Pricing

Automation is free.
Audit season is not.

Every run leaves evidence anyone can verify offline: a tamper-evident chain, a signed receipt, and an open verifier that never contacts us. That part is free forever, with no host cap, no seat cap, and no expiry. You pay when an organization has to answer for the work: directory sign-in, rules that refuse a change or grade it by risk, distributed workers, and the period change register assembled from your real run history. Four tiers, and a signed license the paid build checks offline, so nothing ever phones home.

Community

Leave AWX today. Try real governance.

$0forever

Self-hosted, single binary, single-node deployment. No license key.

Get started
Not a trial and not a crippled edition. Everything here is complete: no seat cap, no host cap, no expiry, and the proofs are free forever: the audit chain, anchoring, receipts, and the open verifier.
  • All seven tools: Ansible, Terraform, OpenTofu, Bash, PowerShell, Python, Go
  • One-command importers: AWX, AAP, Tower, Ascender, Semaphore, Chef, Puppet, Rundeck, Jenkins, and crontabs
  • Live host-by-task matrix, balanced splits, fleet memory, and drift detection
  • Drag-and-drop workflow editor, pipelines, schedules, webhooks, notifications
  • Local users with roles, organizations, and teams
  • Plain rules, as many as you need, each a require-approval policy or an exemption, with every approval digest-bound: a held run is approved as the exact content the approver saw
  • The full evidence engine: hash chain, RFC 3161 anchoring, signed per-run receipts, the run dossier, and offline verification with the open verifier
  • Sealed credentials with secrets masking in logs
  • The agent gate, free on every tier: an AI agent gets one operator-bound token, its runs wait for a person's approval with no policy written, unless a rule with effect: exempt covers them, and it can never approve one
  • Advisory AI that can propose a run and never runs one, and community support on GitHub
Pro

Pro stops a risky or irreversible change before it runs, at a price that fits one engineer's budget.

$500per year, flat per org

To 500 hosts, single-node. The paid build, unlocked by a signed license file the product verifies offline.

Start a 30-day trial Buy Pro
Community gives you the built-in hold on agent runs and plain rules of your own. Pro is for when a rule has to refuse a change outright or hold it by how risky or hard to undo it is, and people should sign in from the directory you already run. A lapsed license takes nothing: sign-in falls back to local accounts, and your data, evidence, and every Community feature keep working.

Everything in Community, plus:

  • Deny rules and risk and reversibility floors: refuse a change outright, or hold it when its risk or how hard it is to undo crosses a floor you set
  • Directory sign-in: OIDC, SAML, LDAP, and JWT, so accounts come from the directory you already run
  • Email support: an engineer's first response within two business days. Clocks are defined in the terms

Pro stops where the organization starts: an approver who is not the requester, policy as code in Rego, rules scoped to one agent or actor, the change register, and workers are Team.

Team

The audit is a command, not a quarter.

One command, switchtender audit report, renders the period's change register from the runs that actually happened: who asked for each change, the decision the chain recorded over it, its risk grade, and how it ended. That is the change-management evidence a SOC 2 CC8.1 or ISO/IEC 27001 A.8.32 review samples from.

$7,500per year, flat per org

By fleet band: $7,500 to 500 hosts · $15,000 to 1,000 · $30,000 to 2,500 · $45,000 unlimited. Self-reported at renewal: no telemetry, no seat counting, no usage audit.

Start a 30-day trial Buy Team

Everything in Pro, plus:

  • The period change register, built from your real run history: up to five thousand changes a period, and it says on its face when the period held more. Point --evidence-dir at an archive and registers write themselves on a cadence, so the evidence exists before anyone asks
  • Separation of duties, which is what makes the register hold up: a rule can require an approver who is not the requester, and a refused self-approval leaves no decision behind. The check compares accounts, not credential names, so asking with a token and approving in a browser is still the same person. The requirement is copied onto each run the rule holds, so a later edit to the rule cannot weaken a pending decision
  • Per-agent rules: scope a rule to every AI agent, to one named agent, or to the account an agent acts for. The record answers which AI agents touched prod, and who approved them: the chain marks an agent's change as an agent's, and every decision names who made it
  • Distributed workers and queues, for fleets one machine cannot reach, including a DMZ or a customer network the controller cannot dial into. A worker's runs enter through the same gate as every other run, so the whole estate can run through one gate
  • The full policy engine: separation of duties and per-agent rules as above, and Rego (Open Policy Agent) policies when a rule needs code
  • One-click drift reconcile, from detection to a held, approvable fix. Terraform and OpenTofu reconcile the exact plan the check kept. Ansible reruns the playbook on the drifted host, bound to the check that found it, a rerun you can also launch by hand on Community
  • Support with a clock on it: Severity 1 and Severity 2 reports get an engineer's first response within one business day, Severity 1 is worked first, and a missed Severity 1 clock adds a month to your license. Severities and clocks are defined in the terms, not implied

A signed license file, verified offline by the paid build. Thirty-day trial from an email, no card. Purchase by invoice, net 30. The signed license goes out the same day for requests before 17:00 US Central, otherwise by the next morning. A lapsed license takes nothing: paid features stop, apart from the few the FAQ names, and your data, evidence, and every Community feature keep working.

