Scan a domain
Cipher Discovery pricing

Clear cryptographic visibility. Predictable pricing.

Start free with evidence-backed public TLS scans and supported browser-local repository discovery. Explore planned commercial monitoring, shared ownership and PQC migration workflows as your needs grow.

No black-box quantum-safe score · Explicit coverage · No source-code upload
Run a free scanExplore plans
Start free. Plan your next step.

Choose the visibility you need.

Paid prices are proposed Early Access offers, not active subscriptions.

EUR, excluding applicable taxes. Yearly prices are monthly equivalents; the full annual amount would be billed upfront for 12 months when subscriptions launch. No payment is collected here.

Free

Available today

Discover what is publicly observable.

€0/ evaluation

No subscription required

Free evaluation today

  • Bounded public scans: HTTPS, SMTP STARTTLS, IMAPS, POP3S and LDAPS.
  • Certificate, TLS, PQC relevance and explicit coverage evidence.
  • Supported repository declarations inspected locally in your browser; no source or snippet upload.
  • Supported CycloneDX CBOM import, export and comparison; evidence snapshots.
  • Private browser-bound evaluation workspace, ownership and migration records.
  • Up to five opt-in daily/weekly evaluation monitors with in-workspace drift and expiry warnings; 30-day authorization.
Run free scanOne hostname and selected service per scan. Current retention and safety limits apply.

Starter

Early access

Stay informed when public cryptography changes.

€29/ month

Proposed monthly subscription price

Yearly option: €24/month equivalent; €288 billed annually.

Planned plan features

  • Up to 25 active monitored public endpoints.
  • Daily scheduled public-service discovery.
  • Email alerts for expiry, unexpected certificate changes and supported crypto drift.
  • Searchable history for up to 12 months.
  • Evidence snapshots, CBOM and migration records.
  • One recoverable user account.
Request Starter early accessRequest-only. No paid entitlement, payment or automatic renewal is activated.

Team

Early access

Featured plan · built for teams

Make your cryptographic inventory actionable across the team.

€99/ month

Proposed monthly subscription price

Yearly option: €79/month equivalent; €948 billed annually.

Planned plan features

  • Everything in Starter.
  • Up to 100 active monitored public endpoints.
  • Shared organizational workspace, invitations and role-based permissions.
  • Unlimited invited team members; no per-seat billing.
  • Asset ownership, migration register and reviewed dependencies.
  • Evidence-driven CBOM comparison, reporting and audit history.
  • Searchable history for up to 24 months.
Request Team early accessRequest-only. No paid entitlement, payment or automatic renewal is activated.

Business

Early access

Prove cryptographic change with consistent evidence and processes.

€299/ month

Proposed monthly subscription price

Yearly option: €239/month equivalent; €2,868 billed annually.

Planned plan features

  • Everything in Team.
  • Up to 500 active monitored public endpoints.
  • Supported read-only API and outbound webhooks.
  • Advanced portfolio reporting and evidence exports.
  • Searchable history for up to 36 months.
  • Priority email support.
Discuss Business accessRequest-only. No paid entitlement, payment or automatic renewal is activated.

Enterprise

Early access

Scale cryptographic inventory and migration governance to your environment.

Custom

Scope and terms by agreement

Planned plan features

  • 500+ monitored endpoints by agreement. Discuss organizational scale, security reviews, controls, contract terms and retention.
  • Any SSO, deployment, SLA or custom integration must be implemented and confirmed in your agreement; none is implied as generally available.
Talk to usRequest-only. No paid entitlement, payment or automatic renewal is activated.
A predictable unit

Pay for managed endpoints, not the number of findings.

The proposed license unit is one exact hostname and supported fixed service/port. HTTPS on api.example.com:443 and SMTP STARTTLS on the same hostname:25 are two endpoints. Repeated observations of the same service within one organization count once.

Algorithms, fingerprints, certificate renewals, CBOM records and migration findings are not additional endpoints. No automatic overage charges are proposed: archive an endpoint or change plan before adding monitors above the allowance.

Only HTTPS/443, SMTP STARTTLS/25, IMAPS/993, POP3S/995 and LDAPS/636. No arbitrary ports, subdomain enumeration or internal scanning.

Evidence first

One model. Honest coverage.

Directly observed public TLS behavior, inferred local repository declarations, imported CBOM evidence and human-entered migration context remain distinct. Every finding retains its evidence and confidence.

A scan does not prove complete coverage, compliance certification or quantum safety. An expected fingerprint match confirms only the newer observed scope, not ACME success or every replica.

Cryptographic inventory · CBOM · PQC migration

Before you choose

Pricing questions, answered.

Can I use Cipher Discovery for free?

Yes. Public TLS discovery, supported browser-local repository checks, CBOM workflows and selected evidence exports are available for evaluation. Safe-use and workspace limits apply. One hostname and selected service per public scan is not a complete organizational inventory.

What counts as an endpoint?

One exact hostname plus one supported fixed public service profile: HTTPS/443, SMTP STARTTLS/25, IMAPS/993, POP3S/995 or LDAPS/636. HTTPS and SMTP on the same hostname count as two monitored endpoints. Duplicate observations of the same profile within an organization count once. Certificate rotations, algorithms, CBOM records and new findings do not create extra endpoint charges.

Will you upload my source code?

No. Supported source files are inspected locally in the browser. If you choose to retain findings, only bounded allowlisted evidence metadata is submitted after review; source content and matching snippets are not uploaded.

Can I scan internal systems or every subdomain automatically?

Not with the current public scanner. It assesses authorized exact public hosts and fixed TLS service profiles. Arbitrary ports, subdomain enumeration and private/internal scanning are not included. Other sources will be described separately if and when available.

Is a scan a PQC compliance certificate?

No. Findings have explicit evidence and coverage limitations. They support inventory, review and migration planning but do not certify an organization as quantum-safe or compliant.

Do you offer recurring monitoring?

Yes, for private evaluation: up to five authorized exact-service monitors, daily or weekly, with authorization renewed every 30 days. Current expiry, drift and expected-fingerprint results are in the workspace, not sent by email or webhook. Expanded commercial quotas, email alert delivery, identity and retention are early-access targets, not available subscriptions.

Can colleagues share my existing workspace?

The evaluation workspace is browser-cookie bound, not a shared or recoverable organizational account. Shared workspaces and team permissions are planned paid capabilities; do not use an evaluation cookie as a team login.

Will I be billed if I exceed my limits?

No paid subscription is activated here. No automatic overage charges are proposed: commercial plans will require archiving a monitor or changing plan before activating endpoints above the allowance. Existing evaluation safety limits remain in force.

How are annual subscriptions billed?

The yearly price is a discounted monthly equivalent, billed for 12 months upfront when subscriptions launch: Starter €288, Team €948 and Business €2,868 per year. Prices exclude applicable taxes. This page does not collect payment or start auto-renewal.

How long is data retained?

Anonymous scan reports expire within 24 hours after reaching a terminal state. Private evaluation workspace data expires after 90 days without workspace activity; background scans do not extend that retention. Commercial 12/24/36-month history is planned, subject to implementation, testing and agreement.

Do you have an Enterprise plan?

We can discuss scale, security reviews and contract requirements. Specific integration, availability, deployment, data residency or SLA commitments require confirmed implementation and a signed agreement; they are not standard live capabilities.

Start with cryptography you can actually observe.

Run a free public scan to see the evidence, coverage and migration relevance behind your TLS and X.509 findings.

Run a free scanDiscuss early access