST to
/authzen/v1/evaluationor gRPC CheckPermission call counts as one evaluation. Batch operations (BulkWriteTuples) count as one request regardless of items. - What's included in a sub-tenant?
- Each sub-tenant gets full namespace isolation (separate schema, tuples, audit trail), independent quota management, and its own API credentials. Typically one sub-tenant = one organisation deployment.
- Do you offer annual billing?
- Yes — annual billing gives you 2 months free (pay for 10, get 12). Contact sales for annual contracts.
- How does the Hardware HSM add-on work?
- You get a dedicated partition on our Thales Luna Cloud HSM cluster (Data Protection on Demand), provisioned via G-Cloud 14. The HSMs are FIPS 140-2 Level 3 certified, ISO 27001 and SOC 2 compliant, with 99.95% availability SLA and 24/7 support. All mTLS certificate signing, JWT token encryption, and audit entry signing operations use hardware-backed keys that never exist in software memory. Available for Professional and Enterprise tiers at £1,500/month.
- What happens if I exceed my plan limits?
- We'll notify you at 80% usage. Evaluations continue uninterrupted — overage is billed at £2 per additional 100K evaluations. Tuple overage is £50 per additional 100K tuples/month.
Ready to get started?
Start free with the Developer tier. No credit card required.