Pricing
Priced per application, not per component.
A complete bill of materials should never cost you more than an incomplete one.
Try the free tools. Start a workspace when you are ready.
Start with a free component scan or the local SBOM readiness checker. For saved findings and the available workspace modules, start a 14-day Team trial. A card is required for the workspace trial; cancel before day 15 to avoid the first charge.
- 14 daysTeam plan, available modules
- €0 todayFirst charge on day 15, VAT included
- Cancel any timeBefore day 15 costs nothing
Team
14-DAY TRIALContinuous watch over a real estate, with the audit trail to prove it.
- Up to 25 applications, unlimited scans
- CSV, TSV, CycloneDX and SPDX upload
- OSV matching with KEV and EPSS enrichment
- Explainable priority derivation and identity triage
- KEV and EPSS enrichment when source data is available
- Finding lifecycle and reassessment history
- VEX statements and accepted-risk decisions
- Tamper-evident audit log with chain verification
- Native binary and API contract audit modules
- Email support, one business day
Enterprise
SELF-HOSTEDFor organisations that will not put unremediated criticals in shared infrastructure.
- Everything in Team
- Unlimited applications
- Self-hosted or single-tenant deployment
- Dedicated vulnerability knowledge base
- SSO and SCIM: planned, not currently included
- Data residency selection
- CRA notification workflow: planned
- Named contact, four-hour response
Questions
Is there a free tier?
The public component scan and local SBOM readiness checker are free, with no account or card. A full workspace starts with a 14-day Team trial and requires a card. The subscription is charged from day 15 unless cancelled before then.
What happens at the end of the trial?
The subscription converts to Team at EUR 180 per month, VAT included, and the card is charged for the first time on day 15. Cancelling before then costs nothing and is done from the billing page inside your workspace, which opens Stripe's portal — no email to us, no retention call.
Is VAT included in the price?
Yes. EUR 180 is the total, and VAT is inside it rather than added at checkout — whatever your billing country, the amount you pay is EUR 180. A VAT-registered business elsewhere in the EU can still enter its VAT number, which applies the reverse charge and shows the VAT line as zero; the total is the same EUR 180. Checkout also offers your local currency alongside euro; the converted figure carries a currency conversion fee, so paying in euro is the cheaper option where your card supports it.
Why per application rather than per component?
Because a single container image is three hundred components. Per-component pricing either produces an unaffordable bill or pushes customers to upload less than they run — and a vulnerability tool that rewards an incomplete inventory is working against its own purpose. An application is the unit you already reason about.
What counts as an application?
One inventory that you scan as a unit — a product, a service, or a defined estate such as a data centre's server build. Uploading the same application repeatedly is one application, not many.
Can I run Cidra on my own infrastructure?
Yes, on the Enterprise tier. It runs on a plain Linux host — Node, MongoDB, systemd, nginx, no containers required. Enterprise security buyers frequently refuse to put unremediated findings in multi-tenant infrastructure, and that is a reasonable position rather than an objection to overcome.