Instatus
Instatus, Inc ·instatus.com· As of: 2026-09-28
Work through this tool with an AI
Our verdict
A competitor can set up a status page in an hour (estimate). Without one, you answer the same question a hundred times in the inbox at the first larger outage. The Instatus documents carry traces of a template: the policies note that they were adapted from Basecamp, and the page on the uptime commitment still describes the product in Basecamp's words as the place for decisions, designs and company announcements. Anyone selling to a large enterprise exposes their own status page to its review.
Evidence:Plan prices: Starter free, Pro 20 USD and Business 300 USD a month, 15 and 225 USD on annual billing; Starter with 15 monitors and 200 subscribers, Pro with 50 monitors and 5,000 subscribers, Business with 1,000 monitors, SAML and 25,000 subscribers (variants Private Pro 50 USD and Select 100 USD, billing per status page)Open sourceThe page on the General Data Protection Regulation links the data processing agreement as a public PDF (revision of 23 June 2022); it calls itself part of the terms of service, contains the 2021 EU standard contractual clauses under Danish law and describes Instatus, Inc as a Delaware C Corporation; countersignature is possible via instatus.com/dpa at Dropbox SignOpen sourceThe subprocessor list names eight services, all located in the United States: Vercel, Amazon Web Services, Mailgun, Paddle, Google Analytics, Sentry, Twilio and WorkOSOpen sourceThe help page on SAML sign-in names the Business plan as a prerequisite and routes the setup through a service called OrbitIDOpen sourceThe privacy policy says the site is operated from Egypt and hosted in the United States, and that anyone using the site or a service consents to the transfer; after cancellation nothing is stored for longer than 30 daysOpen sourceThe official participant list of the EU-US Data Privacy Framework returns no match for a search for Instatus; the same search for a listed company returns one as a cross-checkOpen sourceThe security whitepaper says a SOC audit has not been completed, the databases are not encrypted at rest and staff are not background-checked; the data centres are at Amazon Web Services in the United StatesOpen sourceThe terms of service name Instatus, Inc as the contracting party without state of incorporation, address, governing law or venue and reserve changes without notice; deletion happens within 30 days from live systems and within 60 days from backupsOpen sourceThe page on the uptime commitment promises 99 percent monthly for Pro and describes the product as the place where decisions are made, designs are shared and company announcements are broadcast; the policies carry the note that they were adapted from BasecampOpen sourceThe cancellation policy says the account is inaccessible immediately after cancellation, data is deleted within 30 days from live systems and within 60 days from backups, and free accounts are deleted after 365 days of inactivityOpen sourceThe activity log keeps a history per incident, maintenance and template on all plans; the administrator view of changes to the team and the status page is visible only to administrators on the Business planOpen sourceThe /open page, marked “Updated August 25” without a year, shows monthly revenue of 50,105 USD, annual revenue of 601,263 USD and 1,354 paying customersOpen sourceThe changelog reaches back to July 2020, carries entries for every month from January to August 2026 and describes automatic translation of content on a language switch as well as, since August 2026, self-updating incident descriptionsOpen sourceThe vendor's own status page at instat.us shows no notice for July, August and September 2026Open sourceAtlassian Statuspage charges 99 USD a month for the public page on Startup for 1,000 subscribers and 399 USD on Business for 5,000 subscribers with roles and permissionsOpen sourceincident.io includes the status page on its free Basic plan and then bills per user, 19 USD a month on Team and 25 USD on Pro; SAML and the model features start on ProOpen sourcePage on the General Data Protection Regulation linking the data processing agreementOpen source
Who it fits
Solo
suitable
The free plan covers a public page with 15 monitors at two-minute intervals, email alerts, five team members and 200 subscribers. A custom domain is missing, and the page runs under the vendor's domain. Someone running a product alone thereby gets a credible answer to the question whether something is broken right now, without a contract and without a payment method.
Mid-market
suitable
This is where the tool belongs. Pro costs 20 USD a month, 15 USD on annual billing, and brings 50 monitors at 30-second intervals, SMS alerts, a custom domain and 5,000 subscribers. Two limits belong on the same note. Sign-in through your own directory service and the administrator view of the change log arrive only on the Business plan at 300 USD a month. And no plan offers European hosting.
