$Pricing
Pricing that scales with your incident response maturity.
Three tiers, drawn from real conversations with security and resilience leaders. Starter and Professional are monthly subscriptions — subscribe in minutes, cancel anytime. Enterprise is custom, and we come back within one business day.
Starter
For teams running their first formalised IR program.
Best for: Single team standing up incident response
$500/mo
billed monthly, cancel anytime
- ▍Commander mode + multi-agent chat
- ▍Up to 15 users · up to 50 incidents / month
- ▍AAR + SITREP generation
- ▍Tabletop exercise designer, scenario and playbook library
- ▍Regulatory deadline clocks
- ▍1 AI provider (Gemini)
- ▍Email support
- ▍90-day activity log retention
Professional
MOST POPULARFor organisations with mature multi-team incident response.
Best for: Multiple teams, SOC + GRC + Engineering
$1,000/mo
billed monthly, cancel anytime
- ▍Everything in Starter
- ▍Up to 50 users · up to 200 incidents / month
- ▍Multi-incident handling + parked-incident workflow
- ▍GRC-A dashboard — DORA, NIS2 and GDPR posture tracking
- ▍AI Governance module
- ▍Multi-model AI: Gemini, OpenAI, Anthropic
- ▍Local AI mode — Ollama on your own hardware
- ▍AI Navigator + integration sandbox
- ▍Webhook and connector ingestion (PagerDuty, Datadog, Opsgenie, Jira, ServiceNow, Sentinel, Splunk SOAR, Cortex XSOAR)
- ▍Per-customer activity logs + admin audit trail
- ▍Priority support
- ▍90-day activity log retention
Enterprise
For regulated industries with deep compliance obligations.
Best for: Regulated industries: financial services, healthcare, public sector
Custom
contract-based, one business day response
- ▍Everything in Professional
- ▍SCIM 2.0 directory sync — automatic user provisioning and deprovisioning (Okta, Microsoft Entra ID)
- ▍Bring your own AI provider keys
- ▍Audit log CSV export for compliance reviews
- ▍Dedicated single-tenant environment with UK, EU or US data residency
- ▍SLA-backed contract with service credits
- ▍DPA and security questionnaire support
- ▍White-glove onboarding
GDPR + DPA-ready
UK GDPR, EU GDPR, EU-US Data Privacy Framework. SCCs included for cross-border transfers. DPA template available.
Evidence records
Evidence records and control-test schedules across all supported frameworks (all plans).
Local-mode AI option
Run AI inference inside your network via Ollama direct mode. Prompts never reach AirTee servers. Available on Enterprise.
Already have an account? Sign in to manage your subscription. Prefer to talk first? Request a demo.
Pricing FAQ
Pricing, billing, compliance, migration.
- How is AirTee priced?
- Monthly self-serve subscriptions. Starter is $500/month for up to 15 users and 50 incidents a month. Professional is $1,000/month for up to 50 users and 200 incidents a month, and adds multi-model AI, local AI mode and connector ingestion. Both are billed monthly via Stripe Checkout — no annual contract — and you can cancel anytime through the customer portal. Enterprise is custom and sales-led, with SCIM provisioning, a dedicated environment and an SLA-backed contract.
- Is there a free trial?
- Yes — we run a 14-day evaluation on a sandboxed tenant for qualified buyers. The sandbox includes seeded demo data so you can run a full tabletop exercise, generate AARs, and walk the GRC-A dashboard end-to-end.
- Do you offer a Data Processing Addendum (DPA)?
- Yes. Our DPA template aligns with UK GDPR, EU GDPR, and the EU-US Data Privacy Framework. SCCs are included for transfers from the UK / EEA to the US. Email hello@airtee.ai for a copy.
- Where is my data stored?
- Self-serve plans run in our US environment. UK/EU data residency requires a dedicated environment on the Enterprise plan — talk to us.
- Can we keep our AI prompts on-premises?
- Yes — Enterprise plans include local Ollama mode, where prompts run entirely against an Ollama instance on your own hardware. Prompts never transit AirTee servers.
- Which compliance frameworks does AirTee help with?
- DORA, NIS2, GDPR, SOC 2, ISO 27001, and HIPAA. Each has dedicated trackers in the GRC-A dashboard with automatic regulatory deadline clocks for incident notification windows.
- How long are incidents and audit logs retained?
- Activity logs: 30 days by default (Professional and Enterprise extend this). AI usage logs and incident records are retained for the duration of your subscription. Admin audit logs run up to 7 years on Enterprise for SOC 2 attestation purposes.
- Can I migrate from PagerDuty / ServiceNow / a custom tool?
- Yes. We support webhook ingestion from any source that can fire JSON, plus pre-built connectors for PagerDuty, Datadog, Slack, Microsoft Teams, and ServiceNow. Historical incident import via CSV or API is included with Professional and above.
- What's the SLA?
- Enterprise contracts are SLA-backed with service credits; the availability commitment is agreed in the contract. We publish a status page, and regulatory clocks tick down inside the app so you can see remaining notification windows live during an incident.
— next step
Ready to see AirTee on your data?
We'll spin up a sandbox seeded with realistic incident data and walk a tabletop exercise with your team — then you can subscribe in minutes.