Service tiers
Three tiers. One contract.
Start with CVE patches. Add architectural assurance when you need auditors satisfied. Add managed operations when you need us holding the pager.
Trusted globally by enterprises
OSSeva Patch
CVE remediation only.
Drop-in patched binaries for your EOL runtime, delivered quarterly or out-of-cycle for CVSS 9+ issues. Signed artifacts, repo manager integration, vulnerability disclosures.
- Quarterly CVE patches for all covered versions
- Signed artifacts (GPG + Sigstore)
- Helm / Maven / OCI registry delivery
- Vulnerability disclosure notifications
- Version compatibility matrix
- Architecture review
- Compliance attestations
- 24/7 managed operations
- Incident response SLA
OSSeva Assure
Patch + architecture + compliance.
Everything in Patch, plus an annual configuration and architecture review, version-upgrade planning, and the compliance documentation your auditors require.
- Everything in Patch
- Annual configuration & architecture audit
- Version upgrade planning
- SOC 2 / HIPAA / PCI / ISO 27001 compliance evidence package
- Pen-test validation summary
- Reference architecture for your deployment
- Named architecture consultant
- 24/7 reactive support
- 24/7 managed operations
- Incident response SLA
OSSeva Operate
Full MSP. We hold the pager.
24/7 monitored operations, proactive incident management, and named senior engineers who know your system — with a 15-minute P1 SLA (OSSeva Operate) and quarterly business reviews.
- Everything in Assure
- 24/7 proactive monitoring & alerting
- 15-minute P1 incident response SLA
- Named senior engineer on your account
- Runbook authoring and maintenance
- Quarterly business reviews
- On-call escalation to senior OSSeva engineers
- Capacity planning & scaling support
- Incident post-mortems & prevention
Want to know the state of your databases first?
The database health check is a fixed-scope review of PostgreSQL, MySQL and MongoDB clusters with a written findings report and an end-of-life readiness assessment. No subscription.
See the database health check →Need a one-off engagement?
Architecture audits, migration design, training, and hardening engagements are available as fixed-scope, fixed-fee professional services — without a recurring subscription.
See Professional Services →What is included in OSSeva Patch?
OSSeva Patch includes: CVE discovery and triage for all covered technologies, backported security patches to EOL versions, signed binary builds delivered via Docker/Helm/tarball, SHA-256 checksums, CVE attestation letters for each release, and a dedicated Slack channel with monthly patch release notifications.
What is the SLA for critical CVE patches?
For CVSS ≥ 9.0 (Critical), OSSeva patches within 48 hours. For High severity, it patches within 7 days. Everything else goes into a quarterly batch. A 15-minute P1 incident response is part of the OSSeva Operate tier.
What is OSSeva Assure?
OSSeva Assure is OSSeva Patch plus architectural assurance and compliance documentation. It includes everything in Patch, plus: compliance evidence matrices mapped to SOC 2, PCI DSS, HIPAA, ISO 27001, DORA, and FedRAMP controls; an architectural review of your deployment for security configuration gaps; and audit attestation letters signed by OSSeva's compliance team. Most customers in regulated industries (financial services, healthcare, government) start here.
What is OSSeva Operate?
OSSeva Operate is full managed operations on top of Assure. It adds: 24/7 incident response with defined P1/P2/P3 response SLAs, infrastructure monitoring and alerting, capacity planning and performance reviews, version upgrade planning, and optional on-call engineering coverage. It is designed for teams that want to treat their OSS infrastructure as managed rather than self-operated.
How is OSSeva priced?
OSSeva pricing is based on the technologies covered, the tier selected (Patch, Assure, or Operate), and the deployment scale. Unlike commercial vendors such as Broadcom Tanzu, OSSeva does not use per-core or per-socket licensing models. Pricing is scoped per engagement on a discovery call. Most customers see 60–80% cost savings compared to equivalent commercial support contracts.
What is the minimum contract term?
OSSeva engagements are structured as annual contracts, typically with a 12-month initial term. Multi-year commitments are available with pricing advantages. There is no trial period, but the discovery call and proposal process is scoped to ensure the engagement is a fit before any commitment.
Get a quote
Not sure which tier fits your team?
The discovery call is free and takes 15 minutes. We scope your coverage needs and recommend the right tier — no pressure to sign anything that day.
Prefer to talk or read more first?