Three keeps, one price to compare
Compare plans
Pick how you want to run VaultGuard. Self host the source available Community edition on your own AWS for free, or let us run it for you on VaultGuard Cloud. Every plan ships with the same encryption, per file permissions, and bounded revocation controls. Security is never behind a paywall.
Plans at a glance
Scroll the table to compare all three plans.
| Capability | CommunitySelf host, free | ProCloud, Pro Edition | EnterpriseCloud, Pro Edition, single sign on |
|---|---|---|---|
| Price | Free, self host | €12 per user monthly, or €9 per user per month billed yearly | Custom |
| Where it runs | Your own AWS | Our AWS (managed) | Dedicated infrastructure |
| License | Sustainable Use License | Cloud terms of service | Commercial contract |
| User cap | Up to 100 | Up to 100 | Custom, beyond 100 |
| Storage | Limited by your AWS | 100 GB included | 1 TB |
| Trial | Clone and deploy | 14-day trial, payment method required | Sales call |
Security you get on every plan
The same encryption, access controls, and revocation boundaries, whether you self host or let us run it.
Scroll the table to compare all three plans.
| Capability | CommunitySelf host, free | ProCloud, Pro Edition | EnterpriseCloud, Pro Edition, single sign on |
|---|---|---|---|
| Encryption at rest and in transit (AES 256 GCM, keys in AWS KMS) | |||
| Per file permissions with role inheritance | |||
| Visual permission graph and in Obsidian access management | |||
| Server access revocation and bounded device key leases | |||
| Time bound key leases (one hour default, configurable) | |||
| Multi vault support per organization | |||
| Plugin allowlist enforcement | |||
| Cognito auth (federate to your identity provider) | |||
| Local at rest encryption via OS keychain | |||
| TLS 1.2+ in transit |
AI in your vault
Use AI on your notes through the same encryption, permissions, and audit gates, on every plan.
Scroll the table to compare all three plans.
| Capability | CommunitySelf host, free | ProCloud, Pro Edition | EnterpriseCloud, Pro Edition, single sign on |
|---|---|---|---|
| Built in Claude chat panel (bring your own Anthropic key or Claude subscription) | |||
| AI agent bridge: a scoped MCP server for Claude Code, Cursor, or Claudian | |||
| AI file access through the bridge is permission checked and audited |
Running it day to day
What you get back when we run the infrastructure for you.
Scroll the table to compare all three plans.
| Capability | CommunitySelf host, free | ProCloud, Pro Edition | EnterpriseCloud, Pro Edition, single sign on |
|---|---|---|---|
| In Obsidian admin (users, permissions, settings, recovery) | |||
| Hosted web admin panel (admin.vaultguard.cloud) | |||
| Share links: send a teammate a clickable link to a specific file | |||
| Basic audit log | |||
| Advanced audit: dashboards, alerts, CSV export, per user and per file reports | |||
| Audit retention | 30 days (configurable) | 1 year | Custom |
| Stripe backed billing | |||
| Transactional email (invites, password reset) | Your SES | Managed | Managed |
| Org signup | Single tenant lockdown | Multi tenant | Custom |
| Managed AWS infrastructure | |||
| Managed security update process | |||
| Managed backup operations | |||
| Uptime target | None | 99.9 percent target | Custom by agreement |
| Support target | Community (GitHub) | Email, one business day target | Priority by agreement |
Enterprise only
Scroll the table to compare all three plans.
| Capability | CommunitySelf host, free | ProCloud, Pro Edition | EnterpriseCloud, Pro Edition, single sign on |
|---|---|---|---|
| SAML and OIDC single sign on | |||
| Security documentation for review | Public documentation | Public documentation | Discuss requirements |
| Dedicated infrastructure | |||
| Custom data residency | |||
| Custom key rotation and retention policies |
Who handles what
What stays on your plate if you self host, and what we take off it on Cloud.
Scroll the table to compare all three plans.
| Capability | CommunitySelf host, free | ProCloud, Pro Edition | EnterpriseCloud, Pro Edition, single sign on |
|---|---|---|---|
| Deploy the backend | You (terraform apply) | Us | Us, or you with a license |
| Patch Lambda runtimes and dependencies | You | Us | Us |
| Rotate KMS keys | You | Us | Us or custom |
| Run backups | You | Us | Us |
| Monitor uptime and page on call | You | Us | Us |
| Pay the AWS bill | You | Included | Custom |
| Compliance assessment and acceptance | Your organization | Your organization | Your organization |
Which plan fits you?
Pro starts with a 14-day trial. A payment method is required.
For most teams, Pro is the best place to start. You get the full security stack, admin panel, user permissions, secure note sharing, readable audit trails, managed backup operations, and a 99.9 percent uptime target, without managing AWS yourself.
Start free and see it for yourself
Choose Community only if you are a solo user or a technical team that wants to self host and manage AWS, backups, patches, and uptime yourself.
Choose Enterprise if you need single sign on or dedicated infrastructure.
What you get if you self host
- The same encryption, per file permissions, and bounded revocation controls as Pro
- Your data stays in your own AWS account
- The same plugin connects automatically, no special build
- Deploy with the documented Terraform runbook; the infrastructure source is available for review
- Cost: just your AWS bill
- You are the on call: patching Lambda runtimes, rotating KMS keys, running backups, and monitoring uptime is on you
What is not included when you self host
- No web admin panel. Every user invite, permission change, and recovery flow happens inside Obsidian, which gets painful past a handful of users
- No share links. Teammates cannot get a one click link to a specific note, they navigate the folder tree themselves
- No audit dashboards, alerts, or CSV exports when your compliance team asks for an audit trail
- No managed uptime commitment, backup operations, or patch pipeline. AWS deprecations and incident response land on you
- Single sign on is available only on Enterprise