Qualor Enterprise
Everything in the free edition, plus the controls your organisation needs. Never priced by lines of code or by seat.
Plansper server, per year
The community edition stays free, with no limit on lines of code or users.
One licence key on the server you already run. Nothing to migrate or reinstall.
One licence key switches these on; each card names the plans that include it.
Business and Enterprise
Your people sign in with the company account they already have, and your identity provider's groups decide their roles. Enterprise adds SCIM provisioning and several identity providers at once.
Learn more about single sign-on and SCIMBusiness and Enterprise
A record of who changed what, built so that any tampering shows. Export it for your auditors, and on Enterprise stream it live to your SIEM.
Learn more about the audit logBusiness and Enterprise
Rule out the licences your company can't ship, such as GPL or AGPL, once for the whole organisation. A merge request that brings one in is flagged and can fail its quality gate.
Learn more about the licence policyBusiness and Enterprise
See which vulnerabilities attackers already exploit (CISA KEV) and how likely an exploit is (FIRST EPSS). Exploited ones reach you at once, by email, Slack or Teams. New High and Critical ones arrive in a daily email.
Learn more about exploited vulnerabilities and alertsBusiness and Enterprise
Download a CycloneDX or SPDX SBOM of your main branch or any release, and a VEX document with your team's decisions, ready for customers and auditors.
Learn more about SBOM and VEX exportEnterprise
Portfolio reports show quality across every project and team. Compliance exports give your auditors findings, gate results and triage decisions, with the SBOM attached. Qualor posts fix suggestions for the new findings of merge requests without a click.
Learn more about portfolio reports, compliance exports and fix suggestions
Per server instance, per year, in US dollars. Never by lines of code, never by seat. Business covers single sign-on, the audit log, a licence policy, vulnerability alerts and SBOM export; Enterprise adds automatic provisioning, SIEM streaming, several identity providers, automatic fix suggestions and priority support.
FreeMIT licence, commercial use included
The full product, with no limit on lines of code, users, projects or organisations.
$4,900per server, per year
Single sign-on, the audit log and vulnerability alerts, with email support.
$12,000per server, per year
Everything in Business, plus the controls a large organisation needs.
Two- and three-year terms and early customers get a discount on request. To buy, name the plan in the form below and we reply by email with your licence key, or with a quote first if your purchasing team needs one.
The enterprise features ship in the server you already run. Add a key and they switch on: nothing to migrate, nothing to reinstall.
The key is verified on your own server. No phone-home, so it works in air-gapped networks.
A lapsed licence gets 14 days' grace, then the server carries on as the community edition. Nothing is deleted or locked.
Modelled on GitLab's enterprise licence: read the code, and try it for development and testing, for free. Production use needs a subscription, or a free 30-day trial.
| Feature | Community | Business | Enterprise |
|---|---|---|---|
| Price | Free | $4,900 per server a year | $12,000 per server a year |
| Lines of code, users, projects, organisations | Unlimited | Unlimited | Unlimited |
| Quality gates on new code | Yes | Yes | Yes |
| Review comments on GitLab and GitHub | Yes | Yes | Yes |
| All analyzers, plus any SARIF tool | Yes | Yes | Yes |
| Qualor's own security rules, with deep C# analysis | Yes | Yes | Yes |
| SonarQube import | Yes | Yes | Yes |
| Every dependency and its licence | Yes | Yes | Yes |
| Dependency vulnerabilities of your main branch and releases, re-checked without a new scan | Yes | Yes | Yes |
| Vulnerability triage with VEX reasons | Yes | Yes | Yes |
| Email: password resets, invitations and quality gate alerts | Yes | Yes | Yes |
| AI code review of merge requests, on your own model | Yes | Yes | Yes |
| AI assistant on your own model | Yes | Yes | Yes |
| Users and API tokens | Yes | Yes | Yes |
| Roles and project-level access | Yes | Yes, with roles set by your identity provider's groups | Yes, with roles set by your identity provider's groups |
| Single sign-on (OpenID Connect, SAML 2.0) | No | Yes | Yes, several identity providers |
| SCIM provisioning | No | No | Yes |
| Tamper-evident audit log, with exports | No | Yes | Yes |
| Audit log streaming to your SIEM | No | No | Yes |
| Dependency licence policy in the quality gate | No | Yes | Yes |
| Exploited vulnerabilities (CISA KEV) and exploit probability (FIRST EPSS) | No | Yes | Yes |
| Vulnerability alerts by email, webhook, Slack and Teams | No | Yes | Yes |
| SBOM (CycloneDX, SPDX) and VEX (CycloneDX, OpenVEX) export | No | Yes | Yes |
| Portfolio reports, with vulnerable releases | No | No | Yes |
| Automatic fix suggestions for new findings on merge requests | No | No | Yes |
| Compliance exports, with the SBOM attached | No | No | Yes |
| Support | Community | Email support | Priority support |
| Licence | MIT | Source-available, with a subscription. Try it free for 30 days | Source-available, with a subscription. Try it free for 30 days |
| Next step | Get started free | Buy BusinessStart a free trial | Request a quoteStart a free trial |
Prices are per server, per year, in US dollars. Compliance exports and portfolio reports are included with Enterprise.
Yes. Name the plan you want, or ask for a quote, with the form at the bottom of this page, and we reply by email. A Business key switches on single sign-on, the audit log, a dependency licence policy, exploited vulnerabilities and exploit probability, vulnerability alerts, and SBOM and VEX export. An Enterprise key adds SCIM provisioning, audit log streaming to your SIEM, several identity providers at once and automatic fix suggestions; compliance exports and portfolio reports are included.
No. It is the same server image. Add a key and the enterprise features switch on at the next restart. Remove it and the server keeps running as the community edition, with all your data.
Admins see a notice 30 days before, and a 14-day grace period follows in which everything keeps working. After that the server runs as the community edition: single sign-on and SCIM stop, the audit log pauses and keeps what it recorded, the licence policy stops checking new dependencies, vulnerability alerts, exploit data and exports stop, and automatic fix suggestions stop. Nothing is deleted or locked, and a renewed key brings everything back at the next restart.
No. The key is checked on your own server, so Qualor Enterprise works in air-gapped networks.
Per server, per year, and never by lines of code or by seat. Business is $4,900 a year: single sign-on, the audit log with exports, a dependency licence policy, exploited vulnerabilities, vulnerability alerts, SBOM and VEX export, and email support. Enterprise is $12,000 a year and adds SCIM provisioning, audit log streaming to your SIEM, several identity providers, compliance exports, portfolio reports, automatic fix suggestions and priority support. The community edition is free. Ask about discounts for two- and three-year terms and for early customers.
Yes. It is in the same public repository, under a source-available licence modelled on GitLab's. Reading it and trying it for development and testing are free; production use needs a subscription or a free 30-day trial. Everything else in Qualor is MIT. Start a free trial
Tell us which plan you want (Business or Enterprise), how many servers, and whether you would like a two- or three-year term. For a quote, tell us roughly how many developers and organisations you have, whether you use GitLab or GitHub, your identity provider, and which enterprise features matter most to you.
Thanks, . Your message is on its way.
We'll reply to .