| Users | Unlimited | Unlimited | Unlimited |
| Single sign-on | OIDC or SAML, passkeys | Plus require-SSO and a network allow-list | As Business |
| Identity providers | 1 active | Up to 5 active | More, by contract |
| SCIM | Inbound SCIM 2.0 server | Plus outbound provisioning to your identity provider | As Business |
| Directory | Not included | Import from Okta, Entra ID, Keycloak and others; departments | As Business |
| Audit | Signed, hash-chained ledger you can verify | Plus export to your SIEM and evidence bundles | As Business |
| Retention | Retention, legal hold and erasure | Plus regulatory floors with a compliance lock and a WORM archive on S3 | As Business |
| Residency | Self-hosted: your data stays where you run it | As Community, plus keys in your own key service | Plus air-gapped install and offline updates |
| Compliance packs | Not included | EU AI Act, ISO/IEC 42001, DORA, NIS 2 and more, as drafts | As Business |
| Runtime security | Guardrails, egress DLP, deny-closed checks, kill switch | Plus content firewall, egress and computer-use checks, tool pinning | As Business |
| Deployment | Binary, deb and rpm packages, container | Binary, deb and rpm packages, container | Plus air-gapped install |