Pricing

Honest pricing, stated up front.

One product in a fully isolated AWS account: same features, same FIPS 140-3 Level 3 validated HSMs, same isolation, for every account. You pay for exactly what you run: no tiers, no rounding up to the next bracket, no setup or account fees.

What $49 a month buys, before you count a single operation.

Keys and operations are how we count, but they’re not what you’re buying. Everything below ships in the base subscription, for every account, at every size, from day one.

One scope note before the list, since it changes how you’ll integrate: what we ship is the certificate authority itself, not an enrollment ecosystem, so you won’t find ACME, SCEP, EST or a renewal agent here. Renewal automation is your pipeline’s job. Signing, revocation, and revocation truth are ours.

An account with one tenant

Your keys, IAM, quotas, identity pool and audit table live in an AWS account that holds nothing of anyone else’s. Keys are generated inside FIPS 140-3 Level 3 validated HSMs and are non-extractable.

Partitions with group-scoped access

Named compartments for your keys, each backed by its own access group and its own audit trail. A user sees only the partitions they belong to, so payments-prod and ci-signing stay separated.

A certificate authority hierarchy

Roots, intermediates, chaining, CSR import and signing into external chains, issuance and revocation, with public CRL and OCSP endpoints so relying parties can check revocation. Not an add-on and not priced per CA. No enrollment protocols: you drive it from the REST API and the console.

Per-operation audit trail, exportable

Every operation writes a tamper-evident record you can export to your SIEM or hand to an assessor. A gap in the trail raises an alarm rather than passing quietly.

Enforced key lifecycle

Rotation is switched on at creation or the key is deleted and creation fails. A non-rotating key cannot quietly exist in your account.

Console, REST API and the Keyout right

A purpose-built console for people who do not live in the AWS console, one REST API for everything, and a standing published-fee right to take the account and own it outright.

How we count what you use.

Line item	What it includes	Per month	Per year (1 mo free)
Base subscription	Dedicated AWS account, first key, 100K crypto ops/mo, console, audit trail	$49	$539
Additional key	Each bundles its own 100K ops/mo	$12	$132
Extra operations	Per prepaid 100K block, beyond your keys’ bundles	$5	$55
Setup, support, account fees	There are none	$0	$0

Sign/verify count as 2 ops; symmetric operations count as 1. Optional add-ons (regions, DR) are listed below; the estimator at the bottom builds your exact bill.

Three steps, fully self-serve

Verify your email, check out with Stripe. Card data never touches SanctiKey infrastructure.

We forge your vault

A dedicated AWS account is provisioned automatically: HSM-backed keys, API endpoints, audit trail.

Call the API

Sign, verify, encrypt and issue certificates over authenticated HTTPS. No tickets, no onboarding calls.

Optional add-ons, when you need them

Enabled from your console after signup, never charged before. Mid-cycle additions are prorated: you pay for the remainder of the current period at the moment you add them, then they join your regular bill.

Additional key (bundles its own 100K ops/mo): $12/mo
Extra operations, per 100K block: $5/mo
Served region (live stack in a second region): $75/region/mo
Key placed in a region (own 100K ops there): $12/key/mo
Failover protection / DR (DNS health-check): $49/protected region/mo

Relocation (moving a key to a new region) is just the served-region fee; the key exists in one place, so no placement fee. Placed keys are active everywhere they live, not cold standbys.

Growing past 50 keys? Volume Pricing is a direct quote keyed to usage; accounts that grew with us are quoted more favorably than net-new volume entrants.

Two ways out. Neither requires our permission.

Way out 1 · costs nothing

Cancel and walk

You cancel yourself from the account portal whenever you want, cancelling online isn’t any harder than signing up was, and neither term carries an early-termination fee. The service keeps running to the end of the period you’ve already paid for, and you can ask for your audit trail at any point before then.

Once the account closes, key material is destroyed by cryptographic erasure, meaning the KMS key is deleted, access to everything it protected is permanently severed, and the deletion event lands in the audit log as the record that it happened. Account and configuration data gets purged within 90 days of closure, and financial records stick around for seven years because tax law says they have to. There’s no exit interview and no retention call.

Both commitments are written down where you can check them: cancellation terms and the retention schedule.

Way out 2 · the Keyout, a purchase

Take the whole account with you

Here you’re buying an AWS account and the infrastructure provisioned inside it, so your KMS keys come across intact and operational along with your audit table, and the account is ejected from our Organization into your sole ownership. It’s yours alone to invoke while your subscription is valid and paid up, and we never initiate it.

price = max($1,000, 24 × trailing-12-month average monthly bill)

Avg $49/mo (1 key, steady): $1,176
Avg $157/mo (10 keys): $3,768
Avg $637/mo (50 keys): $15,288

The Keyout price is a published formula, not a negotiation, and it is derived from historical billing rather than your key count on the day you leave, so it can’t be gamed by deleting keys right before exit. Full terms, the three-phase hand-off and exactly what does and does not transfer: Business Continuity and Keyout Policy.

The fine print, in normal type

Evaluating first? The shared demo environment lets you explore the console and run real operations before you buy; demo accounts delete automatically after 14 days. Paid subscriptions start with a single key, billed from day one. Add more keys from your console at any time.
When you grow: keys and ops scale continuously : your bill is computed directly from what you run, never rounded up to a bracket. At a crypto-ops limit, operations return 429 until you add a prepaid block or your cycle resets, but listing, describing, and managing your keys is never blocked.
Partitions: named compartments for your keys inside your account, each backed by its own access group. A user can only see and use keys in partitions they are a member of, so teams and workloads (say, payments-prod vs ci-signing) stay separated with their own audit trail. Every account starts with a default partition.
Account ownership: the AWS account is SanctiKey-owned and operated inside our Organization; you are its only tenant. Ownership transfers to you whenever you exercise the Keyout above.
Billing: handled entirely by Stripe. Your card details never reach a SanctiKey server; see payment security.

Worked examples

Starter

$49/mo

$539/yr annual

1 key, bundled ops

Growing team

$157/mo

$1727/yr annual

10 keys, 1M bundled ops

Heavy signer

$182/mo

$2002/yr annual

10 keys + 500K extra ops

Build your price

Keys

Each key bundles 100K crypto ops/mo.

Extra 100K-ops blocks

Beyond what your keys bundle. Sold per 100K block, no separate overage SKU.

Base (1 key, 100K ops): $49
+ 2 extra keys × $12: $24
+ 0 ops blocks × $5: $0

$73/mo

or $803/yr billed annually (1 month free)

Start now

No setup fees. Cancel anytime. Annual terms run to the end of what you paid for.