🛡\ufe0f Sunray Pricing

One price.
Published. No surprises.

Core free to self-host · Enterprise €9/month for 20 users.

Self-hosted only · Passkeys WebAuthn · Source-available

Core
sunray_core
Free

Self-hosted. Everything you need to protect your applications with Zero Trust.

  • ✓Passkey WebAuthn FIDO2 authentication
  • ✓Session management with TTL and revocation
  • ✓Rules engine: Public / CIDR / Token
  • ✓Email OTP — passwordless fallback
  • ✓2 Workers: Cloudflare Edge + FastAPI ForwardAuth
  • ✓Audit log — 40+ forensic events
  • ✓Configuration cache & outage resilience
  • ✓WAF Bypass Cookie (Cloudflare Worker)
  • ✓Admin UI Odoo Community Framework + CLI
  • ✓Worker auto-registration & migration

FSL-1.1-Apache-2.0 — converts to Apache 2.0 per release on a rolling 2-year basis

Download for free
Beta — currently free
Enterprise
sunray_advanced_core
9 € /month
20 users included
+ €1 / user beyond that

Advanced features for teams and production deployments.

  • ✓All Core included
  • ✓Remote Auth — mobile QR code (kiosks / shared workstations)
  • ✓Deployment Mode — progressive go-live without friction
  • ✓Sunray Configuration Proxy (SCP)
  • ✓Bulk token generation with email delivery
  • ✓Worker auto-registration with configurable defaults
  • ✓User self-service session management
  • ✓Analytics Dashboard ChartJS
  • ✓+17 advanced audit events

Elastic License v2 — source-available in perpetuity, no open-source conversion

Start in beta

• Billed user: any person with \u22652 logins in the calendar month.

• Beta: Enterprise billing inactive — Enterprise access is free during this phase.

• Exclusive distribution oursbl.eu — No white-label.

Two Worker implementations

Available in both tiers — choose based on your infrastructure

Cloudflare Worker

Edge deployment on 200+ Cloudflare PoPs. Native reverse proxy, state in KV namespaces, Cloudflare WAF included, HMAC-signed WAF Bypass cookie.

Global edgeReverse proxyNative WAFKV state

FastAPI Worker

Self-hosted on your infra. ForwardAuth middleware compatible with Traefik, Nginx, Caddy. Cache in DragonflyDB (async Redis client). Prometheus metrics included.

On-premiseForwardAuthDragonflyDBPrometheus

Included in both tiers

Enterprise-grade security accessible to all teams

🔑

Passkeys WebAuthn

Touch ID, Face ID, FIDO2 key. Host-scoped credentials, phishing-resistant by design. Zero passwords.

🚫

Zero client to install

No VPN, no agent on workstations. A browser is enough to authenticate.

🔀

Transparent reverse proxy

Your apps remain intact — Sunray handles the access layer without any modification.

🛡️

Locked-by-default model

All traffic is authenticated. Exceptions are defined via explicit rules in a centralised library.

⚡

Offline resilience

Workers serve from their cache during a Server outage — zero interruption for your users.

🇫🇷

Sovereign & source-auditable

Auditable code, self-hosted. IP Cyril MORISSE / oursbl.eu. No imposed third-party SaaS dependency.

What Sunray is not

  • ❌ Not a VPN — operates at the HTTP layer, not network
  • ❌ Not a federated SSO / generic cross-application IdP
  • ❌ Not a CASB or CIAM for third-party SaaS apps
  • ❌ No managed SaaS offered today (internal roadmap, no public commitment)

Ready to secure your applications?

Installation in 5 to 30 minutes · No modification to your code

Contact us → See all features