Enterprise
suitable with caveats
Business costs 225 USD a month on annual billing, so 2,700 USD a year, with SAML sign-in, an administrator log and 1,000 monitors; Enterprise offers custom contracts and custom policies. The documents yield three findings. The vendor writes itself that it has not completed a SOC audit. The databases are, by its own account, unencrypted at rest. And the data processing agreement dates from 2022, still mentions Privacy Shield and promises third-party audit reports the security whitepaper does not name; the vendor offers custom versions from Business. The volume of data is small, mostly subscriber addresses and team members. Where procurement allows an exception for that, Enterprise is the route.
Buy, switch or build
Off-the-shelf
The established status page next to it
Atlassian Statuspage is the buy option this decision gets measured against, and Instatus runs a dedicated import path for its customers. On 28 September 2026 Atlassian charges 99 USD a month for the public page on Startup with 1,000 subscribers, and 399 USD on Business for 5,000 subscribers with roles and permissions. At Instatus 5,000 subscribers cost 20 USD a month on Pro.
AI-native
The status page as a by-product of incident response
The younger design puts the status page at the end of an incident response process in which language models take notes. On 28 September 2026 incident.io already includes the status page on its free plan and then bills per user, 19 USD a month on Team and 25 USD on Pro; the writing aid and the model's suggestions start only on Pro, as does SAML sign-in. The flow runs from alerting to post-mortem, and the price grows with every person on call.
Build it yourself
Static page on your own edge, delivery through a building block
The page itself is quick to build. From this toolbox: Astro generates a static status page from incident files in the repository, Cloudflare Pages serves it, Resend sends notifications to subscribers, Sentry supplies the error signal, and n8n connects alert and publication. On the order of magnitude (estimate): 8 to 15 person-days at 1,100 EUR give 8,800 to 16,500 EUR one-off, against 180 USD a year for Pro. Three places are costly. The status page has to stay reachable when your own environment goes down, so it must run on separate infrastructure and a separate domain. Subscriber management needs confirmation, unsubscribe and deliverability. And monitoring from the outside has to check from several regions and open the incident when a check fails.
Our advice
- Solo: The free plan is enough. The page runs under the vendor's domain; that is enough for a start.
- Mid-market: Buy, Pro. Before adoption, countersign the data processing agreement and ask which service produces translations and incident descriptions and whether staff access customer data from Egypt.
- Enterprise: For large enterprises a completed SOC audit is missing. Where procurement allows an exception because of the small volume of data, negotiate Enterprise with a custom contract.
Who is behind it
Staying power: Young
The product has been on the market since summer 2020 and is developed further at a monthly cadence. Funding is not documented by any primary source; on its pricing page the company describes itself, by its own account, as profitable and founder-led. Under the scale of this collection, funding that is not public leads to the classification young, even after more than three years on the market. The vendor publishes its revenue figures itself, without third-party review.
