Kestro for a team

Kestro installs across a team the way it installs on one machine: one key, as many computers as you bought, no account to create and nothing to administer. There is no “enterprise” edition, and there won’t be: that would mean charging more for the same software to whoever happens to have a budget.

What your security team will ask

The question always comes, and it is a fair one: a tool that opens tunnels into your databases handles production access. Here are the answers, in the order we get asked.

  • No credentials leave the machines. Kestro uses the machine’s own ssh, its keys, its agent, its gcloud and aws profiles. It keeps no vault of its own and copies nothing anywhere, so it cannot leak what it never holds.
  • Nothing syncs to us. Connections go from the machine to your servers, directly. We do not know what you open, or when. That is the substantive difference with SSH clients that keep your hosts in their cloud: syncing by default is enough to make a tool incompatible with some contracts.
  • No usage analytics. Not what you run, not how often. What leaves the machine amounts to one thing: the periodic licence check.
  • The app is signed and notarised by Apple, and updates over a signed channel from our servers.
  • Closed networks: if your rules block the licence check, we issue a licence that does not depend on it, on request.

If your developers use an AI

This is the case that worries people most, and the one where Kestro offers something a terminal cannot. An assistant with a shell can do anything, production included: nothing in a connection string tells staging apart from the real database.

Kestro exposes its tunnels to an assistant under limits each person sets. Environments marked “production” are closed by default, every family of actions can be switched off, and a refusal says which one. It is a boundary the application holds, not a guideline you hope will be followed.

Billing

  • Invoice in the company’s name, with an intra-EU VAT number for purchases outside France. It is sent by email to whatever address you give us.
  • Bank transfer from five seats up, if cards are awkward where you work. Write to us and we’ll send a proforma invoice.
  • One key for the whole team, or several if your accounting prefers separate lines. Your call.
  • One year of updates included, then renewal is optional, never an automatic charge, never a tacit renewal. Not renewing takes nothing away: the machines keep working.

The price

The first seat carries the product, and every seat after it costs €14.99$14.99£12.99CHF 12.90CA$20.99A$22.99, above three as below. There is no volume discount: a team of ten pays ten times for a tool ten people use, and the price per head stays below what an hour of development costs.

Beyond 25 seats, or for a quote on letterhead, write to us: we answer within one business day.

[email protected]

Before any of that, let one person on the team try it: seven full days, no card and no account. An infrastructure tool is judged on a real tunnel, not on a page.