Skip to content
DEStart free 14-day trial
Product
Pricing
Resources
Trust
Company
Start free 14-day trialSign inDeutsch

One price per module. Combine the modules that apply to you.

Pick a plan size per module, add the options you need and see your total instantly. Free 14-day trial on Starter, Team and Business. Businesses only, prices plus VAT.

Choose your modules

  • CRACyber Resilience Act

    Article 14 reporting for products with digital elements

    From €149 a month, plus VAT.

    Starter, €149 a month€1,490 a year, Team, €449 a month€4,490 a year, Business, €990 a month€9,900 a year, In your totalAdd to total
    Plan size, CRA module

    51530 usersrecords kept 24 monthsalerts by e-mail, Slack, Teams, webhookHow alerts reach you

    Everything included
    • SBOM upload in CycloneDX or SPDX JSON, in the web interface or through the API, with upload tokens limited to one product.
    • Every hour, each monitored release is checked for actively exploited vulnerabilities listed by CISA KEV and ENISA EUVD, matched with OSV advisory data to its npm, PyPI, Maven, Go and NuGet components.
    • Alerts go by e-mail to the contacts you name and to Slack, Microsoft Teams or a signed webhook; if nobody has opened or acknowledged the case two hours after its clock started, your named backup is alerted as well.
    • Choose per channel: every alert, only the urgent ones (the first alert, escalations and overdue deadlines), or only when a case opens.
    • The Article 14 clocks for actively exploited vulnerabilities and severe incidents, calculated from the time you became aware and shown in UTC.
    • Report drafts with the fields and field limits of the single reporting platform, each field ready to copy. You submit to ENISA yourself; the submission time and reference are recorded.
    • Append-only audit trail of who knew what, when.
    • Download everything: one archive with your account data, every document as it arrived, the findings, the cases with their deadlines and reports, and the complete audit trail.
    • Four roles: Owner, Administrator, Member, Viewer.
    • The application and customer data are hosted in Germany.
    • E-mail support Monday to Friday, 9:00–18:00 CET/CEST, except public holidays.

  • NIS2 (Germany)BSIG

    Significant-incident reporting under the BSIG, with energy, telecom and trust-service profiles

    From €129 a month, plus VAT.

    Starter, €129 a month€1,290 a year, Team, €349 a month€3,490 a year, Business, €790 a month€7,900 a year, In your totalAdd to total
    Plan size, NIS2 (Germany) module

    51530 usersrecords kept 24 monthsalerts by e-mail, Slack, Teams, webhookHow alerts reach you

    Everything included
    • The reporting stages under § 32 BSIG, each with its own clock: early warning within 24 hours of becoming aware, notification within 72 hours, intermediate report at the BSI’s request, final report one month after the notification – or, if the incident is still ongoing then, a progress report instead.
    • Profiles for energy (§§ 5c, 5d EnWG), public telecommunications (§ 168 TKG) and trust service providers (eIDAS), all in the same module.
    • Drafts structured like each recipient’s form, for the BSI reporting portal, the BSI’s online form for entities without registration, and the § 168 TKG reporting addresses of the Federal Network Agency and the BSI.
    • A self-check questionnaire on § 28 BSIG – for orientation, not a legal assessment.
    • A reminder to register with the BSI (§ 33 BSIG) while an entity’s registration is required or not yet assessed.
    • Your own copy of every report, with the time you submitted it.
    • Every stage cites its legal basis.
    • Alerts, audit trail, export and hosting in Germany, as in every module.

  • GDPRpersonal data breaches

    Breach notification and communication under Articles 33 and 34 GDPR, with a telecom profile

    From €39 a month, plus VAT.

    Starter, €39 a month€390 a year, Team, €99 a month€990 a year, Business, €199 a month€1,990 a year, In your totalAdd to total
    Plan size, GDPR module

    51530 usersrecords kept 24 monthsalerts by e-mail, Slack, Teams, webhookHow alerts reach you

    Everything included
    • The Article 33 clock: notification to the supervisory authority within 72 hours of becoming aware, where feasible, with a field for the reasons if notification is late.
    • Drafts with the Article 33(3) information, which you can supplement in phases (Article 33(4)).
    • Communication to data subjects (Article 34), with the Article 34(3) exceptions as a checklist.
    • Every personal data breach documented with its notification decision, who made it and when, including those not notified (Article 33(5)).
    • The reporting channel of the competent German supervisory authority: every federal state and the BfDI.
    • Telecom profile under § 169 TKG and Regulation (EU) No 611/2013: notification to the BNetzA and the BfDI within 24 hours of detection where feasible, and a second notification within three days.
    • Breach records hold the categories and approximate numbers of data subjects and personal data records concerned, not their identities.
    • Alerts, audit trail, export and hosting in Germany, as in every module.

Included in every module: Alerts by e-mail to the contacts you name and to Slack, Microsoft Teams or a signed webhook. Users included: set by your largest plan.

Add-ons for the whole account

  • Extra users

    €10 a month net per login (€100 a year net)

    Alerts to Slack, Teams or a webhook need no login.

    On every plan

  • 120-month retention

    €99 a month net (€990 a year net)

    Keep every case, report and audit-trail entry for 120 months instead of 24.

    On Starter, Team and Business; included in Enterprise

  • Contract notification clocks

    Clocks for the notification duties in your own contracts: a deadline, alerts, a draft and the time you record as sent, for each notice.

