Pricing
Free to 1,000 active devices a month, no card.
Root Herald is in private beta, so accounts are provisioned by request — these are the plans once you are in. You pay for devices, not checks: a device counts once a month however often it re-attests.
Plans
One clear comparison
Pro
$99 / month minimum
2.5¢ per device over 1,000
- Everything in Free
- No device ceiling
- Pay as you go, custom budgets
- Your own attestation policies
- Webhooks
- Email support
Not yet available
Enterprise
Custom
Annual agreement
- Everything in Pro
- Single sign-on with SAML or OIDC
- Volume pricing
Not yet available
Rate card
The more devices, the less each one costs
| Monthly active devices | Rate per device |
|---|---|
| 1 – 1,000 | Free |
| 1,001 – 10,000 | $0.025 |
| 10,001 – 100,000 | $0.018 |
| 100,001 – 1,000,000 | $0.012 |
| 1,000,001+ | Contact sales |
Feature matrix
Every feature, every tier
| Feature | Free | Pro (coming soon) | Enterprise (coming soon) |
|---|---|---|---|
| Volume | |||
| Active devices included | 1,000 | 1,000 | 1,000 |
| Device ceiling | 1,000 | none | none |
| Rate per extra device / month | — | $0.025 → $0.006 | Volume |
| Re-attestation | Unlimited | Unlimited | Unlimited |
| Custom budgets | |||
| Platform | |||
| Desktop TPM attestation (Windows, Linux) | |||
| Mobile device attestation (iOS, Android) | |||
| Cloud vTPM attestation (AWS, Azure, GCP) | |||
| Attestable application keys | |||
| Secure Boot and measured-boot posture | |||
| API keys you can rotate, revoke and scope | |||
| Custom attestation policies | |||
| Webhooks | |||
| Enterprise SSO | |||
| Support | |||
| Community / docs | |||
| Email support | |||
FAQ
Pricing FAQ
What counts as an active device?
One device, counted once, in one calendar month. The first time a device reaches us in a month — whether that is an enrollment through your backend or an attestation check — it becomes active. Every attestation it makes for the rest of that month is free.
A device is identified by its hardware key, not by a cookie or an account, so the same machine is the same device across reinstalls, account changes and key rotation. The same physical device used by two different customers of ours is active for each of them.
Do re-attestations and retries cost extra?
No. Once a device is active for the month you can re-attest it as often as you like — on every login, before every payment, on a timer — at no further cost. That is the point of billing per device: checking more often is the behaviour that makes you safer, and it would be a strange product that charged you most for doing it.
Each challenge nonce is still single-use, so a replayed nonce is rejected rather than re-checked. This is a change from our earlier per-check pricing, where every re-attestation was a separate billable unit.
What happens when I hit my Free-tier quota?
Free covers 1,000 active devices a calendar month. Past that, a device that is new to the month is refused with HTTP 429 quota_exceeded— but every device already active that month keeps working normally, so a fleet that is running does not stop because it grew. The allowance resets at the start of the next calendar month. Paid plans have no device ceiling; they meter the growth instead of refusing it.
You can upgrade in-app at any moment. The ceiling lifts immediately and metered billing applies from that point forward.