What Enterprise includes
Everything in Team, plus the access controls, retention and support a security team asks for.
SSO with OIDC
Okta, Microsoft Entra ID and Google Workspace. The workspace owner sets it up and can make it mandatory for your whole domain. How it works.
Roles and change log
Four roles (Owner, Admin, Member, Viewer), per-user MFA and a log of every access and configuration change, with the actor, the IP and the before and after. See details.
Retention set by your contract
One year of query history included, extendable to 3 or 7 years. Your contract sets how long the history and the monthly reports are kept.
Monthly compliance report
On the 1st of every month, a PDF signed with Ed25519 with the period summary and the evidence for 6 SOC 2 criteria and 6 ISO 27001 controls.
Sensitive column protection
Tag the columns that hold personal or payment data and choose what Vericto does with each query that reads them: block it, flag it or mask the value. See details.
Per-agent allowlists
Define which tables and columns each AI agent or service may use. Observe it and simulate it against your real traffic before you enforce it. See details.
Volume sized to your operation
The base includes 25 protected databases and 200M runtime queries a month, and your contract extends it. Protection is never cut off by volume, and CI, CLI and MCP checks are unlimited.
SLA and support by tier
Three plans, all with service credits: Standard, a 99.9% monthly SLA on shared infrastructure; Enhanced, 99.95% on a dedicated single-region deployment; and Premium, 99.99% on a dedicated multi-region active-active deployment. Each plan has its own support level: see the table and the support policy.
Onboarding and a smooth procurement
We guide you through the proxy rollout, rule tuning and SSO setup. For your procurement process, we answer your security questionnaires and provide the DPA.
Security architecture
Designed for CISOs who need verifiable, deterministic protection — not probabilistic models.
- Credential-free architecture: database credentials never leave your network.
- Deterministic AST evaluation: no ML and no probabilistic scores. The same input always produces the same decision, and every decision names the rule and the AST node behind it.
- Append-only audit log: every decision is recorded, with the query text encrypted at rest with AES-256-GCM. The database rejects edits and deletions of events; only your plan's retention purge removes them. Exports and monthly reports are signed with Ed25519: a third party verifies them with Vericto's public key, and any alteration invalidates the signature.
- Role-based access control: four permission levels — Owner, Admin, Member, Viewer.
Performance at scale
Security your engineering team will actually adopt, because they will not notice it.
- P99 < 2ms rule-evaluation latency
- Over 50,000 queries/second per proxy instance with 1 vCPU
- Zero-downtime rule updates: hot-swap via ArcSwap, no restart required
- Non-blocking telemetry: telemetry never delays the SQL path
- Resource-efficient: from 0.5 vCPU and 128 MB per instance in production, up to 10,000 queries/second
Compliance and audit readiness
Pass your next audit with deterministic evidence, not statistical confidence intervals.
- SOC 2 Trust Services Criteria: evidence for CC6.1, CC6.2, CC6.3, CC7.2, CC7.3 and CC8.1
- ISO/IEC 27001:2022, Annex A: evidence for A.5.18, A.8.2, A.8.3, A.8.15, A.8.16 and A.8.32
- Controls tab in the dashboard: any period's activity related to each control, with its evidence and what weakens it
- Exportable audit log: CSV/JSON exports with their PDF compliance report, signed with Ed25519, for external auditors
- Retention set by your contract: one year of query history included, extendable to 3 or 7 years
- Monthly compliance report: on the 1st of each month, a signed PDF with the previous month's summary, control mapping and configuration; kept 13 months, or what your contract sets
- MTTD < 2ms, inline remediation: the destructive query is blocked automatically before it executes.
The report your auditor receives
Every month, a signed PDF with the period summary, the status of each control and the configuration in force. Download the sample or see the controls in detail.
On scope: Vericto is a tool that produces evidence for the controls listed; it does not replace an audit, nor does it imply that Vericto S.A.S. is itself SOC 2 or ISO 27001 certified. Your organisation's certification is issued by an independent auditor against your own controls. If your procurement process needs our certification status or a signed DPA, contact enterprise@vericto.com.
Deployment options
In both models the proxy runs in your VPC: your queries and database credentials never leave your network. Your plan sets where the control plane runs.
