The people behind Provisionr, the company
We spent our careers on the other side of this problem, inside IT and security teams, doing the work by hand. We know what it is to lose a Monday to the access-request queue, to inherit a pile of group rules nobody documented, and to explain to an auditor why someone who left six months ago still had a login. Between us we have administered that access, attacked it, and had to prove it was right, while one of us runs the business so the rest can stay focused on the work. None of us is guessing at what hurts. We did not build Provisionr to chase a market. We built the tool we kept wishing existed and never found.
Our mission is to automate the tedious, repetitive work of group membership and access provisioning so identity teams can spend their time on the work that actually needs a human. We are not trying to be everything an identity program could want. We are trying to be very good at the part that has been ignored the longest, and honest about the rest.
We have spent years working out how access should actually be modeled, so Provisionr is an opinionated platform with the right defaults built in, ready to adapt to how your organization actually works, not a months-long, six-figure implementation.
What We Believe
Prevent. Don't Process.
A faster ticket queue is still a ticket queue. If your groups are modeled to match how your organization should implement least privilege, most access requests should not need to exist at all. We would rather remove the work than optimize it, and we are openly skeptical of any tool whose main achievement is making a broken process run faster.
Boring Beats Clever
We aim for roughly 70% turnkey, 20% configurable, and 10% honest gap, and we will tell you about the 10% rather than paper over it. We are not building a cockpit covered in switches for the rare case. A tool you can reason about, maintain, and trust is worth more than one that demos beautifully and then needs a dedicated owner to keep alive.
Optimized for small and mid-sized organizations
We do not believe identity governance should require a six-figure budget. You're past the point where scripts and spreadsheets hold up, but you're nowhere near the budget or headcount a full enterprise platform assumes. That middle has been underserved for years, because it is not where the six-figure deals are. It is exactly where we want to be, and where our own experience lives.
A small company feels the same provisioning pain a large one does, so our pricing is a flat monthly rate per workspace. Your invoice is cheap enough to be expensed by a sysadmin or IT manager, and you can immediately justify it based on the value of the groups you've automated. There's no procurement cycle on the lower tiers, no consumption math, and no seat minimum to clear before the math works. You start on a $20/mo Evaluator workspace, and you move up a tier only when the next bit of pain is worth solving.
Essentials is not a watered-down enterprise tool with the useful parts removed until you upgrade. Both tiers run the same platform, with the same data isolation and the same group engine. You are not buying a starter edition you will outgrow in a year. You are buying the whole thing, sized and priced for where you are now, and it grows with you instead of against you.
A small company feels the same provisioning pain a large one does, so our pricing is a flat monthly rate per workspace. Your invoice is cheap enough to be expensed by a sysadmin or IT manager, and you can immediately justify it based on the value of the groups you've automated. There's no procurement cycle on the lower tiers, no consumption math, and no seat minimum to clear before the math works. You start on a $20/mo Evaluator workspace, and you move up a tier only when the next bit of pain is worth solving.
Essentials is not a watered-down enterprise tool with the useful parts removed until you upgrade. Both tiers run the same platform, with the same data isolation and the same group engine. You are not buying a starter edition you will outgrow in a year. You are buying the whole thing, sized and priced for where you are now, and it grows with you instead of against you.
Honest pricing for Enterprise software
We think you should be able to self-qualify whether our price fits without requesting a quote from sales. Everybody sees our best price on the pricing page. Three flat monthly tiers, with discounts for 1 and 2 year terms. Our sales conversations should not waste time on discount negotiation theater. Our calls focus on your pain points and on finding automation and governance value the website doesn't cover, or that we spot during a demo from past experience.
Every tier is one flat monthly price per workspace, sized by infrastructure isolation and sync frequency:
Every tier is one flat monthly price per workspace, sized by infrastructure isolation and sync frequency:
- Evaluator: $20/mo for a serverless workspace with weekly syncs. Affordable for every team, with a 30 day free trial and no card required.
- Essentials: $200/mo with dedicated compute, database, and encryption key per workspace, and weekday syncs.
- Enterprise: $3,000/mo on a dedicated GCP project with customer-managed encryption keys and always-on infrastructure. Self hosting in your own AWS account or GCP project is available for $1,000 more to cover the cost of the engineers that will help you get Provisionr deployed in your environment.
No Quality Compromises on Engineering
Our handshake agreement with our community and customers is "don't rush our process, and we won't break yours." Those are the mutually assured expectations we live by.
We will usually be later to market than you'd like, but we don't want to be the first. We want to science the hell out of it and get it right. Just ask anyone who's used our API or CLI.
Identity is load-bearing. When it fails, people lose access they need or keep access they should not have, and both are the kind of failure an auditor remembers. We do not ship until it is ready. That sounds obvious, but most of this industry ships on a date and patches toward correctness afterward. We would rather hold a release than put something fragile in front of the access decisions your organization depends on. When we break something, we stop and fix the cause, not just the symptom, so the same crack never has to bear weight again.
We would rather do a few things well than many things poorly, and we're opinionated, so we say no to features that don't align with the platform. We don't try to do everything for everyone.
We will usually be later to market than you'd like, but we don't want to be the first. We want to science the hell out of it and get it right. Just ask anyone who's used our API or CLI.
Identity is load-bearing. When it fails, people lose access they need or keep access they should not have, and both are the kind of failure an auditor remembers. We do not ship until it is ready. That sounds obvious, but most of this industry ships on a date and patches toward correctness afterward. We would rather hold a release than put something fragile in front of the access decisions your organization depends on. When we break something, we stop and fix the cause, not just the symptom, so the same crack never has to bear weight again.
