Page · Pricing

Kimezu prices the operator, not the user.

Kimezu charges for what an operator actually runs (tenants, regions, support tier). Not for the people who happen to log in this month. Three published tiers; self-hosting is flat and contracted.

Billing
Monthly · in euros
Region
EU-west default
Sandbox
No card required
What you pay for

Hosting, the protocol, every operator feature, no seat tax.

Developer
Production-grade free tier. One tenant, one app, real OIDC.
Free
Starter
A single tenant, shared EU infrastructure.
€49/mo
Most chosen
Operator
For platforms running multiple white-label tenants.
€299/mo
Growth
For serious operators not yet ready to self-host.
€899/mo
Self-hosted
Your hardware, your jurisdiction, contracted SLA.
Custom
Capacity
·
·
·
·
·
Active tenants
1
1
Up to 25
Up to 100
Unlimited
Users per tenant
Unlimited
Unlimited
Unlimited
Unlimited
Unlimited
Connected applications
3
10
Unlimited
Unlimited
Unlimited
Agent identities
5
25
200
1,000
Unlimited
Authentication
·
·
·
·
·
Password & magic-link
●
●
●
●
●
MFA (TOTP) + recovery
●
●
●
●
●
OAuth 2.0 / OIDC + JWKS
●
●
●
●
●
Custom domain per tenant
·
·
●
●
●
Defence
·
·
·
·
·
HMAC-chained audit log
●
●
●
●
●
External chain verification
●
●
●
●
●
Canary tokens + tarpit
●
●
●
●
●
Anomaly detector
●
●
●
●
●
Payments & tax
·
·
·
·
·
Stripe + Mollie profiles
·
●
●
●
●
PayPal profile
·
·
●
●
●
VAT engine + OSS report
·
Basic
Full
Full
Full
Invoice templates
·
1
Per tenant
Per tenant
Per tenant
Operator features
·
·
·
·
·
Webhook delivery
1 endpoint
5 endpoints
25 endpoints
Unlimited
Unlimited
WordPress + modular SSO
●
●
●
●
●
Embedded forms
●
●
●
●
●
Theming as code
JSON
JSON
JSON + git
JSON + git
JSON + git
Wallet credentials (beta)
·
·
●
●
●
Hosting & support
·
·
·
·
·
Region
EU-west shared
EU-west shared
EU-west · EU-central
EU-west · EU-central · pinned
Your hardware
SLA
·
TODO
TODO
TODO
Contracted
Support channel
Community
Email · 2 BD
Slack · 1 BD
Slack · 4h
On-call · 1h
Migration playbook
Docs
Docs
Onboarding included
Dedicated engineer
Dedicated engineer
Start Developer
Start Starter
Run as an operator →
Talk Growth
Talk to an engineer
Atypisch Managed

Atypisch installs and runs Kimezu for your organisation.

Custom install on infrastructure of your choice, operated remotely by Atypisch. Same codebase as Self-hosted, your install tracks the public release stream, one single source of truth for updates across every managed customer. No per-customer forks, no version drift.

Customcontract
Talk to Atypisch →

All prices ex VAT. Billed monthly in euros; annual prepay = 12 months for the price of 10. EU-hosted by default; Self-hosted runs on your hardware under a contracted SLA; Atypisch Managed is operated for you, same upstream codebase.

Non-profit and open-source projects: Developer is already free; Operator is 50% off on request.

How billing works

Kimezu meters what you'd expect, and nothing else.

The bill is a function of tenants, regions and tier, not user logins, not webhook events, not authentication attempts.

a. Tenants are the unit of pricingAn active tenant has had at least one authentication in the billing period. Dormant tenants are not billed. Adding a tenant prorates from the day it activates. measured
b. Users are never billedWhether you have 100 or 10 million users per tenant, the price is the same. You're the operator, they're your customers, not ours. free
c. No charge for failed loginsSome vendors charge per attempted authentication. Kimezu doesn't. A botnet doesn't make you owe us more money. free
d. Webhook delivery is includedLimits apply at the tier level (endpoints, not events). Going over your endpoint count is a one-click upgrade, not a surprise bill. included
e. Annual prepay caps the rateLock the rate for 12 months at a discount; mid-year tier changes apply only to renewal. prepay
f. EU operators pay in EUR; non-EU pay in EUR or USDVAT applies per the EU rules, we record the VAT treatment on every invoice, OSS-ready. EUR · USD
Phone, laptop and tablet on a desk — the end-user's Kimezu sign-in moment

Mobile sign-in screen, the end-user's Kimezu moment

A pricing page is a kind of contract. It should be readable in a single visit, without coming back to check whether the bill grew while you were sleeping. Kimezu is priced flat per tenant for exactly that reason.

Questions

Pricing questions, answered plainly.

If your scenario isn't covered here, mail operators@kimezu.com, a human replies, usually within a business day.

01What counts as an "active tenant"?+
A tenant is active for a billing period if it produced at least one authentication (user, group or agent) during that period. Tenants you've configured but no-one has signed into are dormant and do not count toward your tenant cap.
02Can we run Kimezu on Operator pricing but in our own VPC?+
No. Self-hosting is a separate plan because it ships on your hardware, with a dedicated incident-response contract and a different support model. If you're between tiers, talk to us, we'll quote you the right one.
03What if we exceed our tenant or app limit?+
Nothing breaks. The console surfaces the overage and prompts an upgrade. We don't auto-bill you to the next tier; you choose whether to upgrade or remove tenants. Existing sessions remain valid throughout.
04How does VAT work on the Kimezu invoice itself?+
If you're an EU-established business with a valid VIES VAT ID, reverse-charge applies and we invoice without VAT. EU consumers and EU businesses without a VAT ID are billed at the local rate. Non-EU customers are outside-EU scope. The treatment is recorded on every invoice.
05Can we cancel mid-month?+
Yes. Cancellation takes effect at the end of the current billing period; we do not prorate refunds for monthly billing. Annual prepay is non-refundable mid-term but can be transferred between Kimezu instances under the same operator.
06Is there a non-profit or open-source discount?+
Yes, registered non-profits and projects with a verifiable OSS license get a substantial discount on the Operator plan. Email us with the registration / licence and we'll set it up before your first invoice.
07Do you sign a Data Processing Agreement?+
Yes, a DPA is part of the Master Service Agreement. SCCs are included for any non-EU establishment. You'll receive both before you start configuring tenants; they're not optional add-ons.
Get started

A foundation you operate.

One identity protocol, every tenant their own brand, all of it EU-hosted and yours to run.

Spin up a sandbox → Book a walk-through
Sandbox
No card required

One tenant, unlimited users, live OIDC discovery.

Migration
A real engineer, not a bot

Operator tier includes paired migration time.