JFrog Licensing Explained: Cloud and Self-Hosted Tiers Compared
This page answers the JFrog licensing questions buyers actually ask — which tier you need, why cloud “Pro” and self-hosted “Pro X” are not the same thing, how the consumption model works, and where JFrog bills surprise people. Figures are JFrog list prices in USD.
The short answer: JFrog Cloud is a flat subscription plus metered consumption, and the base consumption allowance is far smaller than the tier is designed for — Pro includes 25 GB but is positioned for teams using around 2 TB. That gap is pure overage, and JFrog does not publish the overage rate — we can get you the current rate card and a quote before you sign. Self-hosted is licensed per server on an annual minimum, also quote-only, and the Enterprise X entitlement of three servers exactly covers a minimum HA cluster with nothing left for non-production.
What are the current JFrog tiers?
The first thing to get straight is that cloud and self-hosted use different tier names, and the similar-sounding ones do not include the same things.
JFrog Cloud (SaaS)
| Tier | Starting price | Base consumption | Security scanning |
|---|---|---|---|
| Pro | From $150/month | 25 GB | Not included |
| Enterprise X | From $950/month | 125 GB | Xray included |
| Enterprise + | Custom | Custom | Xray included |
Self-hosted
| Tier | Servers included | Artifactory | Xray | Advanced Security | HA |
|---|---|---|---|---|---|
| Pro X | 1 | Yes | Yes | No | No |
| Enterprise X | 3 | Yes | Yes | Add-on | Yes |
| Enterprise + | 6 | Yes | Yes | Add-on | Yes |
Cloud Pro and self-hosted Pro X are different products at different price points. Self-hosted Pro X includes Xray. Cloud Pro does not — on cloud, security scanning starts at Enterprise X. If you are comparing a self-hosted quote against a cloud quote, check what each one actually includes before comparing the numbers.
Is there still a free tier?
Not a free-forever SaaS tier. JFrog now offers a read-only platform tour and a 14-day trial. The one surviving free product is JFrog Container Registry, available for on-premises deployments only, with container-registry functionality alone.
How does JFrog’s consumption pricing actually work?
This is the part that determines your bill, and it is not per-user.
Each cloud subscription includes a base amount of monthly consumption, and consumption pools storage and data transfer into a single metered number. There is no separate storage allowance and transfer allowance — they draw from the same pot. Exceeding it does not block your account; it adds charges to that month’s bill automatically.
Now compare the included allowance against JFrog’s own sizing guidance:
| Tier | Base consumption included | JFrog’s stated sizing guidance | Gap |
|---|---|---|---|
| Pro | 25 GB | Up to ~50 users, ~2 TB consumption | ~1,975 GB of overage |
| Enterprise X | 125 GB | Up to ~300 users, ~20 TB consumption | ~19,875 GB of overage |
This is the single biggest gotcha in JFrog’s commercial model, and JFrog does not publish the overage rate. We could not find a dollar-per-GB figure anywhere in JFrog’s own documentation, and the third-party estimates in circulation disagree with each other by more than an order of magnitude. Treat any online figure as unreliable. As a JFrog partner we can get you the current overage rate card and model it against your actual expected consumption before you sign — contact us for details or a special quote. Better consumption rates are also available on annual contracts at Enterprise X and above, and we will make sure those are on the table.
When do I need Enterprise X versus Enterprise +?
JFrog’s own answer is consumption-driven: 2–20 TB points to Enterprise X, above 20 TB to a custom Enterprise +. But in practice the decision is usually forced by a feature, not a volume:
Move to Enterprise X when you need: Xray security scanning on cloud, high availability, multi-site push replication, load balancing, enterprise access controls (OAuth, SAML, CName), or a 24/7 support SLA.
Move to Enterprise + when you need: JFrog Distribution and Edge Nodes, Access Federation, more than three servers, more than 30 projects, disaster recovery, Mission Control, AppTrust, or JFrog ML.
The HA headroom problem
High availability requires Enterprise X or Enterprise + — Pro and Pro X cannot do HA at all. And a three-node cluster is required for no-downtime upgrades. Enterprise X includes exactly three servers. That covers your minimum production HA cluster and leaves nothing for staging, test or DR. Additional servers are a substantial line item each, so size the server count deliberately rather than discovering the shortfall during implementation.
Whether each HA node draws from a licence bucket is not clearly documented. Since licensing is per server, assume every non-production and DR server consumes an entitlement unless you have an exception confirmed in writing. We can get that confirmed and priced as part of a quote.
How does JFrog count users?
Platform users are not the billing unit for the base subscription — consumption is. But the security modules bill per “contributing developer,” and that definition is broader than it sounds.
JFrog defines a contributing developer as anyone who contributes to the creation or update of an artifact or project scanned by Advanced Security in the last 90 days. JFrog’s cloud agreement broadens this further to include creating, modifying, configuring or updating code, scripts or artifacts — or by downloading public packages.
