Four plans · billed per active repo · cancel anytime

Four plans, billed per active repo.

Start free — no card required

Free for the first repo. No card to start.

Connect GitHub, get a draft PR within five minutes. Upgrade only when you're ready — one repo stays free forever.

Start with your first repo

1 active repo · continuous dependency watch · draft PRs

All tiers ship with SOC 2 / NIS2 / CRA evidence-ready audit trails, the same triage loop, and the same test-gated auto-merge guardrails. Higher plans widen what the agent handles autonomously — and how fast it commits a fix. Bivouac produces the evidence; the certifications are your team's.

1 active repo · no card required

$0 free
1 active repo · free forever for your first repo · no card required
  • Continuous dependency watch
    GitHub repo + lockfile scan against public advisory feeds every five minutes.
  • Manual patch PRs
    Agent opens a draft PR with the chosen SemVer bump and rationale. You review and merge on your terms — no auto-merge scope on Free.
  • Standard SLA
    Goal times from disclosure to fix-attempted, broken down by severity.

Up to 5 active repos

$19
/ active repo / month
5 active repos · billed monthly per active repository
  • Continuous dependency watch
    GitHub repo + lockfile scan against public advisory feeds every five minutes.
  • Forward-fix patch PRs
    Agent opens a draft PR with the chosen SemVer bump, rationale, and pre-pinned references.
  • Test-suite gate
    Project test suite runs on a clean checkout. Red blocks the merge — every widening of the auto-merge scope is opt-in per repo.
  • Standard SLA
    Goal times from disclosure to fix-attempted, broken down by severity. Pages the on-call rotation on contested decisions.

Up to 25 active repos · private advisory feeds

$39
/ active repo / month
25 active repos · billed monthly per active repository
  • Continuous dependency watch
    GitHub repo + lockfile scan against public AND private advisory feeds every five minutes.
  • Autonomous patch-and-merge
    Autonomous patch
    Agent opens, tests, and merges the patch PR unattended for surfaces your policy pack classifies as routine.
  • Downgrade-as-fix
    Downgrade-as-fix
    On a regression or breaking upstream cut, the agent may downgrade or pin instead of forward-fixing — chosen locally, tested, and merged without paging the on-call.
  • Multi-repo policy packs
    Shared guardrails and severity rules across every repo in the org, surfaced in the audit log for evidence.
  • Compress SLA
    Goal times drop on critical severity. Pages only on contested license or security-sensitive surfaces.

SLA add-ons

+24h critical SLA
+business-hours paging

Unlimited repos · dedicated routing

$99
/ active repo / month
Unlimited repos · volume pricing · billed monthly per active repository
  • Continuous dependency watch
    Private feeds, supply-chain provenance scoring, and registry-level disclosures before your scanner catches up.
  • Autonomous patch-and-merge
    Autonomous patch
    Widened auto-merge scope with per-repo overrides, captured in the audit log for evidence.
  • Downgrade-as-fix
    Downgrade-as-fix
    Forward fix, downgrade, or pin — chosen by Bivouac on your policy. Regression-class fixes go straight to merge.
  • Multi-repo policy packs
    Org-wide guardrails, severity rules, and on-call routing rules. Every widening is opt-in and recorded.
  • SBOM provenance
    Exportable attestation logs aligned with SOC 2, NIS2, and EU Cyber Resilience Act evidence requests — to support your SOC 2, NIS2, and EU CRA evidence workflows, not a Bivouac certification.

SLA add-ons

+4h critical SLA
24/7 paging
Dedicated on-call routing

Usage-based add-ons

SLA add-ons

Pair any tier with an SLA upgrade. Each add-on bills on its own usage curve — pricing finalised once customer contracts are in flight.

SLA add-on

24h mean-time-to-PR
Mean-time-to-PR clock drops to 24 hours for critical-severity disclosures across every active repo.
PricingUsage-based · pricing TBD

SLA add-on

4h on-call paging
Bivouac pages the right rotation within four hours of a contested decision, 24/7.
PricingUsage-based · pricing TBD

SLA add-on

Dedicated compliance contact
A named point of contact for SOC 2 / NIS2 / CRA evidence requests, with quarterly review.
PricingPer-account · pricing TBD

Billing, caps, and cycle mechanics

Six questions a buyer should be able to answer before they upgrade.

Plain-language answers about plan changes, what each tier actually unlocks, the monthly cycle, what counts as an active repo, what happens past the cap, and how refunds and downgrades are credited. If something’s missing, ping us — we read every message.