Ship a site, store the bytes, push the image.
One workspace for hosted static sites, S3-compatible object storage and a container registry, with Runa, an assistant that can act across them and shows every step it takes. One bill, one set of credentials, one audit log.
- Free plan
- No card, no expiry
- Storage API
- S3-compatible
- Registry API
- OCI distribution
Sites
Static hosting with a real rollback
Push a directory, get a URL. Every deployment keeps its own immutable preview address, so rolling back is promoting a deployment that already exists rather than rebuilding the one that worked.
- Your own domain with two DNS records, a CNAME to cname.subnomic.app, and the certificate follows.
- Per-deployment redirects and headers, versioned with the files they apply to.
- Traffic counted without a cookie, a visitor identity or a third party.
Storage
S3-compatible object storage
The endpoint and the key are the product, so they are the first thing on the page rather than four clicks in. Any client that speaks S3 speaks to this: the AWS CLI, rclone, restic, the SDK you already have in the repository.
- Versioning and object lock, with the locked window stated in days on the object itself.
- Access keys scoped to buckets, a prefix and read, write or delete, with the secret shown once.
- A bucket anyone can read wears this wherever it is listed:Public, no credential needed
Registry
A private OCI registry that scans
docker login and you are done. What is signed, what is vulnerable and which version fixes it is readable from the list, not behind a tab somebody has to remember to open.
- Every push is scanned, and each finding names the version that fixes it.
- Cosign signatures are recognised as signatures, not listed as stray tags.
- Robot accounts for CI, scoped to one repository and revocable on their own.
| Tag | Scan | Signature | Fix |
|---|---|---|---|
| acme/api:1.4.1 | 3 high | Signed | Newest |
| acme/api:1.4.0 | 2 critical | Signed | Both fixed in 1.4.1 |
Runa
An assistant with your workspace in reach
Ask it a question about the workspace and it reads the workspace to answer. Every tool call is shown with the real arguments it was called with, and it never holds more permission than the person who gave it access.
- It reaches only what its access is scoped to, through the same guardrails you go through.
- Every call lands in the audit trail with its arguments.
- Press ⌘J on any screen and that screen is already pinned.
Why does api in prod-eu keep restarting?
The previous container ran out of memory on start. The restart was proposed from the incident, and it runs only after somebody approves it.
Workflows
The four of them, wired together
Draw a graph of the things you already let people do by hand, read a database, restart a deployment, ask a person, and run it on a schedule, a webhook or a button. Each workflow runs as its own credential, so it can never reach further than whoever wrote it.
- A run survives the worker that started it: succeeded steps are not run twice.
- Anything that changes something can stop and wait for a person, and editing the graph asks for approval again.
- Describe it in a sentence and the graph is drawn for you, on the canvas, where you can argue with it.
Pricing
One table, because you are comparing your own number against the next column.
| Plan | Free | Pro Most teams | Team | Enterprise |
|---|---|---|---|---|
| Price | $0 | $29.99 / mo | $99.99 / mo | $999.99 / mo |
| Stored | 512 MB | 20 GB | 100 GB | 1 TB |
| Objects | 1,000 | 50,000 | 250,000 | 2,500,000 |
| Sites | 1 | 10 | 50 | 500 |
| Services | 1 | 3 | 10 | 10 |
| Largest service | 256 MB | 1 GB | 2 GB | 8 GB |
| All services together | 256 MB | 3 GB | 20 GB | 80 GB |
| Servers & clusters | — | 3 | 25 | 250 |
| Site traffic | 1 GB | 30 GB | 150 GB | 1.5 TB |
| Workflows | 1 | 20 | 200 | 2,000 |
| AI credits | 2k | 100k | 500k | 1M |
| Members | 1 | 3 | 15 | 100 |
| Start free | Start on Pro | Start on Team | Start on Enterprise |
Prices are in US dollars and exclude tax. The free plan needs no card and does not expire. Upgrading takes effect immediately; downgrading takes effect at the next invoice. Nothing above a limit is billed as overage, so there is no path to an invoice you did not choose. A service is a microVM: the plan sets how many you may run and how large one may be, and the largest size is the ceiling for a single service rather than a total across them.
Enterprise
The numbers are in the table above, like every other tier. What this one adds is room, more of every limit, 8 GB services and 365 days of retention, and the features a security review asks about.
Just-in-time access and break-glass, with a reviewer, an expiry and an immediate notice to owners.
Tamper-evident audit, a hash chain that reports deleted and altered entries.
Audit streaming of sealed entries to a signed webhook for your SIEM, or to Slack.
Evidence packs for SOC 2, ISO 27001, HIPAA or PCI DSS reviews — evidence, not a certificate.
Workspace network restrictions, an IP allowlist in monitor or enforce mode.
A DPA and a security overview, and a real person to email about both.
When the servers are yours too
The same workspace grows a second tier: your own servers and Kubernetes clusters, reached through an agent that opens no inbound port. Servers start on Pro, guardrails and session recording come with Team, and just-in-time access with Enterprise.
Servers
CPU, memory and disk as three bars, and a governed terminal on the page.
Kubernetes
Replicas as ready over desired, and right-sizing from the P95 of sampled usage.
Incidents
The timeline is the incident, and the proposed fix waits behind a human.
Compliance
Access reviews signed off in one place, and an audit chain that states its limits.
Before you sign up
Can I leave?
Storage is S3 and the registry is the OCI distribution API, so leaving is aws s3 sync and docker pull, the same two commands you would have used anyway. That is the point of standard APIs.
What does the AI actually see?
Only what its access is scoped to, never more than the person who created that access can do, and every step is shown with its arguments. A guardrail that requires approval refuses the call instead of running it.
Is the free plan a trial?
No. It needs no card and does not expire: one site, 512 MB of storage, one member. Reaching a limit never deletes anything already stored.
Do I have to use all four?
No. Most workspaces start with one. The others are there when you need them, on the same bill and behind the same credential.
Who can see what?
Roles are per workspace, sessions are listed and revocable one at a time, and anything a stranger can reach without a credential wears hazard tape, so you find it by looking.
A workspace, an endpoint and a namespace, about a second from now.
Signing up creates the workspace and shows the registry address your images will push to before it does. The free plan needs no card.