↓ Skip to main content
fremforge

Pricing

One plan. Per seat. In EUR.

Every seat ships with sovereignty, Security (scanning, prioritisation and fixes), hosted runners, and full export rights. One price covers Actions minutes, security signing, dependency scans, and on-demand data export - all on EU infrastructure.

€30 / seat / month

Billed monthly. Cancel any time at end of paid month.

Billed in EUR. VAT reverse-charge for EU B2B with a valid VIES VAT number.

Read-only readers are free and unlimited. Only members who can push or administer count as a seat. How readers work →

At today's mid-market rates, €30 is roughly £26 / CHF 28 / kr 320 NOK / kr 224 DKK. Your effective cost in your local currency varies with FX on each invoice date. Customers outside the EUR zone are charged in EUR; their bank or card provider applies the conversion. Enterprise customers invoiced on payment terms can agree DKK invoicing instead.

Start your 30-day free trial →
30-day free trial on signup. Card authorisation at signup via Mollie hosted checkout (€0 - no funds taken; some banks may briefly pre-auth €0.01 and reverse it). Trial auto-converts to your monthly plan on day 30; cancel any time before then in Admin → Billing at no cost. We send a reminder 3 days before the auto-charge.

Trial caps: 1 seat, 10 repositories, 500 runner-minutes pooled across the full 30-day trial, and up to 5 GB of dependency-proxy cache. The full 1,000 runner-minutes/seat monthly pool unlocks at first payment. Caps protect the platform during the trial window; legitimate evaluation fits comfortably - that's ~25-50 typical CI runs.

Annual term: €306/seat charged upfront for the year. If you cancel, access continues to your committed-until date and the year stands as paid. Auto-renews unless cancelled at least 30 days before term end. Full detail in the terms of service.

What's included

  • Forgejo surface. Repos, issues, PRs, package registry - Forgejo upstream with a thin MFA patch set (API-compatible).
  • Free read-only readers. Add unlimited reader members - clone, browse code, read issues and PRs - at no charge. You only pay for members who can push or administer.
  • Auditors. Every organisation has a built-in read-only Auditors team that can also read organisation settings, members and the audit trail - but never change anything or download exports. The first 5 auditors per organisation are free; a sixth or later counts as a seat. How auditors work.
  • Hosted CI runners. 1,000 min/seat/month pooled. Concurrent jobs: 2 per seat guaranteed (at least 10, at most 60), and up to 60 when capacity is free (fair use; higher on request). €0.01/min after pool. Each job counts in whole minutes, rounded up (a 61-second job counts as 2 minutes), for the pool and overage alike. Single-use VM per job.
  • Sovereign build supply. Hosted runners install npm, PyPI, Go, Maven and NuGet packages and pull container images through your organisation's dependency proxy, and resolve GitHub Actions from Forgejo pull-mirrors. Set up automatically on every runner job.
  • Dependency proxy. Pull container images and npm, PyPI, Maven, NuGet, Go, Cargo, Helm and RPM packages from the major public registries through frem.sh, cached for your organisation. On by default. Docker Hub pulls use your organisation's own Docker Hub credentials. Fair use per AUP §4A.
  • Security. Pre-receive secret scanning, push protection, dependency + licence + image + malware scanning, SAST, reachability verdicts (reachable, not reachable, unknown), known-exploited flags (ENISA EUVD + CISA KEV), security fix pull requests, signed commits, SLSA provenance, SBOM per build, workflow pinning (SHA-pin rewrite PR).
  • Compliance. Compliance report, control evidence and an on-demand signed vendor attestation of audit-chain + security state (HTML + JSON).
  • Dependency updates (security fixes and version updates). Version updates on a schedule, with a 3-day release-age wait, and security fix pull requests on click or, if you choose, automatically for the findings that matter most, one per package at the lowest fixing version. Security fixes work without switching on version updates; they wait for review by default, merging when checks pass is opt-in.
  • Storage. 5 GB repo + 5 GB LFS + 5 GB packages per seat, as three separate org-wide pools. The dependency-proxy cache counts toward the packages pool.
  • Package egress. 100 GB/seat/month soft cap (we notify you); 300 GB/seat/month hard cap, then throttled to 1 Mbps until the 1st. No overage charge. Downloads by fremforge-hosted runners never count toward either cap; self-hosted runners and other clients do.
  • SSO with step-up MFA. OIDC SSO (Entra ID, ADFS, Okta, Google Workspace) with real acr_values/amr-claim verification (not just first-login), per-org session binding.
  • Enterprise access controls. SSH-CA, hardware-backed keys (WebAuthn-only), IP allowlist, email-domain allowlist, per-org max PAT lifetime, signed-commits enforcement, org-wide branch protection defaults.
  • SCIM 2.0 provisioning. Push users and groups from Okta, Entra, Authentik, or any compliant IdP. Per-tenant bearer-token auth with dual-token rotation.
  • OIDC federation. Short-lived T Cloud Public credentials on every job. No long-lived deploy keys.
  • Deployment environments. Per-env secrets, branch restrictions, required-reviewer gates.
  • SIEM forwarding. HMAC-signed audit-event POST to your Splunk/QRadar/Sentinel/Datadog endpoint.
  • Fix-by SLA. Customer-set days to fix per severity; overdue findings surface as bell alerts. Optionally stretch the SLA of findings that are not reachable; known-exploited ones always keep the full SLA.
  • Public REST API. Same surface humans use. PAT + OAuth 2.0 client credentials. Ready for AI agents.
  • AI integrations (BYOK). PR review, Renovate explanations, AI fix for selected SAST findings (off by default), customer-callable /ai/complete. Bring your own key - Anthropic, OpenAI, Mistral, Vertex Gemini, or any OpenAI-compatible URL. Data path & sovereignty →
  • Public repos supported. Private by default.
  • One-click tamper-evident export. Repos, LFS, Actions logs, audit slice, attestations - zipped with a SHA-256 manifest.
  • Audit log retention up to 2 years. Configurable per tenant (90 / 180 / 365 / 730 days). Hash-chained index stays forever; payload ages out per your policy. WORM-anchored with cross-region replica.
  • Storage overage. €0,20/GB/month on the relevant pool, billed in arrears.

