Policy Control Overview

Policy Control is the foundation of Provisionr that automates group membership across your identity ecosystem. Define policies once, and Provisionr keeps your groups in sync across Google Workspace, Okta, Slack, GitLab, and more.

Plan Features

All features are included on every plan — Free, Baseline, Growth, Scale, and Sovereign. There is no feature gating or tiers by plan, however the higher frequency of background jobs on the Scale and Sovereign plans make some features more useful.

• All Policy Control features, integrations, platform capabilities, API access, and CLI
• Unlimited users in your workspace
• Unlimited members in each group or resource managed by a policy
• Isolated compute and database for your workspace
• Choice of infrastructure region for data residency
• Single Sign-On (SSO) with Google and Okta
• Audit logs and data export

We plan to release add-on products in the future for features that require additional SKUs, but for now everything is included in every plan.

User Membership Integrations

• User Membership Integrations
  • Q2 GitLab Groups
  • Q2 GitLab Projects
  • Google Workspace Groups
  • Okta Groups (for apps)
  • Q1 Slack User Groups
  • 2H AWS Identity Center Groups
  • 2H GCP Folders
  • 2H GCP Projects
  • Q2 Google Cloud Identity Groups
  • 2H Google Shared Drives
  • 2H Google Drive Folders
  • 2H Google Docs, Sheets, Slides
  • 2H Slack Channel invitations

Platform Features

• Platform Features
  • Admin CLI Client for macOS
  • Q2 Web UI for admin users
  • REST API and Service Accounts
  • Audit Logs
  • Sign in with Google
  • Google and Okta SSO
  • Isolated DB per workspace
  • CSV, JSON, or YAML data export
  • Q2 User Access Review Reports
  • 2H Webhooks for No/Low Code
  • On-demand sync for any policy

Plan Differentiation

• Free — Free with 10 active policies and on-demand sync. Start automating your most painful groups today with zero commitment. Free workspaces are deleted after 90 days unless you upgrade to Baseline for $20/mo.
• Baseline — Flat price at $20/mo for engineers and teams without budget that want less headaches. Includes up to 50 active policies and weekly sync.
• Growth — Pay-as-you-grow in increments of 100 policies with daily sync. Built for SMB and small teams that want to improve their onboarding automation. This allows IT and Identity teams to self-service land and expand as they prove value and automate more groups over time.
• Scale — Unlimited policies, 3-hour sync, and a flat monthly rate on AWS or GCP. Built for larger organizations that need predictable pricing without worrying about incremental costs.
• Sovereign — Deploy Provisionr into your own AWS account in any region with a metered license through AWS Marketplace. Built for organizations with strict data residency, infrastructure control, or compliance requirements.

We price by active policies and infrastructure requirements, not users. Whether a policy manages 10 users or 10,000, the cost stays the same — because the automation effort and infrastructure scale with policies, not headcount. This means you can grow your team without worrying about per-seat costs eating into your budget.

Try our Free Plan for 90 days with 10 active policies and on-demand sync to see how Provisionr can automate your group management and save you time and effort.

No credit card required, and you can upgrade or cancel anytime.

	Baseline	Growth	Scale	Sovereign
Monthly Price	$20/mo $50/mo Save 60%	$1/mo per policy Increments of 100	$2,000/mo	~$3,600/mo
Annual Price Save 17%	$200/yr for 50 Policies	$10/yr per policy	$20,000/yr	~$36,000/yr
Active Policies	≤50	≤100 to 2,000	Unlimited	Unlimited
Pricing Model	Simple price for expense report	Pay-as-you-grow with max limits	Predictable price for your budget	$5/hr Marketplace + AWS Infra Costs
Sync Frequency	Weekly	Daily	Every 3 hours	Every 3 hours
API and AI Agent Rate Limits	Limited	Progressive	Unlimited	Unlimited
Cloud Provider	GCP (SaaS) 8 Regions	GCP (SaaS) 8 Regions	AWS or GCP (SaaS) AWS - US or EU GCP - 8 Regions	AWS (B.Y.O. Acct) Any AWS region

Active Policy Count

An active policy is any ruleset that is actively managing a group or resource by syncing members based on rules and conditions you define. If you have 42 Google Groups with a policy ruleset, that’s 42 active policies.

Each Google Group, Okta Group, Slack User Group, or GitLab Group you automate counts as one active policy. Although Directory Attributes use policies to define and manage user attributes, they do not count towards your active policy total for billing purposes.

You can create staged policies to design rules and conditions. This does not count towards your policy limit until you activate the policy and start syncing users.

See the Policies & Rules to learn more.