- Contracting entity: Instatus, Inc, according to the data processing agreement a Delaware C Corporation with a mailbox address in Beaverton, Oregon; the terms of service name neither a state of incorporation nor an address, neither governing law nor venue, and the vendor reserves the right to change them without notice; the privacy policy says the site is operated from Egypt and hosted in the United StatesThe terms of service name Instatus, Inc as the contracting party without state of incorporation, address, governing law or venue and reserve changes without notice; deletion happens within 30 days from live systems and within 60 days from backupsOpen source · As of 2026-09-28
- Revenue and customers, by the vendor's own account: the /open page, marked “Updated August 25” without a year, shows monthly revenue of 50,105 USD, annual revenue of 601,263 USD, 1,354 paying customers and 67,522 users; the vendor names no third-party reviewThe /open page, marked “Updated August 25” without a year, shows monthly revenue of 50,105 USD, annual revenue of 601,263 USD and 1,354 paying customersOpen source · As of 2026-09-21
- Ongoing development: the public changelog reaches back to July 2020 and carries entries for every month from January to August 2026, most recently in August 2026 the interface in 26 languages and push alerts to the phoneThe changelog reaches back to July 2020, carries entries for every month from January to August 2026 and describes automatic translation of content on a language switch as well as, since August 2026, self-updating incident descriptionsOpen source · As of 2026-09-21
- Own status page: the vendor's own status page at instat.us shows no notice for July, August and September 2026 and 100 percent availability for all ten entries shown; the addresses status.instatus.com and trust.instatus.com by contrast show status pages of unrelated customersThe vendor's own status page at instat.us shows no notice for July, August and September 2026Open source · As of 2026-09-21
- State of the legal documents: the data processing agreement carries the revision of 23 June 2022, sits as a PDF on the vendor's own website and can be countersigned via Dropbox Sign; the policies carry the note that they were adapted from Basecamp, and the page on the uptime commitment still describes the product in Basecamp's wordsThe page on the uptime commitment promises 99 percent monthly for Pro and describes the product as the place where decisions are made, designs are shared and company announcements are broadcast; the policies carry the note that they were adapted from BasecampOpen source · As of 2026-09-28
Cost of leaving: Low
After the export, little is missing for a status page. Subscribers can be exported as CSV; incidents, maintenance, components and monitors are available through the API. Three points cost time. The status page address has to be re-pointed in DNS. The subscribers change sender; if a new service writes to them without warning, the mail can end up in spam. The deadline is short: on cancellation the account becomes inaccessible at once, after 30 days the data is deleted from live systems and after 60 days from backups. The export therefore belongs before the cancellation.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedyes, publicly available as a PDF (revision of 23 June 2022), by its own text part of the terms of service, with EU standard contractual clauses; countersignature via Dropbox Sign optional, custom versions from BusinessThe page on the General Data Protection Regulation links the data processing agreement as a public PDF (revision of 23 June 2022); it calls itself part of the terms of service, contains the 2021 EU standard contractual clauses under Danish law and describes Instatus, Inc as a Delaware C Corporation; countersignature is possible via instatus.com/dpa at Dropbox SignOpen sourceThe page on the General Data Protection Regulation links the data processing agreement directly as a PDF, without sign-in and without a plan requirement. The text calls itself part of the terms of service and the privacy policy and names Instatus, Inc as processor. It contains the 2021 EU standard contractual clauses for controllers and for processors, with Danish law and courts, plus the UK clauses. New subprocessors are announced in advance, and the customer may object within ten business days. Anyone needing a signed copy countersigns on a self-serve basis via instatus.com/dpa at Dropbox Sign; the pricing page names custom agreements from the Business plan. Three points belong in procurement's review. The text dates from June 2022 and still mentions Privacy Shield. The technical and organisational measures only point to the security page and the privacy policy. And the promise to provide third-party audit reports meets a security whitepaper that names no completed audit.As of 2026-09-28 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, but unfavourableUnited States, at Amazon Web Services and Vercel, with no selectable European region on any planThe security whitepaper says a SOC audit has not been completed, the databases are not encrypted at rest and staff are not background-checked; the data centres are at Amazon Web Services in the United StatesOpen sourceThe security whitepaper places the primary data centres in the United States at Amazon Web Services, the privacy policy says the site is hosted in the United States, and the subprocessor list names Vercel and Amazon Web Services as cloud providers located there. No European