Pricing

Two tiers,
both run by us

Pricing is a conversation, not a list: tell us about your customers and we agree a price with you. We run RealmSSO for you, so you install and operate nothing. No per-seat pricing. No per-connection fees.

ManagedHosted by us

Priced in a conversation

No list price: we agree the price with you.

We run it for you. You install and operate nothing.

SAML 2.0 and OIDC connections, and SCIM 2.0 directory sync
Admin Portal, observability dashboard, REST API and webhooks
A realm for each of your customers’ accounts: a separate sign-in space for each
Deployed, operated and upgraded by us
Your customers keep their own identity provider

Talk to us about pricing

Enterprise

Priced in a conversation

No list price: we agree the price with you.

Managed hosting, under a written agreement, with priority feature requests and custom integrations.

Everything in Managed
Priority feature requests
Custom integrations

Talk to us about pricing

Both tiersRun under a written agreementNo per-seat pricingNo per-connection fees

What managed hosting is, precisely

We run RealmSSO for you on one shared instance. Each of your customers’ accounts gets its own realm, the separate sign-in space we create for that account. Below the realm, accounts share one RealmSSO server, one sign-in service, the databases and one machine. We deploy, operate and upgrade it. No service-level figures exist yet, and there is no uptime figure. There is no list price, so we agree the price with you in a conversation. Read How we run your instance and What we do not have yet before you decide.

Questions buyers ask

Before the first call.

Why is there no price on this page?

Pricing is a conversation with us, not a list. Tell us which identity providers your customers use and how many customers you have, and we agree a price with you.

Do you charge per user or per connection?

No per-seat pricing. No per-connection fees.

How can we try RealmSSO?

Talk to the people who build RealmSSO about a pilot. Both tiers run under a written agreement.

What is the difference between the two tiers?

Enterprise is managed hosting, under a written agreement, with priority feature requests and custom integrations.

Are there service levels?

A written agreement covers the Managed and Enterprise tiers. No service-level figures exist yet, and there is no uptime figure.

Can we have a dedicated instance or choose a region?

There is no dedicated instance, no private connectivity, no customer-managed keys and no choice of region. The rest of what we do not have yet is in one list.

What network access does RealmSSO need?

SAML: a public address. The sign-in travels through the user’s browser. When you create a connection, RealmSSO checks the provider’s sign-in address: its name must resolve in public DNS to a public address, or the request is refused. A provider with an internal-only name or a private address cannot be connected today. A provider with a public name and address can be connected even if its firewall admits only your customer’s network: use three manual values or pasted metadata XML. With a metadata URL, the sign-in service keeps re-reading the metadata from that URL, so it must stay reachable from the internet.
OIDC: yes. RealmSSO’s sign-in service exchanges the code with the identity provider directly, so the provider’s endpoints must be reachable from the internet.
SCIM: your customer’s identity provider calls RealmSSO’s SCIM address over the internet. RealmSSO never connects to it.
Your application can sit on a private network. RealmSSO never connects to it for sign-in. It needs outbound HTTPS to sso.realmsso.com for sign-in, and to api.realmsso.com if it calls the API, for example the domain lookup. Your users’ browsers need to reach your application and the sign-in service. Webhooks are the exception: RealmSSO calls an endpoint of yours, which must be public.
There is no private connectivity today. If your firewall needs to allow our calls, talk to us.
We have not measured a sign-in against a provider or an application on a private network.

What does leaving look like?

Your application speaks standard OIDC to the sign-in service. The addresses that your customers registered in their own identity provider point at RealmSSO, so moving to another service is a coordinated change for each customer. No procedure for exporting your data is documented yet.

Talk to the people who build it.

We run RealmSSO for you. Tell us which identity providers your customers use and how many customers you have, and we will tell you what fits today.