Hosted witness add-on, $3,000 a year, flat per org: a KordLoom-operated witness, outside your install. On a cadence you set, your install sends it the chain's newest head with a proof that the chain only grew, and the witness countersigns only a chain that did. It receives no run content, host names, credentials, or personal data. Scoped on the order form.

The live demo runs the Community build, the same one you download, so a paid feature there answers with the tier it needs. This page lists the tier of each one.

Enterprise

The audit trail has an alibi.

An outside witness countersigns your chain as it grows, so nothing it has seen can be rewritten without the verify failing.

$50,000and up, per year

Negotiated, and includes Team for the whole organization. Every service below is available, and the ones you choose are scoped and dated on the order form before either of us signs.

Talk to us

Everything in Team, plus:

  • Hosted witness, included: the same KordLoom-operated witness Team buys as an add-on, outside your install. On a cadence you set, your install sends it the chain's newest head with a proof that the chain only grew, and the witness countersigns only a chain that did. Every bundle your install exports carries those countersignatures, and any LoomSeal verifier checks them offline. It receives no run content, host names, credentials, or personal data
  • Evidence custody for the term of the agreement, re-timestamped as timestamp authorities change, with the full archive handed back at the end. A paid retention period after the term can be added on the order form
  • Evidence operations: the evidence packs and periods named on the order form, delivered on its dates, so each pack lands on your audit calendar. Each pack is the change register the product already writes on a cadence, so none depends on someone remembering to run it
  • Air-gapped deployment assistance and hardened builds
  • A written support SLA on the order form, with its coverage and clocks stated there
  • A named engineer and a security questionnaire pack

What the witness proves: the record was not changed after the witness saw it. It does not prove an entry was true when it was written, and history from before enrollment rests on your anchors. The threat model says where that line sits.

Where the line sits, in one sentence: the proofs are free and the packaging is paid. Anyone can verify a SwitchTender receipt offline forever, on any tier, because evidence you cannot check is not evidence. What Team buys is the org-scale machinery around it, and what Enterprise buys is work done for you outside your own install, scoped on the order form.

Why the import is free and the migration costs $25,000. The importer moves your configuration. It reads your AWX export and stands the jobs, projects, credentials, schedules, and inventories up here, after a preview of what will land. What it does not move is how your organization governs a change: who may approve what, which credentials survive the crossing, how you cut over without a window where neither system is authoritative, and what your auditor accepts as evidence afterward. That is the part that goes wrong, and the Migration Program below is that part done with you.

For your procurement or security review: the procurement page answers vendor-risk questions in writing: business continuity, support clocks, security response, release verification, and what data ever reaches us.

Before you buy: a purchase is governed by the terms, and the refund policy says what happens if it turns out to be the wrong call. Both are short, and both are written to hold us to the commitments above rather than to reserve rights against you. The Migration Program is a services engagement under its own written agreement.

SwitchTender Migration Program

$25,000fixed price, four milestones, first year of Team at the 500-host band included, larger bands pay the difference

We move you off AWX, Semaphore, or Rundeck and into production on SwitchTender, with the change controls you already run and your evidence workflows carried forward. Four milestones, normally about six weeks: discovery and import, environment, governance, cutover and handoff. Your first year of Team at the 500-host band is included, and a larger band adds the difference for that year: $7,500 at 1,000 hosts, $22,500 at 2,500, and $37,500 unlimited. Everything wired during the program keeps working after it.

Start a migration Full program details

In writing, before you sign

Seven commitments, every one enforceable.

What is free today stays free

The Community tier as published at launch never shrinks. We add paid features, and we never move a Community feature behind the key.

A lapsed license takes nothing

Data, evidence, receipts, and every Community feature keep working. Paid features stop, apart from the few the FAQ below names. Nothing is deleted, locked, or held for ransom, and dropping to Community needs no restart.

No phone-home, no seat counting, no audits

The license is a signed file the binary verifies offline. Fleet bands are self-reported, and we will never ask to check.

Every receipt verifies without us, forever

The verifier is open source, the format is published with conformance vectors, and verification does not depend on KordLoom continuing to exist.

Your price is fixed for the term

And you hear about any change at least 60 days before renewal, not on the invoice.

Every release of the public core converts to Apache 2.0

Two years after it ships, automatically, under BSL 1.1. The escape hatch is in the license text, not in our goodwill.

Flat per org within a band

Never per seat, never per run. A controller gets more valuable as more people route work through it, and we refuse to price against adoption.

Questions

Which tier do I need?