hosting location appears on the pricing page, in the policies or in the help pages checked, not even as an add-on on the Enterprise plan (checked on 28 September 2026).As of 2026-09-28 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a conditionpublic list with eight entries, purpose and country named, all in the United States; three discrepancies with other documents of the vendorThe subprocessor list names eight services, all located in the United States: Vercel, Amazon Web Services, Mailgun, Paddle, Google Analytics, Sentry, Twilio and WorkOSOpen sourceThe list names Vercel, Amazon Web Services, Mailgun, Paddle, Google Analytics, Sentry, Twilio and WorkOS, each with purpose and the United States as country, and is visible without signing in. It carries no date; the procedure for changes is set out in the data processing agreement, which announces new subprocessors in advance and allows an objection within ten business days. Three places do not match it. The help page on SAML sign-in routes the setup through a service called OrbitID, which is missing from the list, while WorkOS stands there as the sign-in provider; no document says how the two relate. The changelog describes automatic translation of content, while no translation service appears in the list. And the policies name customer support software as a subprocessor category, while no such service is listed.As of 2026-09-28 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, tied to a conditionprocessing in the United States, operation from Egypt; the data processing agreement anchors EU standard contractual clauses for the transfer to Instatus, Inc; no document names a basis for subprocessors or for access from Egypt; no entry in the EU-US Data Privacy FrameworkThe page on the General Data Protection Regulation links the data processing agreement as a public PDF (revision of 23 June 2022); it calls itself part of the terms of service, contains the 2021 EU standard contractual clauses under Danish law and describes Instatus, Inc as a Delaware C Corporation; countersignature is possible via instatus.com/dpa at Dropbox SignOpen sourceThe privacy policy says the site is operated from Egypt and hosted in the United States, and bases the transfer on consent through mere use. The data processing agreement governs the transfer to Instatus, Inc in Beaverton, Oregon, through the 2021 EU standard contractual clauses. The eight subprocessors are all located in the United States; for them the agreement only names contracts with equivalent protection, without a transfer basis per recipient. No document says anything about access from Egypt, a country without an adequacy decision. The official Data Privacy Framework participant list returned no match for Instatus on 21 September 2026.As of 2026-09-28 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, tied to a conditionno statement; automatic translation and continuously updated incident descriptions run through an unnamed serviceThe changelog reaches back to July 2020, carries entries for every month from January to August 2026 and describes automatic translation of content on a language switch as well as, since August 2026, self-updating incident descriptionsOpen sourceReviewed were the privacy policy, the terms of service, the security whitepaper, the subprocessor list, the pricing page and the changelog. None of them mentions model training or a provider of language models. The product mainly processes incident texts that become public anyway, plus subscriber addresses and measurements. Two changelog entries concern customer content: automatic translation when switching language, and since August 2026 team-internal incident descriptions that update themselves as the incident evolves. Whether a language model does that work, and which service runs it, is stated nowhere. The rating stays yellow: red requires a documented AI function on customer content, and none is documented here. Anyone wanting to use either feature should settle the question with the vendor before adoption.As of 2026-09-28 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, no condition attacheddeletion after cancellation promised and quantified: 30 days from live systems and logs, 60 days from backupsThe cancellation policy says the account is inaccessible immediately after cancellation, data is deleted within 30 days from live systems and within 60 days from backups, and free accounts are deleted after 365 days of inactivityOpen sourceThe terms of service, the cancellation policy and the security whitepaper name the same periods consistently. On cancellation the content becomes inaccessible at once, after 30 days it is deleted from live systems and logs, and after 60 days from the backups, which are stored off-site. The vendor rules out restoring a single account from backup. Free accounts are additionally deleted after 365 days of inactivity, frozen accounts after 180 days.As of 2026-09-21 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, but unfavourablenone named; according to the vendor's security whitepaper no SOC audit has been completed and the databases are not encrypted at restThe security whitepaper says a SOC audit has not been completed, the databases are not encrypted at rest and staff are not background-checked; the data centres are at Amazon Web Services in the United StatesOpen sourceOn audits, the security whitepaper states that a SOC audit has not been completed and that a self-assessment for PCI is in progress. It describes access over a VPN with a