| Feature | Standard: shared infrastructure | Enhanced and Premium: dedicated deployment With onboarding |
|---|---|---|
| Vericto proxy | In your VPC, run by your team | In your VPC, run by your team |
| Control plane | Multi-tenant, operated by Vericto | Single-tenant, operated by Vericto for your organization alone, in a dedicated AWS account: the database on Amazon RDS/Aurora, storage on Amazon S3, and the API and dashboard as containers on Amazon ECS |
| Proxy connection | HTTPS with TLS; only telemetry leaves, and it can be sanitized | AWS PrivateLink: telemetry never crosses the internet |
| Region and data residency | AWS us-east-1 (US) and the DPA sub-processors, each in its own location. Data residency is not guaranteed | Enhanced: in the AWS region you choose. Premium: active-active in the regions you choose. Data residency is guaranteed in those regions |
| Users | Unlimited, no per-user pricing | Unlimited, no per-user pricing |
| Domains and TLS | Vericto's domains (app.vericto.com) | By default, an opaque subdomain (for example, e7k2.vericto.com) that never carries your organization's name, or your own domain (for example, vericto.yourcompany.com) through a CNAME. TLS with AWS Certificate Manager certificates on the load balancer; DNS does not route the traffic through Cloudflare |
| SLA | 99.9% (Standard) | Enhanced 99.95% · Premium 99.99%, from deployment acceptance |
| Go-live | When your contract is activated | An onboarding project: we build it for your start date and verify it with you before go-live |
| Price | From $2,500/mo, annual contract | Enhanced: Contact sales · Premium: Contact sales |
Data residency by plan: Standard runs on shared infrastructure and does not guarantee data residency; the sub-processor list shows where each kind of data is processed. On Enhanced and Premium, every control plane component runs in your dedicated AWS account and in the regions you choose: the API and the dashboard, the database, exports and reports, and transactional email, sent with Amazon SES from your region. DNS stays on Cloudflare in DNS-only mode, not proxied, so traffic does not pass through its network. The deployment annex of your contract lists every component and where it runs.
Support by SLA tier
Each SLA tier includes a support level. Times are first-response targets, not resolution times.
| Feature | Standard · 99.9% SLA (shared infrastructure) | Enhanced · 99.95% SLA (dedicated deployment) | Premium · 99.99% SLA (dedicated, multi-region) |
|---|---|---|---|
| Coverage | 24/7 for P1–P2; business hours (customer's time zone, Mon–Fri) for P3–P4 | 24/7 for P1–P2; business hours for P3–P4 | 24/7 for all severities |
| First response P1 | 1 h | 30 min | 15 min |
| P2 | 4 h | 2 h | 1 h |
| P3 | 1 business day | 8 business hours | 4 h |
| P4 | 2 business days | 1 business day | 1 business day |
| Channels | Private Slack channel, email and phone | Private Slack channel, email and phone | Private Slack or Microsoft Teams channel, email and phone |
| Updates during a P1 | Every 2 h | Every 1 h | Every 30 min |
| Extras | Quarterly review | Named support contact, monthly review | Named technical account manager, post-incident report within 3 business days, annual DR/failover drill report |
Severities: P1, production down: the service is unavailable or enforcement data cannot reach Vericto, with no workaround. P2, major degradation: a critical function is degraded. P3, minor issue, or a workaround exists. P4, question or request. These are the same severities as in the support policy. Availability is measured on the control plane Vericto operates; the proxy runs in your VPC and its availability is your team's responsibility (shared responsibility). Service credits apply to availability only, unless your Order Form says otherwise.
Contract and billing
A contract built for your procurement team: predictable pricing, no per-seat licences.
Annual contract
Billed annually, with unlimited users: Standard from the price published above; Enhanced and Premium, custom. 2- and 3-year contracts are discounted and keep the price fixed for the whole term.
Invoice and bank transfer
We send you an invoice in US dollars (USD) and you pay it by bank transfer, net 30. No credit card.
Design Partner program
The first Enterprise customers get a year-1 discount in exchange for a case study, the use of their logo and a feedback session every quarter. Contact us. The self-serve founding-customer code applies to Builder and Team annual plans only.
On-demand add-ons
Contracted separately and not included in any plan: extended retention of 3 or 7 years, and a penetration test on demand. Custom pricing: contact sales.
Penetration test on demand
It is not included in any plan: it is contracted separately, as a one-time charge, with one of these three scopes.
- A. Control-plane API and dashboard. An external firm runs a manual test of the Vericto API and dashboard, following OWASP ASVS and the OWASP API Security Top 10. It includes one retest within 30 days and an attestation letter. On Standard this is the shared plane, so the fixes reach every customer.
- B. A plus the dedicated deployment (Enhanced and Premium). On top of A, the customer's dedicated AWS account: cloud configuration review, the PrivateLink endpoint and both regions. It includes one retest.
- C. Customer-commissioned test. The customer hires its own firm and Vericto coordinates: rules of engagement, the test window and a test workspace, up to 8 hours; additional hours are billed as professional services.
Price: A and B are charged at cost plus 15% (the external firm's cost and Vericto's coordination hours), quoted before you sign. C is a flat USD 1,000. Multi-year and design-partner discounts do not apply. The attestation letter documents the test; it is not a certification.
Ready to protect your production databases?
Tell us about your stack and we will prepare a proposal with the deployment, retention and SLA you need.