Transparent pricing · No per-seat surprises · Cancel any time

Simple pricing for
every team size

Start free. Add products when you need them. Every paid plan includes signed audit receipts, API access, and agent-ready MCP tools.

Monthly Annual save 20%

Full-stack bundles

Free Developer
$0 /month

Explore all products. Build integrations. No credit card.

  • 50 file operations / month
  • 10 signing operations / month
  • 1 user seat
  • REST API + Agentic AI (MCP) — software sandbox
  • SoftHSM software-key sandbox
  • Signed audit receipts
  • Hardware HSM key custody
  • SLA + priority support
Start free →
Most Popular
Protected Workspace
$199 /month

Cloak Files + KMS. The complete protection stack for you and your AI agents — one account.

  • Unlimited file cloak / uncloak operations
  • Smartcard HSM key custody — up to 10 keys
  • Agentic AI (MCP) access to all 10 keys
  • MCP tools + REST API
  • Signed audit receipts (all ops)
  • Priority email support
  • 1 user account · team pricing — talk to us
Start Protected Workspace →
Enterprise Gateway
$799 /team/month

Cloak Files + KMS with Cloak Gateway and your own user-owned HSM devices. Consultative setup.

  • Cloak Gateway with your user-owned HSM devices
  • Up to 5 user seats
  • Up to 50 smartcard HSM keys total
  • Agentic AI (MCP) access
  • Agent budget controls + audit log
  • Dedicated WhatsApp / office-hours support
  • Gateway setup consultation — before or after sign-up
Book a consultation →
Enterprise HSM + Signing
$2,000 – $10,000 /month

Dedicated HSM partition, AATL certificate-backed Batchsign, custom key policy, on-prem deployment option, and named account manager.

  • Dedicated HSM partition
  • Unlimited seats
  • AATL Batchsign
  • SSO / SAML
  • On-prem option
  • 99.99% SLA
Talk to us →

Only need one product?

The plans above bundle Cloak Files + KMS with agentic-AI (MCP) access — the simplest way to start. If you just want a single tool, each product keeps its own standalone pricing on its page.

🔒 Cloak Files pricing → 🗄️ Cloak Vault → ✍️ Batchsign →

Bundle plan comparison

Feature Free Protected Workspace
$199/mo		 Enterprise Gateway
$799/mo		 Enterprise
File encrypt / decrypt 50 / mo Unlimited Unlimited Unlimited
User accounts / seats 1 1 5 Unlimited
HSM keys Sandbox Up to 10 Up to 50 Unlimited
Agentic AI (MCP) Sandbox keys Production keys Production keys Production keys
Signed audit receipts ✓ ✓ ✓ ✓
KMS key custody Software sandbox Smartcard HSM User-owned HSM + Gateway Dedicated HSM / CloudHSM
Cloak Vault (DRM) — — ✓ ✓
Batchsign PDF signing 10 / mo — 5,000 / mo Unlimited AATL
Agent budget controls — — ✓ ✓
SSO / SAML — — — ✓
Uptime SLA — 99.9% 99.9% 99.99%
Support Community Priority email Slack channel Named manager

Frequently asked questions

What is a signed audit receipt?
Every state-changing operation (encrypt, decrypt, sign, key create/delete, ECDH derive) returns a tamper-evident JWS-signed receipt containing the actor, key reference, resource fingerprint, timestamp, and a cryptographic signature. Receipts are verifiable offline via the published JWKS — no call back to cloakapps required.
Do I need to buy all four products?
No. Start with just Cloak Files or Cloak KMS individually, then add more products as your needs grow. The bundle plans exist because teams often end up needing more than one product — bundles save 30–40% over individual purchases.
What makes KMS "HSM-backed"?
Keys stored in HSM plans never leave the hardware security module as plaintext. Cryptographic operations (sign, encrypt, decrypt) happen inside the HSM boundary. Even Cloak staff cannot extract your keys. Shared HSM plans use a multi-tenant partition; dedicated plans give you an isolated hardware partition.
Can AI agents use Cloak products?
Yes — Cloak Files and Cloak KMS expose MCP tools today that any MCP-compatible AI agent (Claude, Cursor, custom LLM apps) can call. Cloak Vault and Batchsign MCP surfaces are coming next. Operations require a human-approved policy before the agent executes. The Enterprise Gateway plan adds per-agent budget limits and a full audit log of every agent action.
Is Batchsign AATL-compliant on all plans?
Server-side PDF signing uses Adobe AATL-compliant certificates on all paid Batchsign plans. The Enterprise plan includes a dedicated AATL certificate in your organisation's name for maximum legal standing. Free and Starter plans use shared certificates.
Where is data stored?
Cloak operates on AWS Singapore (ap-southeast-1) with an optional EU region. Files are encrypted before leaving your network — Cloak never receives plaintext files. Metadata and audit receipts are stored in Cloak's Cassandra cluster. Enterprise customers can opt for on-premises deployment where no data leaves their network.

Ready to protect your files?

Start free in minutes. No credit card. Full API access from day one.

Start free → Talk to enterprise sales

Cloak is governed by the OMMAU Charter — humans authorize, agents execute, receipts prove it.