second factor, logging of all account access by IP address, daily backups encrypted with GPG, and recovery drills. It also states that the databases are not encrypted at rest and that staff are not background-checked. No document names an ISO 27001 certificate, a C5 attestation or a trust portal. A security page exists; the evidence is the vendor's self-declaration. The data processing agreement by contrast states in section 7.2 that the vendor has obtained third-party audits and will provide the reports on request; its own statements therefore contradict each other.As of 2026-09-28 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, tied to a conditionno statement on the regulation; the tool contains no recognisable AI system that faces end customersThe changelog reaches back to July 2020, carries entries for every month from January to August 2026 and describes automatic translation of content on a language switch as well as, since August 2026, self-updating incident descriptionsOpen sourceRegulation (EU) 2024/1689 appears in none of the documents reviewed. According to the changelog, the tool updates incident descriptions that only the own team sees, and translates content on a language switch, where the operator can edit the translation before publishing. The vendor describes no machine that answers visitors of the status page directly. Responsibility for published texts therefore stays with the operator who approves them.As of 2026-09-21 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourablechange log present, administrator view only on the Business plan; retention period and export not namedThe activity log keeps a history per incident, maintenance and template on all plans; the administrator view of changes to the team and the status page is visible only to administrators on the Business planOpen sourceThe help page on the activity log describes two views. Every incident, maintenance and template carries its own history on all plans. The administrator view of changes to the team, the status page, notifications and credentials is visible only to administrators on the Business plan. How long the log is kept and whether it can be exported into your own systems is stated neither on the help page nor on the pricing page (checked on 28 September 2026).As of 2026-09-21 |
What it really costs
Entry price
The free Starter plan covers 15 monitors at two-minute intervals, email alerts, five team members and 200 subscribers, without a custom domain. Pro costs 20 USD a month, 15 USD on annual billing, with 50 monitors at 30-second intervals, SMS alerts, a custom domain and 5,000 subscribers. Business costs 300 USD a month, 225 USD on annual billing, with 1,000 monitors, alerts by phone call, SAML sign-in and 25,000 subscribers. Enterprise goes through a conversation. The page quotes prices in US dollars only and per status page, independent of the number of users; Business covers up to three pages, and Pro also comes as Private Pro at 50 USD and Select at 100 USD a month.Plan prices: Starter free, Pro 20 USD and Business 300 USD a month, 15 and 225 USD on annual billing; Starter with 15 monitors and 200 subscribers, Pro with 50 monitors and 5,000 subscribers, Business with 1,000 monitors, SAML and 25,000 subscribers (variants Private Pro 50 USD and Select 100 USD, billing per status page)Open source
As of 2026-09-28
What gets expensive
Extra cost arises at one point: between Pro and Business lies a factor of 15. Private pages and pages for selected customer groups already exist as variants of Pro, at 50 and 100 USD a month, 37.50 and 75 USD on annual billing. Anyone needing sign-in through their own directory service or the administrator view of the change log, however, jumps from 180 to 2,700 USD a year. For a team of twelve that is 225 USD per person and year (own calculation). The pricing page names a 99.99 percent uptime commitment only for Enterprise; the vendor's own policy on it promises 99 percent for Pro.
What it displaces
- An outage banner on your own website, which is itself down
- A mass email to customers from a personal mailbox
- The same answer to the same question in support, a hundred times
- Availability figures from memory in a customer conversation
Interfaces
- REST API for incidents, maintenance, components, monitors, subscribers and team members
- Subscriber notification by email, SMS, Slack, Microsoft Teams, Discord, Google Chat, webhook, RSS and Atom
- Connection to monitoring services such as Datadog, New Relic, Pingdom, Prometheus and PagerDuty
- Incident response in Slack with a dedicated channel per incident
- SAML sign-in from the Business plan, directory sync over SCIM on Enterprise
- Subscriber export as CSV; import from Statuspage, incident.io, Sorry, UptimeRobot and Better Stack
Matching methods
- Service BlueprintingThe status page sits on the line of visibility this method draws: an internal failure becomes visible to the outside there. That is also where it is decided whether the customer learns of it from the vendor or from their own outage.
- DORA Delivery DiagnosticThis method measures time to restore after a failure. An incident archive with start, updates and end per incident supplies data points for that time.
- Good-Better-Best PricingStarter, Pro, Business and Enterprise form a ladder, plus the Pro variants Private Pro and Select. Between Pro and Business lies a factor of 15, and sign-in through your own directory service sits on Business. The method helps check whether this tier opens the way up or blocks it.
