Essentiel
Replace your VPN
MAD 42 excl. taxper user / month
From 5 users
Included modules
- PassTunnel
Next-Generation Secure Access for IT & Critical Systems
Replace your VPN with Zero Trust access: every person is verified at every connection, and reaches only what they are allowed to use.
- No card required
- No port to open
- From MAD 42 excl. tax per user
Pricing
One price per user per month, excluding tax. Start with the essentials, and add modules as your needs grow.
Avancé
Segment your network
MAD 81 excl. taxper user / month
From 10 users
Included modules
- PassTunnel
- PassSegment
Business
Secure your files
MAD 129 excl. taxper user / month
From 25 users
Included modules
- PassTunnel
- PassSegment
- PassShare
- PassCrypt
Enterprise
Isolate industrial networks
Custom
From 50 users
Included modules
- PassTunnel
- PassSegment
- PassDiode
- PassShare
- PassCrypt
- No open port
- Your applications stay as they are
- 14-day trial, no card
- Monthly, no commitment
Compare the plans
| Essentiel | Avancé | Business | Enterprise | |
|---|---|---|---|---|
| The plan | ||||
| Minimum number of users | 5 users | 10 users | 25 users | 50 users |
| 14-day trial, no card | Included | Included | Included | Not included |
| Access without a VPN | ||||
| PassTunnel, access without a VPN | Included | Included | Included | Included |
| No port to open on your network | Included | Included | Included | Included |
| Any TCP or UDP application | Included | Included | Included | Included |
| Two-factor authentication at every access | Included | Included | Included | Included |
| A device check before every connection | Included | Included | Included | Included |
| An agent for Windows, Linux and macOS | Included | Included | Included | Included |
| Temporary access for your contractors | Not included | Included | Included | Included |
| Single sign-on with Microsoft Entra ID or Google Workspace (SSO) | Not included | Not included | Included | Included |
| Segmentation | ||||
| PassSegment, each device in its own zone | Not included | Included | Included | Included |
| Rules based on identity, not on IP address | Not included | Included | Included | Included |
| Administrator rights open only for as long as needed (JIT PAM) | Not included | Included | Included | Included |
| Files and exchanges | ||||
| PassShare, secure file sharing (SMB) | Option | Option | Included | Included |
| Every file disarmed, then rebuilt (CDR) | Option | Option | Included | Included |
| PassCrypt, encrypted exchanges | Option | Option | Included | Included |
| Industrial networks | ||||
| PassDiode, the data diode | Not included | Not included | Not included | Included |
| Strict isolation of industrial networks (OT, SCADA) | Not included | Not included | Not included | Included |
| Logs and support | ||||
| Access logs kept | 7 days | 30 days | 90 days | Custom |
| Support by ticket and email | Included | Included | Included | Included |
| Priority support | Not included | Not included | Included | Included |
| Dedicated support and a named contact | Not included | Not included | Not included | Included |
| An availability commitment in the contract (SLA) | Not included | Not included | Not included | Included |
| Deployment | ||||
| On your own servers or hybrid | Not included | Not included | Not included | Included |
| Setup and onboarding | Not included | Not included | On quote | On quote |
Publishing the usual way, and what changes
| With nginx, a reverse proxy | With PassZTNA | |
|---|---|---|
| Who can connect | The whole internet | Devices with a certificate |
| Direction of the connection | nginx comes in to the server | The agent calls out to the gateway |
| Port on your network | Required | None |
| What an attacker sees | The application and its flaws | A gateway that says no |
| What goes through | The web | Any TCP or UDP exchange |
| The right choice for | A public website | A tool reserved for your teams |
| A VPN | PassZTNA | |
|---|---|---|
| What it opens | The whole network | One application |
| If a device is compromised | The intruder can move anywhere | Limited to that device's access |
| What stays visible | The VPN appliance | A closed gateway |
| In a picture | A badge for the whole building | A key for a single door |
A public website should stay public: for it, nginx remains the right tool.
The key terms, in plain words
- Zero Trust
- Trust no one by default, not even inside the network. Every access is verified.
- Micro-segmentation
- Splitting the network into closed rooms: if a device is compromised, the intruder stays in its room.At PassRoyal: PassSegment, from the Avancé plan.
- With or without an agent
- With an agent: a small program on the computer, for every use. Without an agent (clientless): from a browser, with nothing to install, handy for a contractor.At PassRoyal: PassTunnel, with an agent first, agentless next.
- VDI and VDA
- VDI gives everyone a desktop hosted on a server; VDA is the program inside that desktop that displays it remotely. ZTNA leads there without exposing the server.At PassRoyal: planned.
- Data diode
- A passage where data flows in one direction only. It isolates an industrial network without cutting it off from the rest of the company.At PassRoyal: PassDiode, Enterprise plan.
- CDR
- Disarming, then rebuilding a file: its useful content is kept, and anything that could run is removed.At PassRoyal: PassShare.
- Single sign-on (SSO)
- One account, your Microsoft or Google one, for all your applications. When someone leaves, their access is closed in one place.At PassRoyal: Business plan.
- Just-in-time access (JIT PAM)
- Administrator rights open for one task, then close on their own.At PassRoyal: PassSegment.
Your questions
When can I start?
PassZTNA is opening in stages, to a first group of businesses that we support one by one. PassTunnel opens first, and the other modules follow. Send your request: we will write to you as soon as your plan can start at your company.
How much does PassZTNA cost?
From MAD 42 to 129 excl. tax per user per month with yearly billing, and from MAD 49 to 150 excl. tax with monthly billing, depending on the plan. Essentiel starts at 5 users, Avancé at 10, Business at 25. Enterprise, with PassDiode, is priced together with you, starting at 50 users.
How does the 14-day trial work?
You request it with our form, with no bank card. We open it for your organisation, and the 14 days start that day. At the end, you choose your plan, or access stops, at no cost.
Can I change plans?
Yes. Start with the one that meets your needs today: when they grow, write to us, and we move your organisation to the next plan.
Do I need to change my applications?
No. An agent is installed next to them and connects out to the gateway. The application sees no difference, and your users keep their usual tools.
Do my users need to install anything?
Yes, a small program on their computer, the agent, for Windows, Linux or macOS. Access without an agent, from a browser, comes in a later stage.
Do I have to keep my VPN?
PassTunnel serves the same need, working remotely, without opening the whole network. The move is prepared one application at a time: the two can run side by side during the transition.
What about my public website?
It stays public, and nginx remains the right tool for it. PassZTNA is for what must stay reserved for your teams: an ERP, a remote desktop, a database.
Ready to replace your VPN?
A 14-day trial, no card required. Or a quote, if you would rather talk it through.