Feature flags on flat plans with unlimited seats and users, and SAML SSO and SCIM even on the free plan.
ConfigCat prices flags by plan, not by user: every plan has unlimited seats, MAU and flag reads, and the SDKs evaluate flags from a locally cached config file, so only downloads of that file count. 2FA, SAML SSO and SCIM are listed on every plan, including Forever Free, and the main infrastructure is in the EU. Teams that only need flags and remote config get identity-provider controls without an enterprise contract.
No user or seat billingSeats, service connections, MAU and flag reads are unlimited on every plan; plans differ in flags, environments, downloads and traffic.Evidence: Pricing page (2026-10-15)
SAML SSO and SCIM on every planThe pricing table lists 2FA, SSO, SAML and SCIM user provisioning across all plans, including Forever Free.Evidence: Pricing page (2026-10-15)
EU infrastructure and ISO 27001The FAQ says the main infrastructure and database are in the EU, with an EU-only CDN option; the trust center lists ISO 27001:2022 and a DPA.Evidence: FAQ, data governance docs and trust center (2026-10-15)
Best for
Teams that want flags and remote config at a flat price, with SSO and EU data, and run experiments in a separate analytics tool.
Good to know
ConfigCat lists no built-in experiment analysis, and Forever Free is limited to 10 flags and 2 environments.
How ConfigCat compares
Against 3 other products we reviewed in Feature flags: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
ConfigCat compared with Statsig, LaunchDarkly, Flagsmith
Worth the priceFeature flags on flat plans with unlimited seats and users, and SAML SSO and SCIM even on the free plan.
Worth the priceFeature flags and full A/B testing on a free plan with unlimited seats, billed only for analytics events, not for flag checks.
Saves engineering timeFeature flags and experiments on one platform with unlimited seats, free to 1,000 client-side users and $8.33 per 1,000 after that.
Worth the priceUnlimited flags and environments on every plan, an open-source core you can self-host, and SOC 2 Type II on the hosted service.
Overall score
6.0
8.7Best
6.5
5.1
Free option
Free plan
Free plan
Free plan
Free plan
Card to start
No card needed
No card needed
No card needed
–Not measured
Getting access
Self-serve
Self-serve
Self-serve
Self-serve
Starter priceCheapest paid plan
$110/mo
$150/mo
$8.33/1k client-side MAU/mo
$40/mo
Pricing model
Tiered
Tiered
Usage-based
Tiered
Pricing page
Public prices
Public prices
Public prices
Public prices
Billing units
Flat plans sized by config JSON downloads and network traffic
Metered events (exposures with Metric Lifts, logged events)
2 million metered events/mo, unlimited flag checks and seats
1,000 client-side MAU, 5 service connections, unlimited seats and flags
50,000 requests/mo, 1 team member, unlimited flags
Reference scenario (50,000 MAU)
$110 on Pro, billed annually, if downloads stay near 15M
$0 on Developer, if no metered events
$416.50 on Foundation, billed yearly, computed
$500 on Scale-Up, billed yearly, computed
A/B testing
Not listed; flag data sent to analytics tools
All plans, incl. CUPED and sequential testing
All plans; 100,000 experimentation MAU on Developer
Multivariate flags; built-in analysis in beta
SOC 2 Type II and ISO 27001
ISO 27001:2022
SOC 2 Type II (Statsig report); ISO certificate listed is Amplitude’s
Both
SOC 2 Type II; not ISO 27001 certified
HIPAA BAA
Not stated
Enterprise
Through an account executive
Private cloud and self-hosted only
EU data region
Main infrastructure in the EU; EU-only CDN option
EU hosting on Enterprise
EU instance for new Enterprise accounts and trials
SaaS data in London (UK); region choice on private cloud
SAML SSO
Every plan, incl. Free
Enterprise
Enterprise
Scale-Up on the pricing page; Enterprise in the docs
Audit log
7 days on Free, 35 days on Pro
Change logs on every plan
Enterprise
Scale-Up and Enterprise
Seats
Unlimited, no per-seat charge
Unlimited, no per-seat charge
Unlimited, no per-seat charge
5 on Scale-Up, then $50 per member (yearly)
Bottom line
From its public pages, ConfigCat is the most focused flag service here, with the most team controls on its free plan. Its score reflects no built-in experimentation and a shorter compliance list.
From its public pages, Statsig gives the most for nothing here: unlimited seats and flag checks, with experiments and analytics on the free plan. SSO and EU hosting need Enterprise, and the product now sits within Amplitude.
From its public pages, LaunchDarkly is the broadest platform here, with experiments on every plan and a long compliance list. Client-side users drive the bill, and SSO and audit logging are listed for Enterprise.
From its public pages, Flagsmith offers unlimited flags on every plan, an open-source core and SOC 2 Type II. Team size sets the price, and a few plan details differ between its pricing page and docs.
