# NDR pricing: Free, Solo, Starter, Pro, Business

> Free €0 · Solo €19 · Starter €49 · Pro €99 · Business €249 · Enterprise from €999 per month. Annual billing: two months free. Data kept in the EU.

Source page: https://netsenx.com/en/pricing

From 3 devices to unlimited. Every plan ships with the NetSenX Math Guarantee (a split-conformal false-positive bound, reported at the level your own calibration data supports), EU data residency, and signed releases. Seats from 1 on Free to unlimited on Enterprise, no telemetry tax.

Annual billing = two months free. Cancel anytime. Prices exclude VAT.

## Plans and published prices

| Plan | Devices | Alert history | Price per month |
|---|---|---|---|
| Free | 3 | 30 days | €0 |
| Solo | 1 | 60 days | €19 |
| Starter | 10 | 60 days | €49 |
| Pro | 25 | 90 days | €99 |
| Business | 100 | 365 days | €249 |
| Enterprise | Unlimited | Unlimited | from €999 |

A device is a host running the NetSenX agent. One agent on a SPAN or TAP port monitors a whole network segment and counts as one device.

## Which plan covers what you need?

Enter how you will watch the network and tick what you need. The smallest plan that covers all of it is highlighted. Every value comes from the same plan catalog as the table above.

A device is a host running the NetSenX agent. One agent on a SPAN or TAP port monitors a whole network segment and counts as one device.

- DNS tunnelling detection: data hidden inside DNS queries (from Free)
- PDF reports for auditors and management (from Solo)
- TLS handshake fingerprinting, with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor (from Solo)
- OT and industrial protocols (Modbus/TCP, S7comm and others) (from Pro)
- Shadow AI: traffic from your devices to AI services (from Pro)
- Post-quantum and SSH inventory (NQCI): active from Professional with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor; the basic macOS mode does not see handshakes (from Pro)
- REST API access (from Pro)
- Alerts to Slack or a webhook (from Pro)
- SIEM export (from Business)
- White label under your own brand (from Enterprise)
- On-premises installation (from Enterprise)

| Feature | Free | Solo | Starter | Pro | Business | Enterprise |
|---|---|---|---|---|---|---|
| Price per month | €0 | €19 | €49 | €99 | €249 | from €999 |
| Devices | 3 | 1 | 10 | 25 | 100 | Unlimited |
| Users | 1 | 1 | 5 | 15 | 50 | Unlimited |
| Alert history | 30 days | 60 days | 60 days | 90 days | 365 days | Unlimited |
| DNS tunnelling detection: data hidden inside DNS queries | Included | Included | Included | Included | Included | Included |
| PDF reports for auditors and management | Not included | Included | Included | Included | Included | Included |
| TLS handshake fingerprinting, with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor | Not included | Included | Included | Included | Included | Included |
| OT and industrial protocols (Modbus/TCP, S7comm and others) | Not included | Not included | Not included | Included | Included | Included |
| Shadow AI: traffic from your devices to AI services | Not included | Not included | Not included | Included | Included | Included |
| Post-quantum and SSH inventory (NQCI): active from Professional with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor; the basic macOS mode does not see handshakes | Not included | Not included | Not included | Included | Included | Included |
| REST API access | Not included | Not included | Not included | Included | Included | Included |
| Alerts to Slack or a webhook | Not included | Not included | Not included | Included | Included | Included |
| SIEM export | Not included | Not included | Not included | Not included | Included | Included |
| White label under your own brand | Not included | Not included | Not included | Not included | Not included | Included |
| On-premises installation | Not included | Not included | Not included | Not included | Not included | Included |

## The evidence that will exist after an incident

Insurers, authorities and auditors ask for records after an incident, and the records have to exist before it. Pick who asks and a plan: the list shows what NetSenX keeps, how far back it goes, and what has to come from elsewhere.

- **Your cyber insurer:** An insurer handling a claim wants to know when the incident started, which systems it touched and what you did about it, with times.
- **The NIS2 authority or CSIRT:** The CSIRT or competent authority wants the reports on time and the facts behind them: what happened, when you became aware and what the impact was.
- **The data protection authority:** The supervisory authority wants to know whether personal data was affected, how many people, and what you did, within 72 hours of becoming aware.
- **A customer's auditor:** A customer's auditor wants to see that monitoring runs, that alerts are reviewed and that decisions are recorded.
- **A buyer in due diligence:** A buyer wants a record of incidents and how they were handled, over a period long enough to judge.

