Priced per governed estate.
Arkion is sold annually, scoped to your estate size and regulatory surface. Every tier includes read-only discovery, cryptographic attestation, and 99.1% compliance evidence. Start with a free Discovery Scan — tier selection follows the finding.
Pilot
For teams running a first governed estate across one cloud, up to 2,500 non-human identities.
- Read-only discovery scan
- Up to 2,500 governed NHIs
- Automated certificate rotation
- Ownership mapping
- Immutable audit trail (1 yr retention)
- Slack + email support · business hours
Scale
For platform teams operating across AWS, GCP, Azure, and Kubernetes. Up to 25,000 NHIs with cross-estate policy.
- Everything in Pilot
- Up to 25,000 governed NHIs
- Multi-cloud + on-prem coverage
- mTLS enforcement policy engine
- Risk scoring + anomaly signals
- Immutable audit (7 yr retention)
- Dedicated solutions engineer
- 24/7 support · 1-hr P1 SLA
Sovereign
For regulated enterprises, defense, and sovereign-cloud customers. FedRAMP-path, air-gapped, dedicated tenancy.
- Everything in Scale
- Unlimited governed NHIs
- Private tenancy or on-prem
- FedRAMP / DORA / NIS2 evidence package
- Dedicated governance architect
- Quarterly executive reviews
- 15-minute P1 SLA · signed BAA · named sub-processors
All tiers: NDA protected · Read-only discovery · Cryptographic attestation
Prices in USD · multi-year discounts available
Questions buyers actually ask.
How is an NHI counted?
One governed non-human identity equals one cryptographic principal under active lifecycle — agent, service account, workload cert, or machine token. Expired or archived identities do not count against your tier.
What is included in the Discovery Scan?
A one-hour, read-only scan of one environment. We return every NHI found, named, risk-scored, and mapped to a likely owner. There is no cost and no commitment. Most scans uncover 30–40% more identities than teams expect.
Is there a free tier?
The Discovery Scan is free. The platform itself begins at the Pilot tier. Arkion is sold only to enterprises with a governance mandate — we do not offer a self-serve consumer product.
How do you handle procurement?
We accept your paper. Standard MSA, DPA, and BAA templates on request. We are listed on AWS Marketplace and Azure Marketplace for committed-spend drawdown.
What about on-prem or air-gapped deployment?
Available on the Sovereign tier. Arkion ships as a signed container bundle with an offline certificate authority bridge. Our FedRAMP path is active.
Tier follows the scan.
Run the free Discovery Scan first. We size the estate, you size the tier. No pre-commitment, no commercial until you’ve seen the finding.