Pricing
Two paths. One destination.
KeystoneOps is sold as a perpetual licence — owned forever. You can buy it outright (self-hosted, full ownership day one) or subscribe to managed hosting which builds credit toward the perpetual licence over three years. At the end you own the licence either way. No per-seat tax. Excluding VAT.
Founding Trust Programme — 20% off for three years
A limited number of founding places. Shape the roadmap, get priority support, and lock in the discount on any tier below.
Self-hosted
One-time perpetual licence. Full ownership from day one.
- Full control over your infrastructure
- Your data stays on your servers
- No ongoing fees (20% maintenance optional)
- Full source code access
- Spreadable over 2–3 budget years — same total
Managed Hosted
We host while you build toward ownership.
- UK datacentres, single-tenant — never co-mingled
- We handle infrastructure, backups, upgrades
- Subscription builds credit toward perpetual licence
- Migrate to self-hosted anytime — licence travels with you
Managed Hosted — Path to Ownership
An annual subscription that builds toward perpetual ownership.
Plenty of trusts don't have the infrastructure or in-house expertise to host a Laravel + Postgres stack — and don't want to. The managed path gives you the operational simplicity of SaaS without the lock-in.
How the managed path works
Three years of fully-managed hosting — then the perpetual licence is yours. Small MAT tier shown.
Year 1
£7,800
Managed & fully supported
Paid so far £7,800
Year 2
£7,800
Managed & fully supported
Paid so far £15,600
Year 3
£7,800
Managed & fully supported
Paid so far £23,400
From year 4 the perpetual licence is yours — no further licence fee, ever.
Self-host it
Move to your own infrastructure whenever you like. You hold the licence and the source — nothing more to pay.
Stay managed
We keep hosting it — but at a hosting-only rate, with the licence cost dropped away.
£7,800/yr × 3 (£23,400, incl. hosting & support) — or own outright from day one for £15,000.
See your tierWant to self-host sooner? Pay the outstanding licence balance any time and migrate on your schedule. Your data + your licence travel with you.
Tier ladder
Banded by trust size. Both paths.
Single Academy
1 academy
Self-hosted
£4,500
one-time
Managed
£2,500
/year, yrs 1-3
5-year managed total: £9,500 + you own the licence
≈ £2.00 per pupil per year*
Starter MAT
2–5 academies
Self-hosted
£9,500
one-time
Managed
£4,700
/year, yrs 1-3
5-year managed total: £17,700 + you own the licence
≈ £1.21 per pupil per year*
Small MAT
6–10 academies
Self-hosted
£15,000
one-time
Managed
£7,800
/year, yrs 1-3
5-year managed total: £29,400 + you own the licence
≈ 83p per pupil per year*
Medium MAT
11–20 academies
Self-hosted
£26,500
one-time
Managed
£14,000
/year, yrs 1-3
5-year managed total: £52,400 + you own the licence
≈ 76p per pupil per year*
Large MAT
21–30 academies
Self-hosted
£41,000
one-time
Managed
£21,000
/year, yrs 1-3
5-year managed total: £77,400 + you own the licence
≈ 71p per pupil per year*
Enterprise MAT
31+ academies
Self-hosted
£82,500
one-time
Managed
£36,000
/year, yrs 1-3
5-year managed total: £132,000 + you own the licence
≈ £1.18 per pupil per year*
Dedicated bare-metal hardware included
Above 50 academies, contact us — pricing flattens for very large trusts.
*Self-hosted licence over a 5-year view, assuming ~450 pupils per academy at the band midpoint — for benchmarking against per-seat SaaS, where one agent licence often costs more than your whole trust does here.
Spread the licence
Self-hosting doesn't have to mean one invoice: split the same licence total across two or three budget years. Same ownership from day one — ask for the schedule.
Growth protection
Take on more academies and move up a band paying only the difference — your existing licence credits in full. Growth should never feel like a penalty clause.
The honest comparison
5-year cost vs the SaaS stack you're replacing.
Toggle between self-hosted and managed to see both paths against your current spend. The wedge holds either way; the size of it differs by route.
Cost calculator
5-year total cost of ownership
Pick your trust shape, your hosting preference, and the SaaS products you're currently replacing. Edit the annual prices inline with your real invoice numbers for an honest comparison. You own the licence at the end either way — the path differs by year.
Click to add. Edit each annual cost with your real invoice number — the seeded values are illustrative estimates only.
5-year SaaS spend
£158,400
- FreshService£86,400
- Bolt-on SCR / safeguarding£72,000
And you never own anything — keep paying or lose access.
