Pricing
Per product line, not per seat. Every plan includes the full feed set, the clocks, SRP-ready drafts, the evidence trail and our data processing agreement. Choose by how many products you place on the EU market.
Every plan has every product feature. Plans differ in products, seats and API keys. Seats: Starter 3, Team 10, Unlimited 25. Unlimited adds single sign-on and priority support.
Which plan?
Starter
- 1 product, unlimited versions and SBOM uploads
- CISA KEV · ENISA EUVD · OSV · EPSS · NVD matching, every 15 minutes
- Assessment → awareness → 24h / 72h / final-report clocks
- SRP-ready drafts (ENISA field set, character limits, completeness check)
- Hash-chained evidence trail, daily RFC 3161 timestamps, one-click export
- Vulnerability inbox for researchers' reports, with a 48-hour acknowledgment target
- Public advisories page with an Atom feed and CSAF 2.0 files, and emails to your customer list
- Jira Cloud and GitHub Issues tickets from any case, with status sync
- VEX import, version diff, scored drills, compliance report and technical-file export
- 3 users (invite deputies or read-only viewers), 1 API key for CI
- Email, Slack/Teams and webhook alerts
- Data processing agreement with EU standard contractual clauses (read it)
Team
Most popular- 5 products, unlimited versions and SBOM uploads
- CISA KEV · ENISA EUVD · OSV · EPSS · NVD matching, every 15 minutes
- Assessment → awareness → 24h / 72h / final-report clocks
- SRP-ready drafts (ENISA field set, character limits, completeness check)
- Hash-chained evidence trail, daily RFC 3161 timestamps, one-click export
- Vulnerability inbox for researchers' reports, with a 48-hour acknowledgment target
- Public advisories page with an Atom feed and CSAF 2.0 files, and emails to your customer list
- Jira Cloud and GitHub Issues tickets from any case, with status sync
- VEX import, version diff, scored drills, compliance report and technical-file export
- 10 users (invite deputies or read-only viewers), 5 API keys for CI
- Email, Slack/Teams and webhook alerts
- Data processing agreement with EU standard contractual clauses (read it)
Unlimited
- Unlimited products, unlimited versions and SBOM uploads
- CISA KEV · ENISA EUVD · OSV · EPSS · NVD matching, every 15 minutes
- Assessment → awareness → 24h / 72h / final-report clocks
- SRP-ready drafts (ENISA field set, character limits, completeness check)
- Hash-chained evidence trail, daily RFC 3161 timestamps, one-click export
- Vulnerability inbox for researchers' reports, with a 48-hour acknowledgment target
- Public advisories page with an Atom feed and CSAF 2.0 files, and emails to your customer list
- Jira Cloud and GitHub Issues tickets from any case, with status sync
- VEX import, version diff, scored drills, compliance report and technical-file export
- 25 users (invite deputies or read-only viewers), unlimited API keys for CI
- Email, Slack/Teams and webhook alerts
- Data processing agreement with EU standard contractual clauses (read it)
- Priority support (one business day); single sign-on (SAML, Microsoft Entra ID or OIDC), set up with your IT team
Prices in EUR excluding VAT. We are established outside the EU: no VAT is charged on the invoice, and a VAT-registered EU business accounts for it under the reverse-charge mechanism — enter your VAT ID at checkout so it is printed on the invoice. Card payment only. The trial gives Team-level access with no card. Products are counted per product line, across all their versions. The trial includes everything on Team except emailing advisories to your customer list, which starts with a paid plan. The vulnerability inbox stays on for every account, with or without a plan. Every account is protected by two-factor authentication from the first login. Talk to us.
What counts as a product?
One product with digital elements as you place it on the market: a device model, an application, a firmware line. Versions are unlimited within a product.
Cancelling
Cancel any time in the billing portal. Access continues to the end of the period you paid for. You can export everything, including the evidence chain, at any time and after cancellation.
Open-source stewards
A lighter regime applies under Article 24 (from December 2027). Write to us and we will find a way to support you.
VAT and invoices
Prices in EUR, excluding VAT. We are established outside the EU, so no VAT is charged; a VAT-registered EU business accounts for it under the reverse-charge mechanism (in Germany § 13b UStG). Card payment at checkout; an invoice paid by bank transfer can be arranged for annual plans — write to us before you sign up. support@exploitclock.com
What this replaces
| Capability | Spreadsheet and inbox | Consultant on retainer | Enterprise product-security platform | ExploitClock |
|---|---|---|---|---|
| Knows an exploitation started at 03:00 | No | No | If someone watches the queue | KEV, EUVD, OSV and EPSS every 15 minutes, alerts to chat and inbox |
| Starts and enforces the 24h / 72h / 14-day clocks | Manually | Manually | Depends on the platform | Automatically, with an escalating alert ladder and a calendar fallback |
| Drafts in the ENISA SRP's own field set | No | Per incident, billed hourly | Depends on the platform | Pre-filled from your data, with a fill payload for the portal |
| Proof that you did it right | Edit history | Emails | Audit log | Hash-chained evidence, timestamped daily by an independent authority |
| Takes vulnerability reports from researchers | A security@ mailbox | No | Depends on the platform | A public reporting page with your policy and a 48-hour acknowledgment target; a report becomes a case in one step. On every account, even without a plan |
| Tells your users (Art. 14(8)) | Emails written by hand | Per incident, billed hourly | Depends on the platform | Advisories published from the case to your public page, with an Atom feed and CSAF 2.0 files; emails to your customer list on paid plans |
| Opens the fix ticket in Jira or GitHub | Copied by hand | No | Depends on the platform | One click from the case; status checked every 15 minutes and recorded as evidence |
| Scored drills, board report, technical-file export | No | Custom | Partly | Included on every plan |
| Cost for one product line | Your time at 03:00 | Four figures per incident | Quote-only | From €79 / month |
Questions people ask before buying
Do I have to pay per user?
No. Seats are included in the plan: 3 on Starter, 10 on Team, 25 on Unlimited. Add deputies at no extra cost, because a clock that only one person can stop is not a control.
What happens when the trial ends?
Monitoring and new products pause. Nothing is deleted: your products, cases and evidence chain stay and remain exportable. Choose a plan and monitoring resumes.
Can I cancel any time?
Yes. Cancel in the billing portal; access continues to the end of the period you paid for, and your export stays available.
Can I get an invoice and pay by bank transfer?
Invoice: yes. Stripe issues one for every payment, with your billing address and VAT ID on it, and you can download all of them from the billing portal. Bank transfer: not for self-serve plans. Checkout takes cards only; there is no SEPA or wire option in the flow today. If your procurement process needs an invoice paid by bank transfer, write to us before you sign up and we will arrange it by hand for an annual plan. VAT: we are established outside the EU, so no VAT is charged on the invoice. A VAT-registered EU business accounts for it itself under the reverse-charge mechanism (in Germany § 13b UStG); enter your VAT ID at checkout so it is printed on the invoice.
Do you sign a data processing agreement?
Yes, on every plan. It is published at /dpa with EU standard contractual clauses and the sub-processor list, so you can read it before you sign up.
What if you go out of business?
Everything you need is exportable at any time in open formats: the evidence chain as JSON with its hash chain, the RFC 3161 timestamp receipts, your filings as text, and your SBOMs as you uploaded them. Nothing is locked in.