Perimetry Cloud
FRDEStart free
Product
Resources
Pricing
FrançaisDeutschSign inStart free

Pricing

Prices in euros, without VAT. Yearly billing gives two months free. Every plan runs the same checks; they differ in how many domains, how often, and how long we keep the history.

Free

€0for ever

1 domain
One audit a month

See what the outside world sees, once a month.

  • Full passive audit of one domain
  • Findings explained by AI, with the steps to fix them: 3 a month
  • Latest report online
  • DNS records ready to copy, "Check if it is fixed"
  • Each finding linked to NIS2, Cyber Essentials and ISO 27001
  • Domain expiry check
  • Inventory of hosts, addresses, ports, certificates and technologies, with a map
  • Timeline of every change: subdomains, ports, DNS, mail, certificates
  • Forgotten hosts and archived backups, your brand in other certificates
  • Secrets in public code that mentions your domain, searched every month (every week from Solo)
  • With your own Have I Been Pwned or urlscan.io key: breached addresses of your domain, pages that impersonate you
  • Uptime checks every 5 minutes, alert when the site goes down
  • 25 MB of storage for reports, files and logos
  • Certificate logs read once a day, alert on an unusual certificate
  • Public score page and badge, if you want one
  • Compared with the French communes of the same size (Perimetry Research)
  • E-mail alert on critical findings
  • A weekly summary by e-mail: what changed, what to fix first, the deadlines of the week
  • Watch 3 suppliers (public checks, alert when their score drops), found for you in your DNS
  • A deadline calendar for Google, Outlook or Apple: certificates and domains (DMARC steps and risk reviews from Solo)
  • WordPress plugin: the score in your dashboard, ownership proved by the site, what WordPress itself shows
Start for free

Solo

€19per month

or €190 per year (€15.83 a month)

Up to 5 domains
Weekly audits

For freelancers and small businesses with a few domains.

  • Everything in Free
  • Findings explained by AI, with the steps to fix them: 50 a month
  • Weekly audits, 12 months of history
  • Uptime checks every 3 minutes
  • 1 GB of storage
  • Certificate logs read every 6 hours
  • PDF reports with the site's logo
  • DMARC reports: who sends mail as you
  • TLS reports (TLS-RPT): whether mail to you arrives encrypted
  • DMARC step by step to p=reject, told when it is safe
  • Watch 10 suppliers
  • Security questionnaires for your suppliers, pre-filled with what we see: 5 a month
  • Attestations for an insurer or a NIS2 assessor, checkable online
  • Compliance view: NIS2, Cyber Essentials, ISO 27001
  • What changed since last week, every week
  • Look-alike domain watch
  • Look-alike takedown kit: evidence, abuse letters ready to send, follow-up until the site is gone
  • A public status page for your visitors, with e-mail subscriptions and feeds
  • Alerts by e-mail, webhook, Slack and Microsoft Teams
  • A risk register: accepted findings with justification, owner, review date and reminders
  • A remediation plan: findings assigned, due dates, comments, reminders, CSV and PDF export
  • Correction times against your targets, with a dated evidence log (NIS2)
  • NIS2 incident reporting: the 24-hour, 72-hour and one-month deadlines, drafts in the authority’s language
  • Answers to the security questionnaires you receive, proposed from your library and what we prove
  • A monthly page for management, approved and sealed (NIS2 Article 20)
  • Alerts within the hour when a vulnerability seen on your addresses becomes exploited (CISA and EU catalogs)
  • Import a list of domains or a CSV
  • API, GitHub Action and MCP server for Claude and other assistants: 300 calls an hour
Start with Solo

Agency

€79per month

or €790 per year (€65.83 a month)

Up to 25 domains
Daily audits

For agencies that look after client sites.

  • Everything in Solo
  • Findings explained by AI: 300 a month
  • Daily audits, 24 months of history
  • Uptime checks every minute
  • 5 GB of storage
  • Certificate logs read up to every hour
  • Client workspaces and PDF reports with your logo
  • Monthly report to each client, sent for you, in English, French or German
  • Audits on demand, as often as you need
  • Tickets in GitHub, Jira or Linear for new serious findings
  • DNS fixes applied in your Cloudflare, OVHcloud or Gandi account, with undo
  • DMARC steps applied in one click
  • Watch 50 suppliers
  • Supplier questionnaires: 30 a month, with your own questions
  • Pre-audits of prospects in your name: 30 a month, with a shared page that tells you when it is opened
  • Pre-launch checks of client sites: 30 a month, with a launch checklist and the fixes to make
  • Alerts routed per client
  • PagerDuty: critical findings and outages, resolved by themselves once fixed
  • Up to 5 team members
  • API: 1,200 calls an hour
Start with Agency

Agency Plus

€199per month

or €1,990 per year (€165.83 a month)

Up to 100 domains
Daily audits

For larger portfolios and managed service providers.

