Three tiers · billed monthly · cancel anytime

One product, three tiers.

Start free — no card required

Free for the first repo. No card to start.

Connect GitHub, get a draft PR within five minutes. Upgrade only when you're ready — one repo stays free forever.

Evaluate with your team

Leave a work email for the first-repo setup notes and early access updates.

Ready to start? Use GitHub

1 included private repo · continuous dependency watch · draft PRs

All tiers ship with SOC 2 / NIS2 / CRA evidence-ready audit trails, the same triage loop, and the same test-gated review handoff. Higher plans widen what the agent prepares for review — and how quickly it opens a tested fix PR. Bivouac produces the evidence; the certifications are your team's.

1 active repo · no card required

For solo maintainers and small teams proving the loop on one repo.

$0
free
1 included private repo · free forever for your first repo · no card required
  • Continuous dependency watch
    GitHub repo + lockfile scan against public advisory feeds every five minutes.
  • Manual patch PRs
    Agent opens a draft PR with the chosen SemVer bump and rationale. You review and decide whether to merge — the connected product waits for your approval.
  • Standard SLA
    Goal times from disclosure to fix-attempted, broken down by severity.

25 included private repos · private advisory feeds

25 included private repos — private feeds, autonomous investigation and testing with one-click human merge, multi-repo policy packs.

$399
/ month
25 included private repos · billed monthly · includes 25 private repos
  • Continuous dependency watch
    GitHub repo + lockfile scan against public AND private advisory feeds every five minutes.
  • Tested patch PRs
    Tested patch
    Agent opens and tests the patch PR for routine surfaces your policy pack classifies; the tested PR is prepared for review and waits for a human to approve and merge it.
  • Downgrade-as-fix
    Downgrade-as-fix
    On a regression or breaking upstream cut, the agent may downgrade or pin instead of forward-fixing — chosen locally, tested, and left for human approval without paging the on-call.
  • Multi-repo policy packs
    Shared guardrails and severity rules across every repo in the org, surfaced in the audit log for evidence.
  • Compress SLA
    Goal times drop on critical severity. Pages only on contested license or security-sensitive surfaces.

Unlimited repos · dedicated on-call routing

For regulated organizations with unlimited repos and dedicated on-call routing.

Custom
volume pricing
Unlimited repos · Custom · volume pricing · billed monthly
Talk to salesSecurity
  • Continuous dependency watch
    Private feeds, supply-chain provenance scoring, and registry-level disclosures before your scanner catches up.
  • Expanded patch review
    Tested patch
    Widened review scope with per-repo overrides, captured in the audit log for evidence; tested PRs remain prepared for human review and merge execution is disabled today.
  • Downgrade-as-fix
    Downgrade-as-fix
    Forward fix, downgrade, or pin — chosen by Bivouac on your policy. Regression-class fixes still open a tested PR for human approval.
  • Multi-repo policy packs
    Org-wide guardrails, severity rules, and on-call routing rules. Every widening is opt-in and recorded.
  • SBOM provenance
    Exportable attestation logs aligned with SOC 2, NIS2, and EU Cyber Resilience Act evidence requests — to support your SOC 2, NIS2, and EU CRA evidence workflows, not a Bivouac certification.

Side-by-side

What each tier actually unlocks.

The same row reads across the three tiers — pick the row, compare the cells. Numbers reflect what ships on day one; the headline price is what Stripe Checkout charges, not a per-repo curve.

CapabilityFreeTeamEnterprise
Monthly price$0 / month$399 / monthCustom
Included private repos125Unlimited
Parallel CVE triage1 in flight5 in flight25 in flight
Parallel-fix concurrency1 in flight3 in flight15 in flight
Audit retention30 days180 days730 days
On-call pagingNoneBusiness hours24/7 dedicated
SAML / SCIMNot availableSAMLSAML + SCIM
Tested patch preparationTested PR; human review + mergeRoutine surfaces tested; human review + mergeExpanded scope; per-repo human review + merge policy
Breaking-change handlingChosen SemVer bump; human review + mergeDowngrade or pin after regression; human review + mergeForward fix, downgrade, or pin by policy; human review + merge
Self-hosted fallbackSeparate self-hosted runner waitlistSeparate self-hosted runner waitlistSelf-hosted runner pilot for regulated / air-gapped repos

Billing, caps, and cycle mechanics

Four pricing questions, answered plainly.

Clear details on the free repo, active repo limits, plan changes, and Enterprise terms — so you know what happens before you upgrade.