Pricing

Free on your machine. Paid when the fleet must stay current.

Signup never gates first value. TEAM begins when inventory must stay current across other people's machines — continuous snapshots, change alerts, ownership, and org decisions. One product, priced by enrolled endpoint.

Run a free scan

SOLO

Free

your own machine · no account

Local Shadow AI inventoryDated local snapshotReport, evidence JSON, AI-BOMNothing uploaded, ever

Get the CLI

Most teams

TEAM

€3,600 / year

up to 50 endpoints

Everything in SOLOContinuous fleet inventoryAdded, removed and changed alertsRunning-state eventsOwnership + org decisions

Start TEAM

Enterprise

Talk to us

SSO · DPA · procurement

Everything in TEAMSSO and SCIMNative GRC push when availableSecurity review supportNamed contact

Contact sales

TEAM bands

Up to 50 endpoints €3,600 / year

Up to 250 endpoints €6,000 / year

Beyond 250 endpoints Talk to us

Start here

Shadow AI Inventory Pilot

Most teams do not start with a subscription. They start by finding out whether an Shadow AI inventory exposes a real endpoint blind spot in their own fleet.

€1,500

30 days · up to 50 Mac and Linux endpoints

Deployment and scan-coverage sessionFirst fleet inventory and change baselineOne review with your Security or IT ownerCredited against the first year if you continue

Book a Sprint

What actually changes between plans

CapabilitySOLOTEAMEnterprise

Local Shadow AI inventory yes yes yes

Dated snapshots local fleet fleet

Report, JSON, AI-BOM yes yes yes

Continuous fleet inventory — yes yes

Change and running-state alerts — yes yes

Ownership & org decisions — yes yes

Findings with fix paths local fleet fleet

GRC delivery manual pilot native

Windows endpoints — — —

SSO / SCIM — — yes

Data leaves the device never consented consented

TEAM standardization is separate from evidence sync — promoting a redacted standard command is an explicit admin action.

Pricing questions

What is actually free?

SOLO: the scan, local inventory and local artifacts on your own machine, with no account and nothing uploaded. That is the whole free tier, and it is not time-limited.

What counts as an endpoint?

One machine enrolled into your org. A developer with two laptops enrolls two endpoints; a machine you revoke stops counting. People who only read the dashboard are not endpoints and are never billed.

Why is the Sprint paid rather than a free trial?

Because the open question is not whether the scan runs. It is whether the inventory finds an operational blind spot and whether the change signals are useful to your Security or IT team. The fee is credited against the first year if you continue.

Do you support Windows?

Not yet. Collection covers macOS and Linux endpoints today. If your engineering fleet is Windows-first, KeepRails is not ready for you and we would rather say so before a Sprint than during one.

Are these prices final?

They are a starting hypothesis published so the conversation has a number in it. Annual billing, multi-year terms and consultant-led engagements are negotiated directly.

What happens to our register if we stop paying?

The local SOLO register keeps working on every device, free, as it always did. The org roll-up is exportable before the account closes.

What is still in pilot?

Native push into Vanta and Drata is in pilot; the working path today is keeprails report --evidence followed by upload.