Two consequences worth planning for:
- “Downloading public packages” can sweep in people you would never describe as developers. Data scientists, QA, anyone pulling a dependency through Artifactory.
- The 90-day trailing window means contractors and short-term staff keep counting for a quarter after they leave.
Advanced Security at Enterprise X includes 50 base contributing developers per month; Enterprise + includes 200. Additional developers are sold in blocks, at roughly $420 per contributing developer per year at list. Curation is priced on the same basis.
Where JFrog contracts catch buyers out
Prepaid annual subscriptions do not auto-renew
This one runs opposite to most people’s instincts. JFrog’s monthly subscriptions auto-renew and are terminable on 30 days’ notice. Prepaid annual subscriptions have a 12-month minimum and expire unless a new order form is executed. If nobody is watching the renewal date, the risk is not an unwanted renewal — it is an outage.
Projects are hard-capped, and Pro cannot be extended
Pro and Pro X allow up to 3 projects with no option to extend within that subscription — it is a wall, not a threshold. Enterprise allows up to 30, Enterprise + up to 300, extendable in blocks of 100. If your organisation models teams as JFrog projects, this constraint will dictate your tier well before consumption does.
Replication capability is tiered
Pro X gets single replication between two instances only. Multi-site push replication and load balancing require Enterprise X or above. Access Federation and Distribution Edge Nodes are Enterprise + exclusive, with edge nodes sold in packs of ten.
Prices rise annually
Self-hosted Enterprise X list pricing rose roughly 5% in January 2025 and roughly 6% in January 2026. Self-hosted Pro X rose 15% in 2025 and was unchanged in 2026. If you are signing multi-year, negotiate a cap on annual uplift rather than assuming today’s price holds.
Support is a percentage at the top end
At higher contract values JFrog’s premium support tiers are priced as a percentage of total contract value rather than a flat fee. Factor it into the total, not as a rounding error.
What happened to JFrog Pipelines and Insight?
Both are end of life. JFrog Pipelines reached end of life on 1 May 2026. JFrog Insight reached end of life in February 2025 for cloud and end of Q2 2025 for self-hosted. If your CI still runs on Pipelines, migration is not a future project. Mission Control’s status is genuinely ambiguous — it is still listed as an Enterprise + entitlement, but an end-of-life notice also exists. Contact us and we will confirm its current status before you build a plan around it.
Frequently asked questions
Is Xray included?
On self-hosted Pro X, yes. On cloud Pro, no — cloud scanning starts at Enterprise X. JFrog Advanced Security is a separate paid add-on even at Enterprise X and Enterprise +, so “we have Xray” and “we have Advanced Security” are two different statements.
How much does storage overage cost?
JFrog does not publish it. This is the most important missing number in any JFrog quote, and published third-party estimates vary by more than fifteen times, which tells you how little they are worth. Contact us and we will get you the current rate card alongside a quote, so you are pricing against real numbers.
Do I need Enterprise for high availability?
Yes. HA requires Enterprise X or Enterprise + on self-hosted. Pro and Pro X cannot run HA in any configuration.
Is there a limit on repositories or package types?
We found no per-tier cap on repository count or package types in JFrog’s documentation — Pro X is marketed as supporting 27+ package types. Projects, however, are capped, and that is the limit that bites.
Cloud or self-hosted — which is cheaper?
It depends entirely on the unpublished overage rate, which is why we keep coming back to it. Cloud starts low and scales with consumption; self-hosted starts considerably higher and scales with server count. For a binary-heavy estate with large artifacts and high transfer volumes, self-hosted often wins on a three-year view. For a smaller team with modest storage, cloud usually does. Model both against real consumption figures from your existing repository.
Which clouds and regions does JFrog SaaS run in?
AWS, Azure and Google Cloud, across multiple regions. Host and region choice is offered at all tiers; multiple regions on a single contract requires Enterprise X or above. JFrog exposes the specific region list through its API rather than publishing it, so ask for the current list for your chosen provider.
Can I run non-production and DR instances without extra licences?
JFrog’s published terms do not address this. Since licensing is per server, plan on the basis that every non-production and DR server consumes an entitlement. If you need an exception, contact us and we will get it confirmed in writing and reflected in your quote.
Pricing, tiers and licensing terms verified 18 September 2026 against JFrog’s published pricing page, cloud subscription agreement, feature matrices and release information. Self-hosted list pricing is not published by JFrog. ReleaseTEAM is a JFrog partner and implements, migrates and manages Artifactory and Xray environments.
Get the consumption maths right before you sign
We size JFrog against real repository data — actual storage growth, actual transfer volumes, actual contributing developer counts — so the quote you accept is the bill you get.
Speak With An Expert