Is Teleport Community Edition free for any company?

No. The source code on GitHub is AGPL-3.0, but Teleport's edition matrix says the Community Edition binaries are under a commercial license with free usage only for companies with fewer than 100 employees and less than 10 million US dollars in annual revenue. Community Edition also limits SSO to GitHub and lacks access lists, SCIM, device trust and most identity governance features, which sit in the Enterprise editions.

Who owns StrongDM now?

Delinea. It announced the deal on 15 January 2026 and completed it on 5 March 2026, with financial terms undisclosed. Delinea says it is bringing StrongDM's runtime authorization to the Delinea Platform, and StrongDM's pricing URL now redirects to Delinea's platform bundles page.

How is Teleport priced?

Teleport Enterprise is usage-based on monthly active users and Teleport Protected Resources, with no published dollar figures. A protected resource is a unique resource or machine identity registered with the cluster, averaged over the billing month, so a CI job that runs for under an hour counts as 1/730th of one.

Can Teleport or StrongDM replace a password vault?

Not fully. Both are built to remove standing credentials from engineers' hands for SSH, Kubernetes, databases and cloud consoles. Neither is a classic vault for large numbers of legacy Windows admin and service account passwords, so programs with that estate usually keep a vault-first PAM alongside.

Teleport vs StrongDM

At a glance

Pick Teleport if you want engineers to reach SSH, Kubernetes, databases and internal apps with short-lived certificates tied to their SSO identity, with the option to self-host the whole access plane. Pick StrongDM if you want a SaaS-managed control plane that brokers connections and credentials across many resource types with fast onboarding, and you are comfortable buying it from Delinea. Both replace bastion hosts and shared keys; the difference is certificates versus a credential-brokering proxy, and an independent vendor versus a product inside a larger PAM portfolio.

Where each wins

Decision factor	Teleport	StrongDM
Credential model	Wins: short-lived certificates, no standing secrets	Proxy injects stored credentials
Self-hosting the control plane	Wins: self-hosted, hybrid or Teleport-managed cloud	SaaS control plane only
Database access governance and onboarding speed	Capable	Wins: broad protocol coverage, fast rollout
Published entry pricing	Usage model published, no prices	Nothing published, quote via Delinea
Vendor independence	Independent	Now part of Delinea
AI agent access	Beams agent runtimes on your infrastructure	Runtime authorization being folded into Delinea Platform

Pricing reality (checked 2026-11-05)

Teleport's pricing page shows a quote form, and its pricing guide explains the meter: Enterprise is billed on monthly active users and Teleport Protected Resources, averaged hourly across the month, so a sub-hour CI pipeline run counts as 1/730th of a resource. Enterprise comes in Standard and Premium (Premium adds Identity Security). The managed cloud offers a 99.9% SLA tier up to 50,000 connected resources and a multi-region 99.99% tier up to 130,000. The free Community Edition is not free for everyone: the edition matrix limits free binary use to companies under 100 employees and under 10 million dollars in revenue, and restricts SSO to GitHub.

StrongDM's pricing URL now 301-redirects to Delinea's platform bundles page, which lists Essentials, Standard and Enterprise packages with capacity limits, no prices and no mention of StrongDM. Ask Delinea whether StrongDM is sold standalone or only inside a bundle.

Ownership changes

Delinea announced its StrongDM acquisition on 15 January 2026 and completed it on 5 March 2026, terms undisclosed. Delinea frames StrongDM as just-in-time runtime authorization brought into the Delinea Platform, aimed at zero standing privileges for humans and AI agents. Delinea itself is private, owned by TPG. Teleport remains privately held and independent.

Deployment and architecture

Teleport runs an Auth Service that acts as the cluster certificate authority, a Proxy Service that fronts the Web UI and public traffic, and agents on your infrastructure. Agents dial out to the proxy over reverse tunnels, so private networks need no inbound ports, and because roles are encoded in the user's certificate, the agent decides access locally (architecture docs). Machine and workload identity uses tbot.

StrongDM keeps the control plane at app.strongdm.com (with UK and EU equivalents) and has you deploy gateways, which accept client connections, and relays, which open reverse tunnels to gateways so firewalls stay egress-only. Gateways and relays decrypt credentials and deconstruct requests for audit (docs). That is what makes its database-level audit strong, and also why air-gapped requirements fit poorly.

Migration notes

Moving between them is mostly an enrollment exercise rather than a data migration. Leaving StrongDM for Teleport means installing Teleport agents near each resource, mapping StrongDM roles to Teleport roles, and rotating any credentials StrongDM held, because Teleport will not need them. Going the other way means registering each resource and its credentials in StrongDM and deploying gateways and relays. Run both in parallel per environment and cut over by team. Export session recordings and audit logs to your SIEM before decommissioning either.

Who should pick which

Teleport: platform teams that want certificate-native access, self-hosting or hybrid, and SSH and Kubernetes as the core use case.
StrongDM: teams that want a managed control plane, database access governance and fast onboarding, especially if Delinea is already in the estate.
Neither: a mostly legacy Windows privileged estate needs vault-first PAM; see CyberArk vs BeyondTrust and StrongDM vs CyberArk. For the HashiCorp route see HashiCorp Boundary, and for shortlists see best PAM for DevOps and how to choose a PAM solution.