How €30 compares

One per-seat price with the supply chain stack included - no security add-on. Feature by feature: fremforge vs GitHub and fremforge vs GitLab.

GitHub Enterprise + security add-ons 🇺🇸 US company

$70/committer/mo$21 Enterprise + $19 Secret Protection + $30 Code Security

Enterprise is $21 per user per month (GitHub pricing). Secret Protection ($19) and Code Security ($30) are add-ons, billed per month for each active committer: anyone whose commit was pushed to a repository with the feature on in the last 90 days (GitHub changelog, 4 March 2025; GitHub billing docs). For a member who commits, that is $70 per month. Team ($4) lacks SAML single sign-on and the IP allow list. Actions minutes are metered separately.

GitLab Ultimate 🇺🇸 US company

$99/user/moreported list price, billed annually

SAST, DAST, dependency & container scanning, vulnerability management. CI minutes metered separately. GitLab's own page now says "Get custom pricing"; $99 per user per month is the price buyers report (SpendBase). Premium ($29 per user per month, billed annually) does not include them (GitLab pricing).

fremforge 🇪🇺 hosted in Germany

€30/seat/moflat · €360/seat/yr · €306 on annual commit

Security included, with reachability and security fix pull requests. 1.000 CI min/seat pooled. Dependency updates (security fixes and version updates). Signed export. Zero US sub-processors.

GitHub and GitLab prices are in USD, read on 23 October 2026: GitHub's are its published list prices, and GitLab Ultimate's is the reported list price, since GitLab quotes it on request. GitHub bills its security add-ons per active committer, so a team pays them only for the members who push code; fremforge includes them in every seat. fremforge prices in EUR throughout, with no FX exposure on renewal. Pricing reviewed annually.

frembench — add-on, per bench seat

A Linux machine you reach from the browser, for running a coding agent off your laptop. Requires a fremforge seat.

€39 / bench seat / month

200 hours of runtime included, pooled across bench seats. Prorated on change. VAT reverse-charge for EU B2B with a valid VIES VAT number.

At today's mid-market rates, €39 is roughly £34 / CHF 36 / kr 416 NOK / kr 291 DKK. Charged in EUR, like every other line on your invoice; your bank or card provider applies the conversion.

What's included

  • 200 hours/seat/month, pooled at org level like CI minutes. A bench suspends after 30 minutes idle, so a working day spends far less than eight hours of it.
  • €0,20/hour beyond the pool. The same rate the seat implies (39 ÷ 200 = 0,195), so spiky usage costs no more than buying another seat.
  • Capped at €99/seat/month. Not an estimate — the charge stops there. Binds at 500 hours on one seat; past that your benches run at no further charge.
  • Billed per second, rounded once at the period boundary. Twenty ten-second wakes cost ten seconds each, not twenty minutes.
  • Prorated on change, like a regular seat.
  • 50 GB profile volume per bench for your code, tools and sign-ins. It survives suspend; the boot disk is rebuilt from a fresh image every wake.
  • Same toolchain as your CI runners, from the same image. Bench documentation.

Payment & billing

Single currency, single price

EUR on every self-serve plan and every invoice. No localised pricing games, no FX surprise on renewal. Enterprise customers on invoice terms can be billed in DKK by agreement.

VAT reverse-charge

Available for EU B2B customers with a valid VIES VAT number. Verified at signup.

Payment methods

Card (Visa, Mastercard), SEPA direct debit, SEPA bank transfer, Google Pay, Apple Pay. Processed by Mollie (NL).

No minimum seat count. Public-sector or regulated buyers who require NET-30 invoice billing on a purchase order: email hello@frem.sh - we handle those cases individually. See trust for the full sub-processor list and the DPA for the contractual posture.

Start your 30-day free trial → See product