  • Everything in Agency
  • 15 GB of storage
  • Findings explained by AI: 1,000 a month
  • Unlimited team members and audit log
  • Watch 200 suppliers
  • Supplier questionnaires: 100 a month
  • Pre-audits of prospects: 100 a month
  • Pre-launch checks: 100 a month
  • API: 3,600 calls an hour
  • Priority support, same business day
Start with Agency Plus

Compare the plans

Every plan runs the same checks. They differ in how many domains, how often, how long the history is kept, and what comes around the findings.

FeatureFree€0 / monthStart FreeSolo€19 / monthStart SoloAgency€79 / monthStart AgencyAgency Plus€199 / monthStart Agency Plus
Scope
Domains1525100
AuditsMonthlyWeeklyDailyDaily
History kept30 days12 months24 months24 months
Team members115Unlimited
Audit and monitoring
Full passive audit, every checkIncludedIncludedIncludedIncluded
Inventory, map and timeline of changesIncludedIncludedIncludedIncluded
Uptime checksEvery 5 minEvery 3 minEvery minuteEvery minute
Certificate logs readOnce a dayEvery 6 hoursUp to every hourUp to every hour
Look-alike domain watchNot includedIncludedIncludedIncluded
Look-alike takedown kit: evidence, abuse letters, follow-upNot includedIncludedIncludedIncluded
Suppliers watched31050200
Supplier security questionnaires, pre-filled with what we seeNot included5 a month30 a month100 a month
Your own questionnaire (questions removed or added)Not includedNot includedIncludedIncluded
Public status pagesNot included1525
Status pages without the Perimetry nameNot includedNot includedNot includedIncluded
Reports and compliance
Findings linked to NIS2, Cyber Essentials and ISO 27001IncludedIncludedIncludedIncluded
PDF reports, compliance view, attestationsNot includedIncludedIncludedIncluded
DMARC and TLS reports, DMARC step by stepNot includedIncludedIncludedIncluded
Risk register with reviews and remindersNot includedIncludedIncludedIncluded
Comparison with peers (Perimetry Research)IncludedIncludedIncludedIncluded
Alerts and fixes
DNS records ready to copy, "Check if it is fixed"IncludedIncludedIncludedIncluded
E-mail alertsIncludedIncludedIncludedIncluded
Webhook alertsNot includedIncludedIncludedIncluded
Slack and Microsoft Teams, with rich messagesNot includedIncludedIncludedIncluded
PagerDuty: critical findings and outages, resolved by themselvesNot includedNot includedIncludedIncluded
Weekly summary by e-mailIncludedIncludedIncludedIncluded
Tickets in GitHub, Jira or LinearNot includedNot includedIncludedIncluded
DNS fixes in one click, with undoNot includedNot includedIncludedIncluded
Remediation plan: findings assigned, due dates, comments, remindersNot includedIncludedIncludedIncluded
Portfolio and agency
Import a list or a CSV of domainsNot includedIncludedIncludedIncluded
Client workspaces, your logo, monthly client reportsNot includedNot includedIncludedIncluded
Prospect pre-audits per monthNot includedNot included30100
API calls an hour: SARIF, CI, MCP serverNot included3001,2003,600

Guarantees

What we promise

The commitments of our security page and our plans, in short.

  • Passive, nothing else

    We do not scan ports, exploit vulnerabilities, guess credentials, submit forms or crawl your site. To your sites, an audit is a few ordinary requests from a crawler that names itself. Optional checks stay off unless you turn them on.

  • Nothing to install

    Nothing is installed anywhere, and we never ask for credentials. One TXT record proves that the domain is yours.

  • Hosted in the European Union

    On servers in the Netherlands, with encrypted volumes and encrypted daily backups kept in the EU. We keep no copy of your pages, only the findings.

  • Cancel at any time

    Plans are month to month, or yearly with two months free. When you cancel, the account drops to the Free plan at the end of the period and your history stays readable for 90 days.

  • Your data, to take or delete

    You can export everything as JSON at any time and delete your account yourself.

  • Open-source checks

    The same checks as the Perimetry open-source project, under the AGPL-3.0 licence: read every check and run it yourself.

Security and data, in detail

Option · coming soon

Verified active scan

When the passive audit suspects a weakness, the active scan checks it for real: with your signed authorization, our dedicated scanner tests the web applications of a proven domain with Nuclei and OWASP ZAP, signed in with a test account if you wish, and marks each suspicion confirmed or not reproduced.

  • Up to 20 hosts of the domain
  • 4 full scans a month
  • Signed-in scans (header or login form)
  • Matched with the passive audit
  • Your window, your rate, revocable at any time

From the Solo plan. Included: 1 domain on Agency, 3 on Agency Plus. Not on Free.

