Pricing
Priced for the whole team, not per anxious decision.
Access management vendors have spent twenty years charging more for the secure option. We think that gets the incentives exactly backwards, so we don't do it.
Why it costs this little → · Who it is for, and who it is not →
Basic
The real product on one team for a month or two, with real grants and real revocation, before you decide on more.
- Hosted for you — highly available, monitored, patched
- SSO included — Entra, Okta, Google
- 40 packages delivered, revoked and audited
- 100 emails per month, or bring your own SMTP credentials
- Audit records retained 30 days
- Entra, Okta, Google Workspace, GitHub and AWS IAM
- No webhook notifications
- No Active Directory integration
Plus
Room for a team running it day to day: more packages, more email and a longer audit history.
- Hosted for you — highly available, monitored, patched
- SSO included — Entra, Okta, Google
- 200 packages delivered, revoked and audited
- 400 emails per month, or bring your own SMTP credentials
- Audit records retained 60 days
- Entra, Okta, Google Workspace, GitHub and AWS IAM
- No webhook notifications
- No Active Directory integration
Premium
Everything the product does, at any scale, on infrastructure we run and keep patched.
- Hosted for you — highly available, monitored, patched
- SSO included — Entra, Okta, Google
- Unlimited packages delivered, revoked and audited
- Unlimited emails and webhook notifications, or bring your own SMTP
- Audit records retained 365 days
- Every directory integration, Active Directory included
For medium and large organizations
Dedicated & Self-hosted
Where most organizations past a few hundred people end up — and, more often than not, the better value. Run TemprBac on your own hardware, or on a stack of its own that we operate, set off to the side with nothing shared with anyone at any layer.
Why most teams this size talk to us first
- Paid by invoice. Monthly or annual, by ACH or wire, through your own procurement process — no company card on file.
- A quote sized to you. Priced against your environment rather than a list figure built for somebody else's.
- Unlimited everything. Packages, emails and webhooks, every directory integration, SSO, and audit retention to your policy.
- A person who knows your deployment. An architecture walkthrough for your security review, and someone to call when it matters.
Rather pay by invoice than by card? Plus and Premium can be invoiced too, monthly or annually — talk to us.
What you get on every plan
The differences between tiers are about scale and isolation. They are not about whether you're allowed to be secure — single sign-on, encrypted credentials, approvals, automatic revocation and the full audit trail are on all five. Active Directory and webhook notifications are the two things kept for Premium and up — the on-premises agent and outbound integrations are what an estate-wide rollout needs, and Basic and Plus are for running the practice on a team or two first.
What happens when Basic or Plus reaches its package limit. New requests stop; nothing already granted is affected. Access that exists still expires on schedule, still gets revoked in your directory on schedule, and the audit trail keeps recording all of it. A cap on this product will never stop access from being taken away — a limit that could would quietly turn every temporary grant into a permanent one, which is the opposite of what you bought. Moving up a tier lifts the cap immediately.
Why Dedicated and Self-hosted have no list price. A deployment of your own costs what its environment costs, and environments differ by more than any single list price could absorb. Publishing one number would mean picking a figure that is wrong for almost everyone. So we ask a few sizing questions first and quote against the answer — and for most organizations of that size, the answer is a better deal than they expected.
| Basic | Plus | Premium | Dedicated | Self-hosted | |
|---|---|---|---|---|---|
| Single sign-on (Entra, Okta, Google) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Time-bound access with automatic revocation | ✓ | ✓ | ✓ | ✓ | ✓ |
| Approval workflows | ✓ | ✓ | ✓ | ✓ | ✓ |
| Full audit trail of every action | ✓ | ✓ | ✓ | ✓ | ✓ |
| Tenant credentials encrypted at rest | ✓ | ✓ | ✓ | ✓ | ✓ |
| Entra, Okta, Google Workspace, GitHub, AWS IAM | ✓ | ✓ | ✓ | ✓ | ✓ |
| Active Directory, through the on-premises agent | — | — | ✓ | ✓ | ✓ |
| Bring your own SMTP | ✓ | ✓ | ✓ | ✓ | ✓ |
| Packages delivered | 40 | 200 | Unlimited | Unlimited | Unlimited |
| Emails per month | 100 | 400 | Unlimited | Unlimited | Unlimited |
| Webhook notifications per month | — | — | Unlimited | Unlimited | Unlimited |
| Audit records retained | 30 days | 60 days | 365 days | 365 days | Your policy |
| Pay by invoice | — | ✓ | ✓ | ✓ | ✓ |
| Dedicated infrastructure | — | — | — | ✓ | ✓ |
| Runs inside your own audit boundary | — | — | — | — | ✓ |
Questions we get asked
Is SSO really included on the $20 plan?
Yes. Entra, Okta and Google on every tier, at no extra cost. Putting single sign-on behind an upgrade means charging a premium for the configuration your security team already requires, and we'd rather not build a business on that.
What counts as a "package delivered"?
One grant of access to one person — provisioned into your directory, tracked, and revoked when its window closes. Revocation and the audit record are part of the same unit, not a separate charge.
What happens if we exceed the email or webhook allowance?
Nothing breaks. Notifications past the month's allowance are not sent — each one is recorded as held back — and access itself is untouched: requests, grants, expiry and revocation all carry on. You can connect your own SMTP credentials on any tier and send email through your own domain, which most teams prefer anyway — approval emails then come from an address their people already recognize, and they no longer count against the allowance. Premium has no allowance to exceed.
Is the $20 plan a free trial?
No. Basic is a paid tier at $20 a month, priced low on purpose: it is the real product on real systems, not a sandbox or a time-limited demo. Most teams run it on one team for a month or two, then move up to Plus or Premium — or cancel, and owe nothing more.
What do Basic and Plus leave out, and why?
Webhook notifications and Active Directory. Everything else is the real product — single sign-on, approvals, automatic revocation, the audit trail and every cloud directory — at a scale for a team or two. Active Directory runs through an on-premises agent, which is a deployment of its own, and webhooks are how TemprBac reaches the rest of an estate's tooling; both belong to a rollout across the organization. Moving to Premium adds both and keeps everything you have already built.
What happens when Basic or Plus reaches its package limit?
New requests stop until the next billing period or an upgrade; everything already granted carries on exactly as before. Expiry still runs, revocation still reaches your directory, and the audit log still records it. The cap is on creating new access, never on ending it — a limit that could stop revocation would convert every temporary grant you hold into a permanent one, and we will not build one.
Can we pay by invoice instead of by card?
Yes. Dedicated and self-hosted deployments are invoiced as a matter of course, monthly or annually, by ACH or wire. Plus and Premium can be invoiced too, which is usually easier for a finance team than a card on file — write to us and we will set it up.
Can we move between tiers?
Yes, in both directions, and nothing you have built is lost on the way. Dedicated and self-hosted run the same product on different infrastructure, so moving is a migration rather than a re-implementation.
Can we run TemprBac on our own hardware, inside our own compliance boundary?
Yes, and for medium and large organizations it is often the better value. Self-hosting runs the whole product on your infrastructure, inside your network and under your controls, with tenant data never leaving it. We're happy to walk through the architecture and our controls in detail.