Sovereign by default. Priced to own.
Run the open core yourself, or have us operate a managed sovereign cell in your region. Pricing is contact-led - no public card flow, no per-seat surprises.
Every tier, line by line.
The same identity platform throughout - what changes is where it runs, who holds the keys, and how we support you.
| Features | Open / Self-host | Sovereign | Enterprise |
|---|---|---|---|
| Identity | |||
| Human users | |||
| Organisations & roles | |||
| AI agents (non-human identity) | |||
| Sovereignty | |||
| Self-host | Optional | Optional | |
| Region & residency | Self-managed | Your region | Custom |
| BYOK | - | ||
| HSM key custody | - | - | |
| Support | |||
| Support tier | Community | SLA | Premium SLA |
| Concierge onboarding | - | ||
| Named contact | - | - | |
| Audit & compliance | |||
| Tamper-evident audit | |||
| Audit export (CSV / JSON) | |||
| Compliance evidence access | - | ||
| Audit support | - | - | |
Need something not listed here? Talk to us.
Questions, answered.
Is there a free tier?
Yes. The open core is free to self-host with community support. You get passkeys, MFA, SSO, tenant isolation and the tamper-evident audit log - run on your own infrastructure.
Can we self-host and migrate to managed later?
Yes. Self-host and managed Sovereign run the same code, so there's no rewrite. When you're ready, we stand up a managed cell in your region and migrate with concierge onboarding.
Where is my data stored?
Where you choose. Self-host keeps everything inside your perimeter; on Sovereign you pin the region for storage and processing. The re-identification map never leaves sovereign storage.
How does BYOK work?
Bring your own keys through HashiCorp Vault, a cloud KMS, or an HSM. Encryption keys stay under your custody - OrthID never holds the master. BYOK is available on Sovereign and Enterprise.
Do agents cost extra?
AI agents are first-class identities on every tier, not a separate add-on. Talk to us about volume - pricing scales with usage, not per-identity-type surcharges.
Own your identity layer.
Tell us your region, your keys, and your timeline - we'll shape the right deployment with you.