    With any module on Team or larger

    Contract notification clocks

Add-ons and extra users are not discounted.

Enterprise

from €1,000 a month, billed annually (at least €12,000 a year)

  • 26 or more products, or custom terms
  • 50 users included
  • 120-month retention included
  • Procurement documents on request
Request a quote

Compare plans

Every plan side by side. For businesses only. All prices plus VAT.
PlanStarterTeamBusinessEnterprise
CRACyber Resilience Act
Price per month€149€449€990by quote
Price per year€1,490€4,490€9,900from €12,000
Products3102526+
Monitored releases per product25252525
Alerts by e-mail to the contacts you name and to Slack, Microsoft Teams or a signed webhook, with escalation to a named backupIncludedIncludedIncludedIncluded
NIS2 (Germany)BSIG
Price per month€129€349€790by quote
Legal entities1310by quote
GDPRpersonal data breaches
Price per month€39€99€199by quote
Controllers1310by quote
Users
Included users5153050
Extra user€10€10€10€10
Roles: Owner, Administrator, Member, ViewerIncludedIncludedIncludedIncluded
Monitoring and alerts
Hourly checks for actively exploited vulnerabilities (CISA KEV, ENISA EUVD), matched with OSV advisory data to npm, PyPI, Maven, Go and NuGet componentsIncludedIncludedIncludedIncluded
E-mail, Slack, Microsoft Teams, signed webhookIncludedIncludedIncludedIncluded
Alert filter per channelIncludedIncludedIncludedIncluded
Cases and reports
Deadline clocks per moduleIncludedIncludedIncludedIncluded
Report drafts with the recipient’s fieldsIncludedIncludedIncludedIncluded
Append-only audit trailIncludedIncludedIncludedIncluded
Contract notification clocksadd-onadd-onadd-onby quote
Data
Retention24 months24 months24 months120 months
120-month retention€99€99€99included
Download everything; hosted in GermanyIncludedIncludedIncludedIncluded
Integrations
SBOM upload API with product-scoped tokensIncludedIncludedIncludedIncluded
Buying
Free 14-day trialIncludedIncludedIncludedpilot by agreement
Support
SupportE-mail, Monday to Friday, 9:00–18:00 CET/CEST

E-mail support Monday to Friday, 9:00–18:00 CET/CEST, except public holidays (SLA).

Questions about pricing

Who can buy BitHive?

Businesses only. At checkout you confirm that you are buying as a business and give your company name and address. All prices are net, plus VAT where applicable. For businesses only (entrepreneurs within the meaning of Section 14 of the German Civil Code); not available to consumers.

Is there a free plan?

No. Each company can try the service once, free of charge, for 14 days. When you order online, you add a payment method at the start; nothing is charged during the trial. Unless you cancel online before the trial ends, the plan you chose starts afterwards. We send you an e-mail reminder at least seven days before the first charge (Section 2.4 of the Terms).

How can I pay?

BitHive UG (haftungsbeschränkt) sells directly. You order online and pay with one of the payment methods offered at checkout, for example by card; your payment method is charged in advance for each billing period. On request, we also invoice annual plans and Enterprise contracts; you then pay by bank transfer within 14 days of receiving the invoice. For businesses only. All prices plus VAT. Customers in other EU countries with a valid VAT ID are invoiced without German VAT (reverse charge); customers outside the EU are invoiced without German VAT.

Do I need a VAT ID?

For a company in Germany, no: German VAT applies either way. For a company in another EU country, yes, at present: we confirm the VAT ID through the EU's VIES service and invoice without German VAT (reverse charge).

How much does yearly billing save?

Two months: you pay for 10 and get 12. The crossed-out price next to a yearly price, labelled “12 × monthly price”, is what 12 monthly payments would cost. Switching from monthly to yearly takes effect at once, with credit for the unused month; switching from yearly to monthly takes effect at the end of the year.

What counts as a product, a legal entity or a controller?

A product is any model, edition or app you sell separately; all its releases count as one product, with up to 25 monitored releases per product. For NIS2, each legal entity you report for counts as one unit; for GDPR, each controller entity. If you need more, move up a plan.

Who needs a user seat?

Everyone who signs in, whatever their role. Your largest plan sets the number of included users for the whole account; each additional login costs €10 a month. An open invitation counts as a seat until it is accepted or withdrawn, or expires. Alerts to Slack, Teams or a webhook need no seat.

Can we combine several modules?

Yes, in one account with one pool of users. Two modules save 5 %, three save 10 % on the module prices; seats and add-ons are not discounted.

How long do you keep our records, and can we take them with us?

Case records, reports and the audit trail are kept for 24 months, or 120 months with the retention add-on (included in Enterprise), as long as your subscription runs. You can download everything as one archive at any time, and for 30 days after your contract ends.

What happens if a payment fails?

We write to you on day 7. From day 15, or at once if the first charge after your trial fails, the account is read-only – monitoring, alerts for new matches and the deadline clocks keep running – and the subscription is cancelled on day 30.

Can we change plan or cancel?

Moving up takes effect at once and is charged pro rata; moving down takes effect at the end of the billing period. Monthly plans renew every month and can be cancelled effective at the end of the current contract month. Yearly plans renew for a further twelve months unless cancelled with one month’s notice before the end of the term. A plan change deletes no evidence, unless you shorten the retention period (Terms 7.6 (c)); open deadlines keep running until they are closed.