Priced per endpoint, not per promise.
Every plan includes the full detection engine, automated response, the geo threat map, the audit log and GDPR self-service. Higher plans add scale, integrations and retention — never the detection itself.
What you are signing up to: a 14-day trial with no card, then a monthly subscription that renews automatically at the price shown per enrolled device until you cancel. Your subscription covers the number of devices set on it; if you enrol more, ask us and we will add them — you are never charged for devices you have not enrolled. Cancel yourself at any time in the billing portal; it takes effect at the end of the month you have already paid for. The price shown is the total you pay: any VAT or sales tax that applies is included in it, calculated and remitted by Stripe, and itemised on your Stripe receipt. Full detail in refunds & cancellation.
Essentials
- ✓ Full behavioral detection and automated response
- ✓ Geo threat map and detection feed
- ✓ Ransomware canaries (placed via the API)
- ✓ Email alerts
- ✓ 14 days of history
Business
- ✓ Everything in Essentials
- ✓ Vulnerability scanning
- ✓ Threat hunting over your own telemetry (API)
- ✓ Your own detection rules
- ✓ Phishing simulations
- ✓ Webhooks and REST API
- ✓ 90 days of history
Plus
- ✓ Everything in Business
- ✓ Single sign-on (OIDC)
- ✓ Microsoft 365 identity protection
- ✓ PSA ticketing (Halo, ConnectWise, Autotask)
- ✓ 365 days of history
- ✓ Support through the contact form and in-console tickets
For MSPs
- ✓ A separate workspace per customer
- ✓ Per-workspace branding
- ✓ Volume pricing by agreement
WatchTower is software, not a managed monitoring service: there is no 24/7 security operations centre.
Contact salesWhat is not charged extra
- Every detection rule and every response action
- Exporting your own data, in any format
- Additional users on the console
- Connecting your own AI provider
- Support during the trial
What you may pay someone else for
- Your AI provider's usage, if you connect one — billed by them, not by us
- Threat-intel lookups on your own VirusTotal or AbuseIPDB keys
We would rather tell you this here than in an invoice.
Pricing questions
What counts as a device?
Anything with the agent installed and enrolled. Servers and workstations count the same. Your subscription covers a set number of devices. Enrolling more does not change it by itself: tell us and we will adjust it, and you are never charged for devices you have not enrolled. To pay for fewer, remove the devices and tell us, and we bring it down at your next renewal. A device you remove stops counting towards your plan's device limit straight away.
Do I pay during the trial?
No. You do not need a card to start. If you choose a plan during the trial, your card is taken at checkout but not charged until the trial ends; after that you are charged monthly until you cancel. Changing plan in the billing portal during a trial does not end the trial early. The Stripe page counts the whole days still left in your trial, so choosing a plan on day two shows twelve free days, not fourteen — the trial always ends fourteen days after you signed up, whenever you pick the plan. If you do not choose a plan, the console becomes read-only at the end of fourteen days and nothing is charged — we will email you before that happens.
Can I cancel?
Yes, at any time in the billing portal. Cancellation takes effect at the end of the month you have paid for. See the refunds & cancellation policy.
Can I self-host?
By agreement. The server is a single Python application with SQLite or PostgreSQL behind it; contact us to discuss a self-hosted licence.
What happens to my data if I cancel?
Export everything as a workbook first. On request we delete your workspace and confirm in writing; see the data processing terms for timings.