Coming soon

€49 a month per domain, excl. VAT

or €490 a year

Not sold yet: it opens workspace by workspace. Ask for early access and we will tell you when your workspace can use it.

Request early accessHow the active scan works →

With a human expert

For customers who want a person to look at their findings. It only ever covers domains with proven ownership.

Expert review On request
A human security engineer reviews your findings, tests the serious ones by hand and writes the remediation plan with your team.

Questions

What is the founding-customer offer?
The first 50 workspaces that subscribe to a paid plan get 30% off their subscription for life: on every renewal, including after a change of plan, for as long as the subscription stays active without interruption. The discount is applied on the payment page; the pricing page shows how many places are left. Full conditions are in section 12.6 of the terms.
Can I get a full report without subscribing?
Yes, on the Free plan: a one-off report for €49 excluding VAT, paid once, for a domain you have proven. For 30 days, that domain gets the full audit of the Solo plan (lookalike domains included), the PDF report with each fix and the NIS2 mapping, and attestations to show a client, an insurer or an auditor. If you subscribe to a paid plan within 30 days, what you paid is taken off your invoices. Full conditions are in section 12.7 of the terms.
What does "passive" mean?
We only read public information: DNS records, certificates published in Certificate Transparency logs, the pages your servers already serve to anyone, and public data sets about open ports. We never send attacks, never guess passwords and never probe paths that are not yours to expose. Your sites cannot tell a Perimetry audit from a normal visitor.
What is the verified active scan, and when can I have it?
An option that tests the web applications of a domain you have proven, with your signed authorization, to confirm or rule out what the passive audit suspects. It will cost €49 a month per domain without VAT (€490 a year), from the Solo plan; Agency includes 1 domain and Agency Plus 3. It is not sold yet: it opens workspace by workspace, and you can ask for early access now. The passive audit itself never changes: without that option, nothing is ever tested actively.
Can you apply the DNS fixes for us?
On the Agency plans, if your zones are on Cloudflare, OVHcloud or Gandi: connect a token limited to their DNS (Cloudflare: "Zone: Read" and "DNS: Edit"; OVHcloud: the /domain/zone rights; Gandi: "Manage domain name technical configurations"). On an SPF, DMARC, CAA, null MX or TLS reporting finding, "Apply in your DNS" shows exactly what changes, before and after, and makes the change only once you confirm, and only if the records concerned are still as the audit saw them (in one atomic step on Cloudflare; record by record on OVHcloud and Gandi, where a stop half-way keeps what was done undoable). Every change is logged with the value before it and can be undone. Your zones stay in your account. Records that would reject all mail for a domain stay a decision you make by hand.
Can findings become tickets in our tracker?
On the Agency plans, connect GitHub, Jira Cloud or Linear with a token that can create issues in one repository, project or team (a GitHub fine-grained token, or a dedicated account for Jira). Each new finding at or above the severity you choose becomes a ticket with the fix and a link to the report, and the ticket gets a comment (and is closed on GitHub) when an audit no longer finds the problem. You can also open a ticket for any finding from the report.
How does uptime monitoring work?
Once a domain is verified, we request its home page (or the address you choose, on the domain or one of its subdomains) every 5 minutes on Free, every 3 minutes on Solo and every minute on Agency. A site is down when it fails twice in a row: no answer within 10 seconds, a name that does not resolve, a refused connection, a certificate error, or a server error (5xx). You then get an alert, and another when it answers again. Each domain page shows its uptime over 24 hours, 7 and 30 days, its response time and its incidents. You can turn it off per domain.
How do you check that a domain is mine?
You add one TXT record to the DNS zone of the domain. We check it before the first audit and keep checking it. Without that record, a domain stays in read-only preview and no alert is sent.
Does this make us NIS2, Cyber Essentials or ISO 27001 compliant?
No tool can, and we do not claim to. Each finding shows the requirements it relates to, and the compliance view (from the Solo plan) lists every requirement with the findings that concern it, which helps prepare an assessment. An outside audit sees only part of what each requirement asks for: nothing about your policies, your staff or your internal systems.
Can I cancel at any time?
Yes. Plans are month to month, or yearly with two months free. When you cancel, the account drops to the Free plan at the end of the period and your history stays readable for 90 days.
Are prices including VAT?
Prices are shown without VAT. VAT is added at checkout according to your country when it applies. Businesses in the EU with a valid VAT number are invoiced under the reverse-charge rule.
Is the scanner open source?
Yes. Perimetry Cloud runs the same checks as the Perimetry open-source project, published under the AGPL-3.0 licence. You can run it yourself, read every check, and compare its output with ours.
Where is my data stored?
In the European Union. Reports, history and account data are stored encrypted on servers in the Netherlands, behind Cloudflare. We keep no copy of your pages, only the findings.