Scheduled Sync Frequency

• Updating user metadata from your IdP and integrations
• Checking if users match the rules and conditions for your policies
• Adding and removing users from groups and resources to keep them in sync with your policies

Cloud Provider

• Google Cloud Platform (GCP)
  • Used by Free, Baseline, Growth, and Scale plans with a pay-as-you-grow pricing model based on the number of active policies
  • Powered by Cloud Run and Cloud SQL with isolated compute and database for your workspace
  • 8 regions available for data residency
    • us - us-central1 (Iowa) and us-west1 (Oregon)
    • eu - europe-west1 (Belgium) and europe-southwest1 (Spain)
    • ca - northamerica-northeast1 (Montréal) and northamerica-northeast2 (Toronto)
    • au - australia-southeast1 (Sydney) and australia-southeast2 (Melbourne)
    • mx - northamerica-south1 (Mexico) and southamerica-west1 (Chile)
    • jp - asia-northeast1 (Tokyo) and asia-northeast2 (Osaka)
    • br - southamerica-east1 (Brazil) and southamerica-west1 (Chile)
    • in - asia-south1 (Mumbai) and asia-south2 (Delhi)
• Provisionr-Managed Amazon Web Services (AWS) Account
  • Used by Scale plan for AWS deployment without the operational overhead of managing it yourself
  • Powered by AWS ECS Fargate and RDS with isolated compute and database for your workspace
  • 2 regions available for data residency
    • usa: us-east-2 (Ohio) and us-west-2 (Oregon)
    • eur: eu-central-1 (Frankfurt) and eu-southwest-1 (Madrid)
• Customer-Managed Amazon Web Services (AWS) Account
  • Used by Sovereign plan for complete control over infrastructure, data residency, and compliance
  • Deploy Provisionr into your own AWS account within your AWS Organization to any AWS region
  • Metered license through AWS Marketplace with no separate invoice from Provisionr

Frequently Asked Questions

How Many Policies Do I Need?

How many Okta applications do you have? How many Google Groups, GitLab Groups, or Slack User Groups do you need to manage? Each group that you automate with Provisionr requires one active policy.

If your list in the hundreds or thousands, you’re not alone! Implementing policies takes time. You should start with your “top 10” list of the groups that are causing you the most pain today and scale as you automate more later.

After you enable each vendor integration, you will be able to see the number of existing groups in your directory and how many of them are currently managed by Provisionr. This will help you estimate how many policies you need to automate the rest of your groups.

The Free plan includes 10 active policies with on-demand sync. Baseline adds up to 50 policies with weekly sync for $20/mo. Growth adds daily sync and costs $100/mo per 100 policies. Scale and Sovereign include unlimited policies at a flat monthly rate.

Exceeding Policy Limit

If you are on the Free plan (10 policies), upgrade to Baseline for $20/mo to get up to 50 policies with weekly sync, or to Growth for daily sync and pay-as-you-grow pricing.

If you are on the Baseline plan (up to 50 policies), upgrade to Growth to exceed 50 active policies.

On the Growth plan, you can upgrade in increments of 100 active policies as you grow. Each increment costs $100/mo. The break even point with the Scale Plan with unlimited policies is reached at 2,000 active policies.

Scale ($2,000/mo) and Sovereign ($3,600/mo) include unlimited active policies.

Policy Count Rollover

The number of policies included with your plan does not roll over month to month. There are no refunds or credits for unused policies.

Discounts

We do not negotiate discounts on the Baseline or Growth plans. Our pricing is already very competitive and we offer the best price to everyone already.

Custom enterprise agreements are available for Scale and Sovereign plans. Contact [e-mail].

Annual Billing Discounts

Annual billing saves 17% compared to monthly billing and provides two months for free (12 months for the price of 10).

You can upgrade from monthly to annual billing at any time and it will be effective on the first day of the upcoming month.

Annual Billing Proration

See prorated pricing for details on how we calculate prorated charges when upgrading from monthly to annual billing.

When you upgrade from monthly to annual billing, we calculate a prorated charge based on the number of days remaining in the month. This ensures that you only pay for the time you are on each billing cycle.

Temporary Policy Increases on Annual Plan

If you are on an annual plan and need to temporarily increase your number of policies for a short-term project or audit, you can purchase the additional policies you need for the number of months that you need.

Change Plans

See Upgrade Your Plan or Downgrade Your Plan to learn more.

Payment Methods

See Payment Methods to learn more.

Enterprise Pricing and Terms

Please email [e-mail] for custom pricing and agreements for Scale and Sovereign plans.

Custom Compliance Requirements

Please see the Sovereign Plan and Tenant Isolation or email [e-mail] to discuss your requirements.

Additional Questions

If you are a new or prospective customer, please email [e-mail] for any additional questions or custom requirements.

If you have questions about your current plan, billing, or payment methods, please email [e-mail].