Simple, Transparent Pricing

Start free. Grow with your fleet. Every plan includes the full NetDefense feature set — limits only apply to resource counts.

Billing lives at the organization level

One login. Many organizations. Every organization carries its own plan, its own devices, and its own seats.

It's tempting to picture a subscription as a pool of seats or devices you buy once and split across clients. That's not the model. Every organization you create — a client's fleet, or your own lab — has its own plan, its own device count, and its own user seats, independent of every other organization under your login.

An MSP creates one organization per client: a client whose support contract needs read-only technician access sits on Business, a smaller client sits on Team, and the MSP's own internal lab stays on Free. That's the design, not a workaround — pick the right tier per organization, not one tier for your whole book of business.

Seats work the same way. Team members only count toward the seat limit of the organizations they're actually part of — a 20-person support team can be spread across dozens of client organizations without ever pushing a single org over its user cap.

Free

Free

Non-production use

10 devices
3 users
1 VPN network
100 snippets
Community support
30 days task history
Backups
Remote Admin
On-Premise Deployment
Custom Reports
Read-Only Technician Access
SSO / SAML

Covers anything that isn't carrying production traffic — homelab, lab, test bench, PoC, evaluation — even if the work itself is billable. Once an organization's devices go live in production under a commercial arrangement (yours or your client's), that org moves to a paid plan.

Team

$6 / device / mo
25 devices
Unlimited users
2 VPN networks
200 snippets
Phone & chat support
90 days task history
Backups
Remote Admin
On-Premise Deployment
Custom Reports
Read-Only Technician Access
SSO / SAML

Business

$12 / device / mo
100 devices
Unlimited users
5 VPN networks
1,000 snippets
Phone & chat support
1 year task history
Backups
Remote Admin
On-Premise Deployment
Custom Reports
Read-Only Technician Access
SSO / SAML

Enterprise

Contact Us

Custom pricing for large deployments

Unlimited
Unlimited users
Unlimited
Unlimited
24/7 phone & chat support
Custom task history
Backups
Remote Admin
On-Premise Deployment
Custom Reports
Read-Only Technician Access
SSO / SAML

Where Free ends

The Free plan isn't scoped by who you are — it's scoped by what your devices are doing.

Free covers anything that isn't carrying production traffic: your homelab, a lab or test bench, a proof of concept, or evaluating NetDefense before you commit. That holds even when the work itself is billable — building a PoC for a client is still PoC work. The moment an organization's devices go live in production under a commercial arrangement — yours, or your client's — that organization moves to a paid plan.

Seat counts follow the same logic. Three accounts is plenty for a homelab or a small evaluation team kicking the tires before a wider rollout — a production support rota, with on-call rotations and shift handoffs, needs more than that. It's part of why production workloads belong on a paid plan.

The whole product, just capped

Free isn't a stripped-down trial. Most vendors gate features by plan — NetDefense only gates scale and commercial use. Every capability below ships in Free, at Free-tier limits.

AI Assistant Integration (MCP)
Scheduled Tasks & Automation
API & Automation Access (Tokens)
Remote Admin
Backups
Configuration Sync
Policy Templating

Full Feature Comparison

Every feature available across all plans — limits vary by tier.

Feature Free Team Business Enterprise
Resource Limits
Devices 10 25 100 Unlimited
Users 3 Unlimited Unlimited Unlimited
VPN Networks 1 2 5 Unlimited
Snippets 100 200 1,000 Unlimited
Support
Support Level Community support Phone & chat support Phone & chat support 24/7 phone & chat support
Data Retention
Task History 30 days 90 days 1 year Custom
Core Features
Device management Fleet overview, device detail, heartbeat monitoring
Configuration sync Push configs to devices
Policy templating Define once, apply everywhere
Organizational Units Group devices, apply templates per OU
Snippets Reusable config fragments: firewall rules, aliases, users, groups, Unbound DNS, Zabbix
Variables Per-device and per-OU variable overrides
Software Policies Manage OPNsense plugins across fleet
Task automation Run, sync, backup operations
Scheduled Tasks & Automation Recurring automated syncs, runs, and backups
VPN Networks WireGuard mesh networking
CLI access ndcli command-line interface
Web application Browser-based management dashboard
API & Automation Access Personal access tokens for CI/CD and scripting
AI Assistant Integration MCP server for AI-driven fleet management
Zero inbound access Agents connect outbound only — no open ports
Plan-Controlled Features
Backups Automated device config backups
Remote Admin Direct device access via relay tunnel
Read-Only Technician Access Delegate read-only device sessions to support staff
Enterprise Only
On-premise deployment Self-hosted control plane in your own infrastructure
SSO / SAML Single sign-on with your own identity provider
Security posture assessment Continuous fleet security evaluation
Policy advisors AI-driven policy recommendations and optimization
Compliance reports SOC 2, PCI DSS, HIPAA, GDPR reporting
Custom reports Tailored reporting built around your requirements
Security questionnaire support Assistance completing vendor security and compliance questionnaires
SIEM integration Security event forwarding and correlation
SOAR integration Automated incident response orchestration
Uptime SLA Contracted uptime guarantee for your deployment
Dedicated account manager & onboarding A named point of contact and guided onboarding

Need a custom deployment with unlimited fleets, dedicated support, or on-premise options? Contact us for Enterprise pricing.

Frequently Asked Questions

Free covers anything that isn't carrying production traffic: a homelab, a lab or test bench, a proof of concept, or evaluating NetDefense before you commit to a plan. That holds even when the work itself is billable — building a PoC for a client is still PoC work. The line is what the devices are doing, not who's paying whom: the moment an organization's devices go live in production under a commercial arrangement — yours, or your client's — that organization moves to a paid plan. Team or Business is the right plan for commercial, production use.
Subscriptions are per organization, not per user or per account. Each organization carries its own plan and its own resource limits, so on one login a client org can sit on Business while a smaller client sits on Team and your own internal lab stays on Free. A single account can belong to any number of organizations, but can only own (as superuser) up to two Free-tier organizations at a time — there's no limit on how many organizations you can join as a member.
Plans are billed based on the number of devices registered in your organization. You only pay for the devices you manage.
The user limit applies per organization. An MSP can create multiple organizations for different clients. Each organization has its own user seat limit. Your MSP team members only count toward the seat limit of organizations they are actually associated with — so a team of 20 can manage dozens of client orgs without exceeding any single org's user cap.
You won't lose access to existing resources. New resource creation (devices, users, VPN networks, snippets) will be blocked until you upgrade or remove existing resources.
Yes — you can change your plan at any time from your organization settings in the web app. Contact us at hello@netdefense.io for assistance.