5-year KeystoneOps — managed
£29,400
- Years 1–3 — managed subscription£23,400Each payment builds credit toward the perpetual licence
- Month 36 — you own the licence outright—(equivalent perpetual value: £15,000)
- Years 4–5 — hosting-only (or £0 if self-hosted)£6,000Reduced rate now licence is owned
✓ Plus you own the licence forever.
Self-hosted from day one would be £27,000 over 5 years (£2,400 less, but you need the infra to run it).
Net saving over 5 years
£129,000 — that's 81% less.
Plus: one vendor instead of 2, one DPIA, one renewal cycle, one finance approval per year — and at the end, you own the licence.
Branded PDF with your selections + savings + procurement boilerplate (security overview, sample contract, DPIA scaffolding). Generated server-side, downloads instantly.
Calculator is illustrative. All figures excluding VAT. Real pricing in our reply, with a quote you can take to your governors.
What's included
Every tier ships with everything.
- All 11 products across four suites — Service & Identity, People & Recruitment, Compliance & Estates, Governance & Leadership — plus platform admin
- Unlimited users — staff, agents, requesters, governors
- Unlimited academies (within your tier)
- Native e-signature — offers, contracts, policy acknowledgements; no per-envelope fees
- All future minor releases (1.x → 1.y)
- Email support during UK office hours
- On-prem network discovery agents
- REST API access
- Wonde MIS integration
- SSO via Entra / Google / SAML / OIDC / LDAP
- Self-service migration toolkit — import from FreshService / Civica / ServiceNow / Every / Wonde / GovernorHub / CSV
- Managed hosting (when chosen) on UK datacentres only — single-tenant
- Enterprise MAT tier ships on dedicated bare-metal hardware
Optional + how it's priced
No surprise add-ons.
- Major version upgrades (1.x → 2.x)
- Included in maintenance / managed
- Tier upgrade when the trust grows
- Pay only the band difference — licence credits in full
- Security patches (Keystone Security Advisories)
- Always included — maintenance or not
- Custom integration build
- Quoted separately
- API webhook / event firehose
- Built in
- Sandbox / staging environment
- Included on managed; provisioned for self-hosted
- Read-only inspector / auditor account
- Built in, no charge
- Source code escrow (third-party)
- Setup at cost, optional
- Off-boarding / data export pack
- Always free, on request
- AI: ticket triage + reply copilot (agent-side)
- Included — BYO key, no markup
- AI: Ask AI portal deflection (staff self-serve)
- Included — BYO key, no markup
- AI: Keystone Intelligent Assist + anomaly detection (executive)
- Included — BYO key, no markup
- AI: weekly headteacher briefing
- Included — BYO key, no markup
- AI infrastructure (Azure OpenAI / hosted Llama)
- BYO key, or managed credentials — cost-capped
From signature to live
Migration is included. Here's what it actually looks like.
A typical small-MAT cutover runs 4–6 weeks from signature. It's agreed with you, not imposed — go faster, or phase it school-by-school, as suits your year.
- Week 0
Kick-off + provisioning
A scoping conversation by email, an agreed go-live date, and your single-tenant instance stood up with your academy structure and branding.
- Weeks 1–3
Data migration
We export from FreshService / Civica / your spreadsheet SCR, map and load it, and you validate it against your live data before anything is trusted. Included in the licence.
- Weeks 2–4
Configuration (in parallel)
SSO, ticket types, departments, compliance schedules and SCR check sets mirrored from how you work today — not a blank slate you have to build.
- Weeks 3–5
Pilot + enablement
A pilot group runs it live alongside the old system. Written guides plus a walkthrough; the product is shaped around trust workflows, so training is light. We adjust on your feedback.
- Weeks 4–6
Go live
Full cutover. The old system stays read-only for an agreed handover window so nothing is lost in transition.
Support + SLA, once you're live
Email support in UK office hours with published response targets — P1 within 4 business hours — identical whether you self-host or take managed; the 99.9% monthly uptime target applies to the managed path. Security patches reach every licensed trust regardless of maintenance status. The full, signed SLA is in the procurement guidance, and the common questions are answered in the FAQ.
Timeline is indicative for a small MAT and agreed per trust — not a fixed contractual schedule.
Take the calculator to the next finance meeting.
We'll generate a procurement-pack PDF with the numbers above for your specific trust shape and chosen path, plus a sample contract, a security overview, and DPIA scaffolding — no obligation, no follow-up if it's not for you.