We would rather do a few things well than many things poorly, and we're opinionated, so we say no to features that don't align with the platform. We don't try to do everything for everyone.
Transparency Builds Trust
We expose our roadmap as far out as we have it mapped internally, including the unit economics and pricing, so you can budget ahead and decide for yourself whether our direction fits your identity maturity roadmap.
We share our architecture publicly in our documentation. We come from open-source roots, so the more eyes on it, the more people tell us what's wrong and the more we can harden it. We're all in this together. It also gives customers the visibility to understand how it works under the hood and judge for themselves whether it's a platform they can trust. If our competitors learn something from it, then we've made the world a better, more secure place for everyone.
We're not afraid of someone stealing it. Reproducing it with the same rigor and experience, even with AI, is more expensive than buying it. You can take the blueprints, but that doesn't mean you have the craftsmanship or security experience to build the house. Our platform starts at $20/mo, not $100k, so the build-versus-buy math isn't close. If you want to vibe-code your own auth and compliance from our blueprints, we shall simply say good luck.
We share our architecture publicly in our documentation. We come from open-source roots, so the more eyes on it, the more people tell us what's wrong and the more we can harden it. We're all in this together. It also gives customers the visibility to understand how it works under the hood and judge for themselves whether it's a platform they can trust. If our competitors learn something from it, then we've made the world a better, more secure place for everyone.
We're not afraid of someone stealing it. Reproducing it with the same rigor and experience, even with AI, is more expensive than buying it. You can take the blueprints, but that doesn't mean you have the craftsmanship or security experience to build the house. Our platform starts at $20/mo, not $100k, so the build-versus-buy math isn't close. If you want to vibe-code your own auth and compliance from our blueprints, we shall simply say good luck.
Leadership Team
Jeremy has spent decades in offensive security, penetration testing, and CISO leadership, with a career that runs through the NSA, HPE, Dell, the Department of Energy, and Cylance.
He has made a profession of finding the access that should not exist and the gaps that policy was supposed to close, which is exactly the instinct you want in the person designing a system meant to prevent both. He is the one asking how each decision holds up when someone is actively trying to break it, not just when everything goes right.
That hands-on security depth pairs with strategic range: he holds an executive certificate in AI strategy and innovation from MIT, speaks internationally, and hosts a podcast on how emerging technology reshapes the way organizations operate.
He has made a profession of finding the access that should not exist and the gaps that policy was supposed to close, which is exactly the instinct you want in the person designing a system meant to prevent both. He is the one asking how each decision holds up when someone is actively trying to break it, not just when everything goes right.
That hands-on security depth pairs with strategic range: he holds an executive certificate in AI strategy and innovation from MIT, speaks internationally, and hosts a podcast on how emerging technology reshapes the way organizations operate.
Jeff has spent his career across development, infrastructure, IT, and security focused on building the systems that handle the provisioning: Google Groups, Okta apps, GitLab groups, Slack channels, AWS, GCP, demo and training labs, sandbox infrastructure for engineers, and the elevated administrative access to manage it. We estimate those systems have automated provisioning access for 200,000+ users. Jeff loves automating directory data, migrating brittle scripts into robust self-service platforms, and trying to automate the gathering of evidence for the quarterly access reviews.
He spent eight years at Riverbed followed by six years at GitLab, including founding the GitLab Identity engineering team. He founded Provisionr to fix the root cause of a problem he had been patching by hand for most of his career.
He spent eight years at Riverbed followed by six years at GitLab, including founding the GitLab Identity engineering team. He founded Provisionr to fix the root cause of a problem he had been patching by hand for most of his career.
Jay handles the human side of a company built by nerds, and the human side is where his real strength lies. His background spans finance, operations, and cybersecurity, with deep work in social engineering, the discipline of understanding how people think and behave in practice rather than how a system assumes they will.
That same instinct is what makes him good with customers: he hears what a team is really trying to accomplish underneath the feature requests, and helps them find the value they came for.
He runs sales, operations, legal, and the administrative machinery so the rest of us can keep our attention on customers and the technology. He also brings humor, transparency, and the steadying sense that the business is handled, which is its own kind of expertise engineers tend to underrate until they have to do without it. Keep an eye out for it when you're on a call with us.
That same instinct is what makes him good with customers: he hears what a team is really trying to accomplish underneath the feature requests, and helps them find the value they came for.
He runs sales, operations, legal, and the administrative machinery so the rest of us can keep our attention on customers and the technology. He also brings humor, transparency, and the steadying sense that the business is handled, which is its own kind of expertise engineers tend to underrate until they have to do without it. Keep an eye out for it when you're on a call with us.
Leah comes from cybersecurity and DevSecOps consulting, where she built security programs grounded in business context rather than checklists. Her specialty is translating regulatory requirements into practical action and guiding leaders through the trade-offs that real compliance demands, with a bias toward clarity and sustainable decisions over the illusion of perfection.
That experience points two ways. Inside the company it keeps us honest about the difference between a control that looks met and one that is. Facing customers, it means the person accountable for your success has sat on the other side of an audit, so the questions she asks on your behalf are the ones an examiner will ask later.
Customer success here means making sure Provisionr leaves you more compliant than it found you, with evidence you can defend.
That experience points two ways. Inside the company it keeps us honest about the difference between a control that looks met and one that is. Facing customers, it means the person accountable for your success has sat on the other side of an audit, so the questions she asks on your behalf are the ones an examiner will ask later.
Customer success here means making sure Provisionr leaves you more compliant than it found you, with evidence you can defend.