ir.mlab.sh
Simple, transparent pricing
Start free. Scale when you need to. No surprises.
Free
For individual analysts and small evaluations.
0€
/ month
forever free
- 3 users
- 10 alerts / month
- 5 cases / month
- 50 observables / month
- Community support
Lite
For small teams needing core IR capabilities.
€49
/ month
excl. VAT
- 10 users
- 200 alerts / month
- 50 cases / month
- 500 observables / month
- Email support
Most Popular
Company
Full-featured IR for mid-size security teams.
€149
/ month
excl. VAT
- 50 users
- 3,000 alerts / month
- 500 cases / month
- 5,000 observables / month
- Priority email support
Corporate
Unlimited access for large security operations.
Custom
tailored to your needs
- Unlimited users
- Unlimited alerts
- Unlimited cases
- Unlimited observables
- Priority support & SLA
- Custom integrations
- Dedicated account manager
All plans include
Self-hosted
Your infrastructure
RBAC
Role-based access
Timeline
Full audit trail
API
REST API access
Updates
Free upgrades
48h Grace
License resilience
Frequently asked questions
Can I try before I buy?
Yes. The Free tier is fully functional with no time limit. Deploy it, test it, and upgrade when you're ready.
How do I upgrade?
Contact us at [email protected]. We'll update your license tier — no reinstallation needed, the change applies within the hour.
What if mlab.sh goes down?
A 48-hour grace period keeps your platform running if the license server is unreachable. Your data is always on your infrastructure.
Where is my data stored?
100% on your infrastructure. ir.mlab.sh is self-hosted. We never access, store or process your incident data.
Not sure which plan?
Let's talk. We'll help you find the right fit for your team and budget.