Skip to content
ECZ-IDService & Workload
Free Passport: Get a FREE Service & Workload Passport

Estate operating plan · ECZ-ID Service & Workload

Service & Workload estate operating plan

One operating plan for your estate of services and workloads, above free Passports it never changes.

The estate operating plan is the paid plan TrustOps publishes for operating services and workloads at estate scale, in tiers with their own allowance. It is a commercial entitlement only: identity, the Resolver record and the free baseline never change by buying, cancelling, refunding or exhausting it.

Configure in TrustOps(opens in a new tab — trustops.ecocitizenz.com)See the tiers and pricesAll Service & Workload products
Type
Estate operating plan
Price
Tiers and prices below, read from TrustOps
Acquired and paid in
TrustOps
Operated in · proved by
Dashboard · Resolver

The problem

Why it matters.

Services and workloads multiply across clusters, clouds and pipelines, each runtime with its own workload identity. Operating that estate needs one plan for it, without turning the plan into another identity or another runtime credential.

Built for

  • Platform teams operating services and workloads across several clusters or clouds.
  • Teams that want workload identity federation run as one plan across the estate.
  • Operators who need every free Service & Workload Passport left untouched by whatever the plan does.

What changes

  • One plan for the estate, sized by the tier you choose.
  • Identity and the free baseline kept apart from the plan.
  • A plan you can stop without touching any ECZ-ID.

What you receive

Concrete deliverables, not a vague trust score.

  • The tiers TrustOps publishes for this family's estate, each with the allowance it states.
  • One paid tier per billing scope.
  • Your free Service & Workload Passports, unchanged, underneath it.
The plan, beside your Passports
Covers
Your estate of services and workloads, within the allowance of the tier you choose
Tier
One paid tier per billing scope
Held in
TrustOps, as a commercial entitlement
Never changes
An ECZ-ID, its Resolver record or the free baseline
Boundary
Never a certification

Illustrative structure. The tiers, their allowances and their prices are TrustOps' own, listed below.

How it works

A short path from need to something usable.

  1. Hold free Service & Workload Passports for the services and workloads you operate.

  2. Choose the tier that fits your estate in TrustOps, which shows whether it can be bought today.

  3. TrustOps holds the entitlement; your Passports and their Resolver records stay as they are.

  4. Buying, cancelling, refunding or exhausting the plan never changes an identity or the free baseline.

How it relates to your Passport

The plan sits above your free Service & Workload Passports, never inside them. Each Passport stays free and resolvable, and the Resolver keeps publishing each record exactly as before.

Use cases

  • An estate growing from a handful of services to workloads spread across several clouds.
  • One plan per billing scope for every service and workload the organisation operates.

Tiers and price

What it costs, and where you buy it.

Workload Identity Federation (monthly)

Paid · Open

£99.99 per month

Workload Identity Federation: up to 100 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified.

logical workloads
100 logical workloads
Choose Workload Identity Federation(opens in a new tab — trustops.ecocitizenz.com)

Workload Identity Federation (annual)

Paid · Open

£999 per year

  • One payment for 12 months (annual prepaid; it does not renew)

Workload Identity Federation: up to 100 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified. One payment for exactly 12 months. It does not renew.

logical workloads
100 logical workloads
Buy annual(opens in a new tab — trustops.ecocitizenz.com)

Workload Identity Federation Business (monthly)

Paid · Open

£299.99 per month

Workload Identity Federation Business: up to 500 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified.

logical workloads
500 logical workloads
Choose Workload Identity Federation Business(opens in a new tab — trustops.ecocitizenz.com)

Workload Identity Federation Business (annual)

Paid · Open

£2999 per year

  • One payment for 12 months (annual prepaid; it does not renew)

Workload Identity Federation Business: up to 500 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified. One payment for exactly 12 months. It does not renew.

logical workloads
500 logical workloads
Buy annual(opens in a new tab — trustops.ecocitizenz.com)

Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal. Read from the TrustOps projection generated . All pricing

After purchase

  1. TrustOps acquires

    Configure and buy in TrustOps, which owns payment and entitlement.

  2. Dashboard operates

    The entitlement appears in your Dashboard, where you operate it.

  3. Resolver proves

    Public facts stay on the Resolver; buying never changes what a record proves.

Privacy, security and evidence

What is collected, published and kept.

  • The plan is an entitlement held in TrustOps, not a property published on the public record.
  • Your ECZ-ID does not change.
  • It is never a certification.

Boundaries

The claims stop here.

  • The plan is a commercial entitlement only. It is never a certification.
  • