Key Vault Scan + 3 rotations/month.
- Key Vault scanning + Enterprise Application monitoring
- TLS endpoint monitoring for App Service, Application Gateway, API Management, Container Apps and Front Door
- 3 rotations/month
- Compliance dashboard
- Email & webhook alerts
- Up to 4 subscriptions
Full automation with rotation, multi-cloud sync, and SSO.
- Everything in Starter
- Unlimited automated rotation
- Multi-cloud sync (AWS/GCP), with copies updated on every rotation
- TLS endpoints linked to the Key Vault certificates they use
- Certificate renewal, including certificates your CA issues
- SSO (OIDC + Microsoft Entra ID; SAML on roadmap) & B2C scanning
- Auditor-ready evidence packages for CIS Azure, SOC 2, ISO 27001, NIST 800-53, Microsoft cloud security benchmark, HIPAA and PCI DSS*
- Up to 20 Azure subscriptions
- Priority support (2 business days)
* CertifyClouds is an evidence aggregator, not a certified compliance product. Disclaimer →
Start Free TrialFor larger Azure estates needing custom terms, guided onboarding, and a signed support schedule.
- Everything in Pro
- Multi-tenant: cross-tenant inventory & rotation across all your Microsoft Entra ID tenants
- Read-only MCP Connector for approved hosted AI clients
- Custom contract (MSA, DPA, SLA)
- Dedicated escalation path
- 24/7 P1 escalation, per signed support agreement
- Implementation & onboarding assistance
- Security questionnaire and procurement support
ROI Calculator
See how much you could save with CertifyClouds Pro
Infrastructure cost (~£35/month) runs in your own Azure subscription
What Are You Replacing?
Scanning. Rotation. Compliance. Multi-cloud sync. Here's what teams cobble together instead:
| Current Approach | The Problem | CertifyClouds |
|---|---|---|
| Spreadsheets & Calendar Reminders | Manual, error-prone, doesn't scale. Someone leaves and tribal knowledge goes with them. | ✓ Automatic scanning across all vaults |
| Azure Monitor Alerts | Complex setup per vault. No unified view. Doesn't track App Registrations. | ✓ Single dashboard, all subscriptions |
| Custom PowerShell / Azure Functions | Maintenance burden. Breaks silently. No UI for non-engineers. | ✓ Production-ready, maintained for you |
| Manual Azure Portal Checks | Click through 50+ vaults? Every week? Across multiple subscriptions? | ✓ Scheduled scans, instant reports |
| "We'll Deal With It When It Expires" | 3 AM incident. Production down. Everyone on a call. Again. | ✓ Alerts at the thresholds you set, automatic rotation |
CertifyClouds Plans Comparison
| Feature | Starter | Pro | Enterprise |
|---|---|---|---|
| Key Vault Scan (plus Enterprise Application monitoring) | ✓ | ✓ | ✓ |
| TLS endpoint certificates (App Service, Application Gateway, API Management, Container Apps, Front Door) with expiry alerts | ✓ | ✓ | ✓ |
| Compliance dashboard | ✓ | ✓ | ✓ |
| Email & webhook alerts | ✓ | ✓ | ✓ |
| Audit trail | ✓ | ✓ | ✓ |
| Secret rotation | 3/month | Unlimited | Unlimited |
| Multi-cloud sync (AWS/GCP) | - | ✓ | ✓ |
| Copies in AWS, Google Cloud and other Key Vaults updated on every rotation | - | ✓ | ✓ |
| Asset Dependencies | - | ✓ | ✓ |
| Which Key Vault certificate each TLS endpoint uses, and whether it picks up renewals | - | ✓ | ✓ |
| One-click Key Vault auto-renewal for self-signed certificates | - | ✓ | ✓ |
| Certificate renewal from CertifyClouds: self-signed, ordered through Key Vault's CA, or requested from any CA | - | ✓ | ✓ |
| SSO (OIDC + Microsoft Entra ID; SAML on roadmap) | - | ✓ | ✓ |
| B2C & Entra External ID tenant scanning | - | ✓ | ✓ |
| User management | - | ✓ | ✓ |
| Multi-tenant (cross-tenant inventory & rotation) | - | - | ✓ |
| MCP Connector (read-only) | - | - | ✓ |
| Azure subscriptions | Up to 4 | Up to 20 | 21+ / agreed scope |
| Support response | 4 UK business days | 2 UK business days | 24/7 P1 escalation (per signed agreement) |
| Dedicated escalation path | - | - | ✓ |
| Custom contract (MSA, DPA, SLA) | - | - | ✓ |
Billing FAQ
We accept bank transfer and major credit cards. Enterprise customers can arrange invoicing with NET-30 terms.
Monthly plans can be cancelled at any time, effective at the end of the billing period. Annual plans are 12-month commitments with 2 months free (pay for 10 months). Annual plans auto-renew unless cancelled 30 days before expiry. Enterprise customers receive custom contract terms including MSA, DPA, and SLA documentation.
Email [email protected] to cancel. Monthly cancellations are effective at end of billing period. Annual plans continue until expiry with no partial refunds.
Upgrades are prorated and take effect immediately. Downgrades take effect at your next renewal date.
Yes. Every plan starts with a free 30-day trial with all features enabled.