Simple, Transparent Pricing
Start free. Grow with your fleet. Every plan includes the full NetDefense feature set — limits only apply to resource counts.
Billing lives at the organization level
One login. Many organizations. Every organization carries its own plan, its own devices, and its own seats.
It's tempting to picture a subscription as a pool of seats or devices you buy once and split across clients. That's not the model. Every organization you create — a client's fleet, or your own lab — has its own plan, its own device count, and its own user seats, independent of every other organization under your login.
An MSP creates one organization per client: a client whose support contract needs read-only technician access sits on Business, a smaller client sits on Team, and the MSP's own internal lab stays on Free. That's the design, not a workaround — pick the right tier per organization, not one tier for your whole book of business.
Seats work the same way. Team members only count toward the seat limit of the organizations they're actually part of — a 20-person support team can be spread across dozens of client organizations without ever pushing a single org over its user cap.
Free
Non-production use
Covers anything that isn't carrying production traffic — homelab, lab, test bench, PoC, evaluation — even if the work itself is billable. Once an organization's devices go live in production under a commercial arrangement (yours or your client's), that org moves to a paid plan.
Team
Business
Enterprise
Custom pricing for large deployments
Where Free ends
The Free plan isn't scoped by who you are — it's scoped by what your devices are doing.
Free covers anything that isn't carrying production traffic: your homelab, a lab or test bench, a proof of concept, or evaluating NetDefense before you commit. That holds even when the work itself is billable — building a PoC for a client is still PoC work. The moment an organization's devices go live in production under a commercial arrangement — yours, or your client's — that organization moves to a paid plan.
Homelab · lab · test bench · proof of concept · evaluation
Production fleets under a commercial arrangement
Seat counts follow the same logic. Three accounts is plenty for a homelab or a small evaluation team kicking the tires before a wider rollout — a production support rota, with on-call rotations and shift handoffs, needs more than that. It's part of why production workloads belong on a paid plan.
The whole product, just capped
Free isn't a stripped-down trial. Most vendors gate features by plan — NetDefense only gates scale and commercial use. Every capability below ships in Free, at Free-tier limits.
Full Feature Comparison
Every feature available across all plans — limits vary by tier.
| Feature | Free | Team | Business | Enterprise |
|---|---|---|---|---|
| Resource Limits | ||||
| Devices | 10 | 25 | 100 | Unlimited |
| Users | 3 | Unlimited | Unlimited | Unlimited |
| VPN Networks | 1 | 2 | 5 | Unlimited |
| Snippets | 100 | 200 | 1,000 | Unlimited |
| Support | ||||
| Support Level | Community support | Phone & chat support | Phone & chat support | 24/7 phone & chat support |
| Data Retention | ||||
| Task History | 30 days | 90 days | 1 year | Custom |
| Core Features | ||||
| Device management Fleet overview, device detail, heartbeat monitoring | ||||
| Configuration sync Push configs to devices | ||||
| Policy templating Define once, apply everywhere | ||||
| Organizational Units Group devices, apply templates per OU | ||||
| Snippets Reusable config fragments: firewall rules, aliases, users, groups, Unbound DNS, Zabbix | ||||
| Variables Per-device and per-OU variable overrides | ||||
| Software Policies Manage OPNsense plugins across fleet | ||||
| Task automation Run, sync, backup operations | ||||
| Scheduled Tasks & Automation Recurring automated syncs, runs, and backups | ||||
| VPN Networks WireGuard mesh networking | ||||
| CLI access ndcli command-line interface | ||||
| Web application Browser-based management dashboard | ||||
| API & Automation Access Personal access tokens for CI/CD and scripting | ||||
| AI Assistant Integration MCP server for AI-driven fleet management | ||||
| Zero inbound access Agents connect outbound only — no open ports | ||||
| Plan-Controlled Features | ||||
| Backups Automated device config backups | ||||
| Remote Admin Direct device access via relay tunnel | ||||
| Read-Only Technician Access Delegate read-only device sessions to support staff | ||||
| Enterprise Only | ||||
| On-premise deployment Self-hosted control plane in your own infrastructure | ||||
| SSO / SAML Single sign-on with your own identity provider | ||||
| Security posture assessment Continuous fleet security evaluation | ||||
| Policy advisors AI-driven policy recommendations and optimization | ||||
| Compliance reports SOC 2, PCI DSS, HIPAA, GDPR reporting | ||||
| Custom reports Tailored reporting built around your requirements | ||||
| Security questionnaire support Assistance completing vendor security and compliance questionnaires | ||||
| SIEM integration Security event forwarding and correlation | ||||
| SOAR integration Automated incident response orchestration | ||||
| Uptime SLA Contracted uptime guarantee for your deployment | ||||
| Dedicated account manager & onboarding A named point of contact and guided onboarding | ||||
Need a custom deployment with unlimited fleets, dedicated support, or on-premise options? Contact us for Enterprise pricing.