Alternatives
Sources
- 1.Plan prices: Starter free, Pro 20 USD and Business 300 USD a month, 15 and 225 USD on annual billing; Starter with 15 monitors and 200 subscribers, Pro with 50 monitors and 5,000 subscribers, Business with 1,000 monitors, SAML and 25,000 subscribers (variants Private Pro 50 USD and Select 100 USD, billing per status page) (opens in a new tab)instatus.com/pricing · As of 2026-09-28
- 2.The page on the General Data Protection Regulation links the data processing agreement as a public PDF (revision of 23 June 2022); it calls itself part of the terms of service, contains the 2021 EU standard contractual clauses under Danish law and describes Instatus, Inc as a Delaware C Corporation; countersignature is possible via instatus.com/dpa at Dropbox Sign (opens in a new tab)instatus.com/instatus-dpa-2022-06.pdf · As of 2026-09-28
- 3.The subprocessor list names eight services, all located in the United States: Vercel, Amazon Web Services, Mailgun, Paddle, Google Analytics, Sentry, Twilio and WorkOS (opens in a new tab)instatus.com/policies/subprocessors · As of 2026-09-28
- 4.The help page on SAML sign-in names the Business plan as a prerequisite and routes the setup through a service called OrbitID (opens in a new tab)instatus.com/help/team/sso · As of 2026-09-21
- 5.The privacy policy says the site is operated from Egypt and hosted in the United States, and that anyone using the site or a service consents to the transfer; after cancellation nothing is stored for longer than 30 days (opens in a new tab)instatus.com/policies/privacy · As of 2026-09-21
- 6.The official participant list of the EU-US Data Privacy Framework returns no match for a search for Instatus; the same search for a listed company returns one as a cross-check (opens in a new tab)dataprivacyframework.gov/list · As of 2026-09-21
- 7.The security whitepaper says a SOC audit has not been completed, the databases are not encrypted at rest and staff are not background-checked; the data centres are at Amazon Web Services in the United States (opens in a new tab)instatus.com/policies/security/whitepaper · As of 2026-09-28
- 8.The terms of service name Instatus, Inc as the contracting party without state of incorporation, address, governing law or venue and reserve changes without notice; deletion happens within 30 days from live systems and within 60 days from backups (opens in a new tab)instatus.com/policies/terms · As of 2026-09-28
- 9.The page on the uptime commitment promises 99 percent monthly for Pro and describes the product as the place where decisions are made, designs are shared and company announcements are broadcast; the policies carry the note that they were adapted from Basecamp (opens in a new tab)instatus.com/policies/sla · As of 2026-09-28
- 10.The cancellation policy says the account is inaccessible immediately after cancellation, data is deleted within 30 days from live systems and within 60 days from backups, and free accounts are deleted after 365 days of inactivity (opens in a new tab)instatus.com/policies/cancellation · As of 2026-09-21
- 11.The activity log keeps a history per incident, maintenance and template on all plans; the administrator view of changes to the team and the status page is visible only to administrators on the Business plan (opens in a new tab)instatus.com/help/team/activity · As of 2026-09-21
- 12.The /open page, marked “Updated August 25” without a year, shows monthly revenue of 50,105 USD, annual revenue of 601,263 USD and 1,354 paying customers (opens in a new tab)instatus.com/open · As of 2026-09-21
- 13.The changelog reaches back to July 2020, carries entries for every month from January to August 2026 and describes automatic translation of content on a language switch as well as, since August 2026, self-updating incident descriptions (opens in a new tab)instatus.com/changes · As of 2026-09-28
- 14.The vendor's own status page at instat.us shows no notice for July, August and September 2026 (opens in a new tab)instat.us/history · As of 2026-09-21
- 15.Atlassian Statuspage charges 99 USD a month for the public page on Startup for 1,000 subscribers and 399 USD on Business for 5,000 subscribers with roles and permissions (opens in a new tab)atlassian.com/software/statuspage/pricing · As of 2026-09-28
- 16.incident.io includes the status page on its free Basic plan and then bills per user, 19 USD a month on Team and 25 USD on Pro; SAML and the model features start on Pro (opens in a new tab)incident.io/pricing · As of 2026-09-28
- 17.Page on the General Data Protection Regulation linking the data processing agreement (opens in a new tab)instatus.com/policies/gdpr · As of 2026-09-28
Last reviewed: 2026-09-28 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.
From tool to decision
The offer that fits this tool
A tool profile tells you what the tool does and what it means for compliance. Whether it gets priority in your company is a management decision, and it takes one working day: the executive AI workshop ranks your initiatives by business value, risk, data readiness and ownership.