| Record | Provided by | Free | Solo | Starter | Pro | Business | Enterprise |
|---|---|---|---|---|---|---|---|
| Alert timeline: what was seen, on which host, when | NetSenX | 30 days | 60 days | 60 days | 90 days | 365 days | Unlimited |
| Audit log: alerts, analyst decisions and configuration changes | NetSenX | 90 days | 180 days | 180 days | 365 days | 730 days | 1095 days |
| NIS2 incident deadlines tracked | NetSenX | Included | Included | Included | Included | Included | Included |
| GDPR Article 33 breach notification draft for your DPO | NetSenX | from Starter | Included | Included | Included | Included | Included |
| Network map: devices seen on monitored segments | NetSenX | Included | Included | Included | Included | Included | Included |
| PDF report of the incident | NetSenX | from Starter | Included | Included | Included | Included | Included |
| What ran on each computer: processes and files | your endpoint protection (EDR) | — | — | — | — | — | — |
| Sign-ins and password use | your identity provider and VPN logs | — | — | — | — | — | — |
| Backup and restore records | your backup system | — | — | — | — | — | — |
| E-mail headers and content | your mail system | — | — | — | — | — | — |

Records a network sensor does not produce stay in the list on purpose: an evidence pack is only as complete as its weakest source. Retention values come from the plan catalog; the audit-log value is the plan's default.

## Frequently asked questions

### Do I need to install anything?

You choose the deployment: a single SPAN/TAP port on your switch watches a whole network segment and counts as one device, or install the NetSenX agent on the specific hosts you choose. Both are documented; no kernel modules. On Linux the installer only installs a package whose signature matches the NetSenX release key, and refuses anything else; macOS agents are set up together with NetSenX support.

### Where is my data stored?

Customer telemetry and alerts are stored exclusively in the EU — EU-region object storage and EU-region Postgres, encrypted at rest with AES-256-GCM. Stripe (payments) processes data in the USA, and several of our providers are US-incorporated; both are covered by EU Standard Contractual Clauses. Some AI Analyst capabilities may use a provider outside the EU only with your explicit consent. A full sub-processor list is published with our DPA.

### Is there a free trial?

There is no separate trial period. Every new account starts on the Free plan — up to 3 devices, no credit card required, no time limit. Free protects the computers the agent is installed on; monitoring a network segment with a SPAN or TAP sensor starts with Starter. Upgrade to a paid plan whenever you need more capacity; plan changes apply immediately.

### Can I bring my own encryption keys (BYOK)?

On Business and Enterprise tiers, you can register an AWS KMS or HashiCorp Vault key with your tenant through our BYOK API.

### What exactly does the NetSenX Math Guarantee guarantee?

It guarantees a method, applied to your data, and full visibility into what that method currently supports. A split-conformal layer derives a false-positive bound on the alerts the engine surfaces, at a configurable confidence level, from analyst-labelled benign traffic in your own tenant. A finite calibration set can only resolve a bound so tight, so the dashboard shows the bound your data supports — and states that it supports none yet, together with what would close the gap, rather than displaying a figure we cannot back. The methodology is documented in our Trust Center and is independently reviewable.

### What is included in the Triple Crown audit pack?

Enterprise customers receive evidence mapped to SOC 2 Type I (in progress), ISO 42001 (AI management), and ISO 27001. Each control includes timestamped artifacts, sub-processor attestations, and an exportable auditor view, refreshed on a real-time cadence.

### Can I migrate from a legacy NDR (Vectra, Darktrace, etc.)?

Yes. The Business and Enterprise onboarding includes a structured cut-over: parallel running for two weeks, alert taxonomy mapping, and analyst playbook migration.

### Is there a non-profit or academic discount?

Yes. Verified non-profits, universities, and accredited research labs receive 50% off Starter and Pro tiers, or extended Free-tier device caps. Email sales@netsenx.com with verification.

### What payment methods do you accept?

Credit and debit cards (Visa, Mastercard, AmEx), SEPA Direct Debit on annual plans, and bank transfer for Business and Enterprise contracts. All processed through EU payment providers that hold PCI-DSS certification; the certification is the provider's, not NetSenX's.

### Can I get an invoice instead of card billing?

Annual plans on Business and Enterprise can be invoiced with Net-30 terms. Starter and Pro annual plans can request manual invoicing on approval. Every payment generates a VAT-compliant invoice automatically.

### Is there a plan for a single computer or a one-person business?

Yes: Solo, at €19 per month or €190 per year (prices exclude VAT), for exactly 1 device and one user. It has Starter's detection, reports and 60-day alert history, without team management. It protects the computer the agent is installed on; monitoring a network segment with a SPAN or TAP sensor starts with Starter. Solo has no device add-on and covers fewer devices than the Free plan (3); from two devices up, Starter at €49 per month is the right plan. Solo is a business plan: like every NetSenX plan it is sold to businesses, freelancers and sole traders buying for their work, not to consumers.