Evidence: ConfigCat: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Statsig: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; LaunchDarkly: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Flagsmith: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
billed by config JSON downloads and network traffic (GB); the scenario is priced on the page
Free tier
7.0 / 10, Good
5 million config JSON downloads and 20 GB a month, unlimited seats, 10 flags, does not cover the reference scenario
Price for 50,000 monthly users
6.0 / 10, Good
$110/mo: Pro billed annually: 100 flags, 3 environments, 25 million downloads and 100 GB a month; assumes downloads follow ConfigCat's own docs example (5 hours a month per user, 60-second polling): 50,000 × 300 = 15 million
Experimentation and rollout safety
1.0 / 10, Fair
no built-in A/B analysis; flag data sent to analytics tools; no rollout metric monitoring listed
Compliance and data residency
4.0 / 10, Fair
no SOC 2 Type II stated, ISO 27001, EU data region
Team and control
10.0 / 10, Excellent
SAML SSO on the free plan; audit log on the free plan; no per-seat charge; open-source SDKs; OpenFeature providers; self-hosted option
Review
Review from public pages
Written from ConfigCat's public pages (pricing, security or privacy, and docs) as read on Oct 15, 2026. We did not sign up, and no hands-on run is published yet.
What the public pages show
We read ConfigCat's pricing page, its trust center, its FAQ and its docs on config JSON downloads, network traffic, data governance, SAML and OpenFeature on Oct 15, 2026; we did not sign up for this review. The pricing page has five plans with prices for annual or monthly billing and in four currencies, and says the Forever Free plan has the same feature set as the paid plans; what changes is the number of flags, environments, products, targeting rules and the download and traffic quotas.
The pricing model follows the architecture. SDKs download a config JSON file from ConfigCat's CDN, cache it and evaluate flags locally, so only downloads count, not users or flag checks. The docs work an example: a web app user active 5 hours a month with the default 60-second polling makes 300 downloads a month. If a plan's limit is reached, the docs say the application keeps running and ConfigCat will get in touch.
What stood out is how much identity control sits on the free plan: 2FA, SAML SSO and SCIM are listed across every plan.
Strengths
SAML SSO and SCIM on the free plan
The pricing table lists 2FA, SSO, SAML and SCIM on all plans, including Forever Free.
vs LaunchDarkly: LaunchDarkly and Statsig list SSO on Enterprise.
No per-user billing
Seats, MAU, service connections and flag reads are unlimited on every plan; you pick a plan by flags and download volume.
EU data by default
The FAQ says the main infrastructure and database are in the EU, and the EU-only CDN option keeps config files in the EU.
Many exit and hosting options
Open-source SDKs, OpenFeature providers, a JSON export of each product and a Dedicated plan that can run on your own servers.
Things to know
No built-in experiment analysis
The pricing page lists no A/B test analysis; the docs describe sending flag evaluations to Amplitude, Mixpanel, Google Analytics or Segment.
Workaround: Percentage options and the analytics integrations let you analyse a rollout in a tool you already use.
Free plan is small for production
Forever Free allows 10 flags, 2 environments and 5 million downloads a month.
No SOC 2 or HIPAA listed
The trust center lists ISO 27001:2022 and a DPA, but no SOC 2 report or HIPAA BAA.
Downloads depend on polling
Usage depends on users, session length and polling interval, so the right plan takes an estimate.
Pricing reality
ConfigCat sells flat plans: Pro $110 a month billed annually ($120 monthly), Smart $325 ($360), Enterprise $900 ($1,000) and Dedicated $4,500 billed annually. Each plan includes a download and traffic quota (25 million and 100 GB on Pro), and Pro can add 25 million downloads and 100 GB for $95 a month. Seats and users are not charged.
For our scenario, ConfigCat's own docs example gives 300 downloads per user a month, so 50,000 users make 15 million, and a backend polling every minute in 2 environments adds about 86,400 (our arithmetic). That fits Pro at $110 a month; 30 flags also exceed Forever Free's limit of 10. Longer sessions or shorter polling raise the count.
Exit path
The FAQ says you can export a product as a standard JSON file at any time, including flags, targeting rules, segments and tags. SDKs are open source on GitHub, OpenFeature providers are documented, and Enterprise and Dedicated customers can add a source-code escrow for an extra cost.
You need SAML SSO, SCIM or EU data storage on a self-serve plan.
Pick Statsig when
You want A/B tests and product analytics built in, on a free plan.
Choose it if
You want feature flags and remote config at a flat price.
You need SAML SSO or SCIM without an enterprise contract.
You want your data in the EU or an on-premise option later.
Look elsewhere if
You want experiment analysis inside the flag tool.
Your security review requires a SOC 2 report or a HIPAA BAA.
Bottom line
From its public pages, ConfigCat is the most focused flag service here, with the most team controls on its free plan. Its score reflects no built-in experimentation and a shorter compliance list.
Plan limits at a glance
Limit
As recorded
Billing units
Flat plans sized by config JSON downloads and network traffic
We read the pricing, security and docs pages of three feature flag services on the same day and scored them on the same six indicators. How each one bills, what 50,000 monthly users cost, and who should pick which.