Community, until a rule has to refuse a change outright or hold it by risk, or people should sign in from your directory. That is Pro. The week you need agent-scoped policy or an approver who is not the requester, workers reaching fleets a single machine cannot, or a change register an auditor will actually read, that is Team. Enterprise is for when someone outside your own install has to hold the evidence: custody of it for the term, evidence work on your audit calendar, and the hosted witness included. Most organizations should start on Community and let the gate tell them when they have outgrown it.

Can I move from AWX?

Yes, on Community, and the same goes for Semaphore, Rundeck, Jenkins freestyle jobs, and plain crontabs. AAP, Tower, and Ascender share the AWX export format. For a large or regulated move, the Migration Program does it for you. Start with the switching guide.

I started on SQLite. What about Postgres and HA?

PostgreSQL, including active-active HA on it, is Community. Today the supported move is switchtender backup and restore, which carries your configuration: projects, templates, inventories, credentials with their sealed secrets, schedules, and tokens. Run history and the audit chain stay with the SQLite file, and that is not a loss: the old database remains readable and its evidence verifiable forever, because receipts never depend on where the data lives now. If you want the history physically merged, tell us and we will do the move with you.

How do I buy or trial today?

Email licensing@switchtender.com with your org name and band. A signed 30-day trial license goes out the same day for requests before 17:00 US Central, otherwise by the next morning. No card. Buying works the same way with an invoice until card checkout ships. Enterprise starts with a conversation.

Do you count my hosts?

No. A host is an inventory entry that received a run in the prior twelve months, counted once however many inventories name it: dead inventory costs nothing. Bands are self-reported at purchase, the binary counts nothing and reports nothing, and we will never ask to audit. Growth mid-term costs nothing: if your fleet outgrows its band, you move up at your next renewal, and that trust is priced in.

What happens when a license lapses?

Paid features stop at their next license check, with no restart, and nothing is deleted, locked, or held. Your data, your evidence, your receipts, and every Community feature keep working, and a database you initialized on PostgreSQL stays fully usable forever. A few things deliberately keep going. Approval policies keep enforcing, advanced rules included, because a gate that opened on the day a term lapsed would release the runs it was written to hold. Directory sign-in stays on until the server next starts, then falls back to local accounts. The policy file still reloads, so rules the API would refuse on a lapsed license can still be added there, and servers already sharing a PostgreSQL schema keep sharing it. We built the gate so that it cannot hold your data hostage even if we wanted it to.

What support comes with each tier?

Community uses the public issue tracker. Pro adds email support, with an engineer's first response within two business days. On Team, Severity 1 and Severity 2 reports, production runs blocked or a paid feature materially degraded with no workaround, get a first response within one business day, and Severity 1 is worked first. A missed Severity 1 clock extends the license term by one month at no charge for each miss. The rest is reasonable efforts. Enterprise puts an SLA on the order form, with its coverage and clocks stated there. Severities, business days, and what a first response means are defined in the terms, so the commitment is checkable rather than a feeling.

Why is the change register paid when receipts are free?

Because proofs and packaging are different things. Anyone must be able to verify what your install did, on any tier, forever, or the evidence story is worthless, so the chain, anchors, receipts, dossiers, and verifier are all Community. The period change register is the assembled compliance deliverable an auditor consumes, and assembling deliverables is a thing organizations pay for.

What does the license allow?

SwitchTender is source-available under BSL 1.1. You can read the source, modify it, self-host it, and run it in production for your own organization. The one thing the license reserves is offering SwitchTender to third parties as a hosted or managed service that provides its primary functionality. If you run infrastructure for clients and are unsure which side of that line you are on, write to licensing@switchtender.com before you start. Each release of the public core converts to Apache 2.0 two years after it ships. Paid features ship in a separate proprietary paid build, licensed to your organization for the term; see the terms. See the LICENSE for the exact terms.

What exactly is the license file?

A small signed JSON document. The binary carries our public key and verifies the signature offline. Nothing is fetched, ever. Install it with switchtender license install, see where you stand with switchtender license status. No license server, no activation, no phone-home, and losing internet changes nothing.

What happens to paid features if you disappear?

Your license keeps verifying, because verification is offline, so everything works through the end of your term, and nothing you produced is ever lost: Community, your data, and your receipts work forever, and the open verifier does not depend on us. Paid features run to the end of your term, and every paid build we delivered keeps running in Community mode after that. Each release of the public core also converts to Apache 2.0 two years after it ships, and the terms accelerate that: if KordLoom ceases business, every published release of the public core converts immediately. The code itself outlives the company, on a clock you can enforce.

Have these prices changed?

Yes, the prices on this page last changed on October 21, 2026.

Leave AWX on Community. License Team the week the org grows into it.

The proofs are free forever on every build. Team is an email and a signed file away. Enterprise is a conversation. If you need off AWX in a hurry, ask about the Migration Program.

Get started Live demo Talk to us