TeamsBusiness
Business
Company sign-in, directory sync and the rule that members use them, for teams that run on an identity provider or need more than 25 seats. Everything else a team does works without it.
+$15 a seat a month, or $150 a seat a year
On top of seats at $100 each, bought once.What it adds
Business is services we run for your team every month. The software itself is yours from the seat.
Members sign in through your identity provider, such as Okta, Microsoft Entra ID or Google Workspace, over SAML 2.0 or OpenID Connect. It answers only for addresses at domains your team has proven it owns.
Your directory tells ZestSSH who joins, who leaves and which groups they are in, and groups map to roles. Removals take effect at once; anything that gives access waits for an owner or admin, who confirms it on their own device.
A team rule, checked by ZestSSH Cloud on every request: members sign in through your company sign-in, not with a password, Google or Apple.
Up to 1,000 seats, bought up to 250 at a time, still $100 each and once. For a larger team, write to support@zestssh.com.
Questions from Business teams are answered first, and we aim to answer within one business day. We help you connect your identity provider and your directory.
Setting it up
Owners set it up on the Team page, under Sign-in. Each change asks for a sign-in from the last ten minutes.
Add a TXT record that starts with zestssh-verify= where you manage DNS.
SAML or OIDC. Copy the reply URL and entity ID, or the redirect URI, from the app.
Sign in with an address at a proven domain. It does not change who is signed in.
People at your domains can now sign in with SSO. Require it with a rule, if you choose.
Your directory can only take access away by itself. Inviting someone or giving a higher role waits for an owner or admin, who confirms it on their own device with the team’s usual signed changes. Neither your directory nor ZestSSH Cloud can sign those.
Without Business
None of these need Business, and none of them stop if it ends.
Everything Business adds works. Cancelled, it stays active until the date it was paid to.
Directory sync and the company sign-in rule keep working. Company sign-in cannot be changed until what is due is paid.
Directory sync stops, and the company sign-in rule is no longer applied, so nobody is locked out. People still sign in through company sign-in. The seats stay, all of them.
The cost
Prices in US dollars, before any tax. More than 25 seats needs Business.
Company sign-in
For company sign-in, or more than 25 seats.
$100per seat, once
+ $15per seat a month, or $150 per seat a year
Everything in Team, on the same permanent $100 seat, plus
If unpaidSeats keep working
For 2 to 25 people.
$100per seat, once
Squeezed and Juiced for every member, plus
Holding the Bundle (Squeezed + Juiced)? Your own first seat is included.
Next billNever
No. Short-lived SSH certificates, version history, activity and event export come with every Team. Business adds company sign-in, directory sync, the company sign-in rule, more than 25 seats, and priority support with help setting up.
The software keeps working. For 14 days after the paid time ends nothing changes, except that company sign-in cannot be changed. After that, directory sync stops and the company sign-in rule is no longer applied, so nobody is locked out. People still sign in through company sign-in, the seats stay, and everything else in the team works as before.
Per seat, $15 a month or $150 a year, for every seat the team has, an owner’s Bundle seat included. It follows the seats: buying more adds them, and Stripe works out the difference for the time left. A team needs its first 2 seats before it can subscribe.
Cancel at any time, from the Buy seats page or Stripe’s billing page. Business stays on until the end of the month or year already paid, and is not charged again. Business payments are not refunded. Seats are a one-time purchase and keep their own 30-day refund.
Questions from Business teams are answered before any others, and we aim to answer within one business day. It is an aim, not a guaranteed response time or service level.
No. Every seat is $100, bought once, with or without Business. Business is the only part of ZestSSH that is billed by the month or the year.
Any provider that speaks SAML 2.0 or OpenID Connect (with the authorization code flow), such as Okta, Microsoft Entra ID or Google Workspace. Directory sync works with Microsoft Entra ID, Okta and any other directory that speaks SCIM 2.0.
No. An OpenID Connect client secret goes only to Identity Platform, the sign-in service behind ZestSSH accounts. A SAML certificate is kept as its fingerprint and the date it runs out. The directory token is shown once, to you.
An owner turns Business on from the team's seats page on zestssh.com. Monthly or yearly, per seat.
