One plan. Everything in it.
You are buying a reporting deadline, and a deadline does not come in sizes. There is no tier that leaves you short of evidence on the day you need it.
£249/mo equivalent · billed annually
For a UK customer at the current standard rate of 20%, that is £3,585.60 per year.
Locked for life. List pricing from £3,600/yr at launch.
£0 charged today. Your card is then charged £2,988 plus VAT once on 1 November 2026, and annually thereafter, unless you cancel before then. Prices exclude VAT, which is added at the applicable rate where chargeable. Card capture is handled securely by Stripe. See the subscription terms.
What's included
All of it. There is nothing held back for a higher tier.
CRA Article 14
- Out-of-band alerts within about an hour of a dependency becoming actively exploited
- On by default — email your owners and admins, no configuration
- Medium and Low findings batched into one daily digest
- Exploitation detection across your dependency tree
- Timestamped, tamper-evident awareness record
- CycloneDX SBOM per product release
- Reportable vs Track classification
- 24h / 72h / 14-day reporting clocks
- Submission-ready packs in the ENISA field order
Supply chain
- Compromise intelligence across 8+ feeds
- Maintainer takeover and typosquatting alerts
- Dependency drift and abandonment detection
- Health scoring with a full evidence trail
- Blast-radius analysis across your apps
- Post-quantum readiness scanner
Platform
- Unlimited repositories
- All ecosystems — npm, NuGet, PyPI, Maven, Go, Cargo, Docker and more
- CI/CD gates and pull-request checks
- Policy engine with configurable scoring weights
- Slack, Teams, Jira and Linear integration
- Full API access and webhooks
Larger organisation?
SAML SSO, SCIM provisioning, a dedicated data region, private deployment, custom policies, or purchase-order invoicing — those are agreed with you rather than published as a tier, because a number set in advance rarely fits.
Frequently asked questions
Why is there only one plan?
Because the thing people are buying is a reporting deadline, and a deadline does not come in sizes. Splitting evidence generation across tiers would mean selling someone a plan that leaves them exposed on the duty they bought the product for. Everything is in the one plan, including unlimited repositories.
What exactly gets charged, and when?
Nothing today. Reserving a founding place captures your card at £0. The first charge is £2,988 plus VAT on 1 November 2026, taken as a single annual payment rather than monthly, and it recurs annually after that. For a UK customer at the current standard rate of 20%, that is £3,585.60 per year. You can cancel any time before the first charge and you will not be billed.
What does “locked for life” mean?
The founding rate stays at £2,988/year plus VAT for as long as you keep the subscription running continuously, even after list pricing rises to £3,600/yr at launch. It is limited to 25 places.
Is VAT included in the price?
No. £2,988 is the price excluding VAT, which is added at the applicable rate where chargeable. For a UK customer at the current standard rate of 20%, that is £3,585.60 per year. Your invoice will show the net amount, the VAT, and the total.
Where are the full subscription terms?
On the Article 14 Signal site, at article14.fortitude-omnis.group/terms/ — that is where the subscription is taken out, so that is where the contract lives. It covers the annual term, automatic renewal and the notice we give, how to cancel, and refunds.
Does this make us CRA compliant?
No tool can. OSPulse provides detection, evidence and drafts — the inventory, the awareness record, the clocks, and a submission-ready pack. Your team, and for many firms your counsel, makes the compliance decisions and files the report. ENISA provides no API, so submission is manual.
We have SAML, data-residency or invoicing requirements. What then?
Talk to us. Those are handled as part of a conversation rather than a published tier — we would rather agree the specifics with you than publish a number that turns out not to fit.
Start with your own exposure.
See which of your dependencies would start an Article 14 clock before you decide anything. Free, nothing to install, nothing stored.
Fortitude Omnis Group Ltd, company number 16862154, registered in England & Wales. Registered office: Office 20228, 182-184 High Street North, East Ham, London, E6 2JA.