Honest pricing, stated up front.

One. Every subscription starts with a single key and 100K crypto operations a month included, and that single key is what the $99 base subscription covers. Additional keys are add-ons at $12 a month each, each bundling its own 100K operations, and you add them from your console once your account is provisioned rather than choosing a quantity at checkout. A key starts billing the moment you add it, and never before.

This is the reason there are no tiers to compare: you are not picking a bundle that might fit, you are starting at one key and adding exactly what you turn out to need. The subscription block at the top of this page states what the base includes, and the cost model under it shows what an account of any shape works out to at the published rates.

Your key material never depended on us continuing to exist. Keys are generated and held as non-extractable material in AWS KMS inside a dedicated AWS account provisioned for you, which holds nothing belonging to anyone else. Our software is the managed layer on top of that account. It is not the place the keys live.

The mechanism that turns that fact into something you can act on is the Keyout, and it is a standing right rather than a favour we grant case by case. You designate an IAM role in your own separate AWS account, and that role is granted direct AWS KMS access to your keys before our managed layer is decommissioned, so cryptographic access is uninterrupted from the moment you initiate to the moment the account is transferred into your sole ownership. Your audit records come with it.

Exercising the Keyout is not contingent on us ceasing or intending to cease operations. It is available at any time during an active subscription that is valid and paid up, for any reason, and we never initiate it. The price is a published formula rather than a negotiation: see the two ways out above for the worked figure, and the Business Continuity and Keyout Policy for the three-phase hand-off and exactly what does and does not transfer.

Leaving costs nothing and you do it yourself from the account portal, whenever you want, on either term. No early-termination fee, no exit interview, no retention call, and cancelling online is no harder than signing up was. The service keeps running to the end of the billing period you have already paid for, which on an annual term means the end of the paid annual year, and you can request an export of your audit trail at any point before then. Fees already charged are not refunded - you retain access until the end of the billed period.

If you cancel without executing a Keyout, your access ends when that paid period closes and your key material is destroyed by cryptographic erasure: the KMS key is deleted, access to everything it protected is permanently severed, and the deletion is recorded in the audit log. Worth being exact about the sequence if you are planning a migration around it. Period closure is the moment access stops; the destruction completes after that rather than in the same instant, and the interval between the two is an operational tail on our side for error recovery. It is not a grace period to plan around, and it is not a second chance to exercise the Keyout, which requires a subscription that is still active and paid up. Treat the end of your paid period as the deadline, because that is what it is.

To keep your keys after you leave, execute the Keyout while the subscription is still valid: the two ways out above carries the fee formula, and the Business Continuity and Keyout Policy carries the process. Account and configuration data is purged within 90 days of closure, and financial records are kept for seven years because tax law requires it.

No, and the reason is structural rather than a policy we promise to keep. Key material is generated inside FIPS 140-3 Level 3 validated HSMs and is flagged non-extractable at creation, so no API call, no support escalation and no internal tool returns the raw private key bytes. That constraint binds you exactly as it binds us: you use a key by asking the platform to sign, verify, encrypt or decrypt with it, never by holding it.

What we can see is metadata, which is to say which key, which operation, when, and by whom, and that is precisely what your audit trail records. We do not retain the plaintext or the ciphertext of the payloads you send. What we cannot see on the security page lists this line by line, and the section above it describes how the non-extractable flag is set.

The demo is a full SanctiKey environment that we host, running the exact same software a paying customer runs, not a sandbox and not a mockup. Signing up gets you a demo account with everything an engineer or developer would actually touch: the console, the SDK, and a set of shared demo keys ready to sign, verify, encrypt and decrypt with. Two emails arrive, in this order: a console invitation carrying your sign-in URL and a temporary password, then a separate message carrying your API key, so the key never travels in the same email as your login.

What is held back is the administrative side. Demo users share one environment, so the surfaces that manage users, accounts and billing are walled off, and so are creating or deleting keys and running the certificate authority; you work against the shared demo keys that are already provisioned. That was a deliberate trade-off: you evaluate the real product, and nobody’s demo activity leaks into anybody else’s.

Your demo account is deleted 14 days after it is created, as the demo terms state. The clock starts at creation, not at first sign-in, and deletion is permanent and irreversible: the account, its keys, its configuration and its data all go, and nothing lingers. The shared environment keeps running; what is deleted is your account inside it. The demo signup asks for an email address and nothing else.

Completely understandable. When you are evaluating custody, you want to see the whole shape of it, including the parts the shared demo walls off. Reach out directly and we will schedule a walkthrough of the administrative backend on our development deployment, with room to ask anything along the way.

No, and that is deliberate. Rather than a paid plan with the meter switched off for a fortnight, the evaluation path is the free demo: no card, nothing to cancel, and no billing relationship to unwind if you decide against us. What you get is a running environment rather than a guided tour.

Paid subscriptions bill from day one and start at one key. Demo accounts do not convert in place, so subscribing provisions a fresh single-tenant AWS account for you and demo data is not migrated. That is the trade for the demo being shared: the thing you evaluate is real, and the thing you buy is yours alone.

The commitment is 99% monthly uptime, measured as ((total minutes - downtime minutes) / total minutes) x 100, which allows roughly 7.3 hours of downtime in a calendar month. Scheduled maintenance announced in advance, demo-environment interruptions, and outages caused by your own integration are excluded from the measurement.

Notification is by email to the account contact. We do not publish a status page, so email is the channel rather than a second place to check, and the SLA says so in those words instead of leaving it implied. Issues you raise go to support@sanctikey.com.

A month below 99% earns a service credit of 15% of the monthly fee. You claim it by emailing support@sanctikey.com with the subject line "SLA Credit Request: [Company Name]" within 15 calendar days of the end of the affected month; we evaluate in good faith within 15 business days and approved credits apply to your next invoice. First-response targets are 1, 2 and 3 business days by severity, and those targets are operational goals rather than binding guarantees, so they do not themselves trigger credits. All of it is written out in the service level agreement.

Card payments through Stripe, today, and that is the whole of the billing path. Checkout is a Stripe session, your card details never reach a SanctiKey server, and there is no invoice-and-net-30 lane, no purchase-order intake and no vendor portal sitting behind it. Everything after that, including cancelling, runs from your account portal.

That reflects where we are rather than a position on how you buy. If your organization cannot put a subscription on a card, or needs paperwork to exist before a payment can, reach out directly and say what your process actually requires. You will be talking to the person who would have to build the answer, not filing a ticket.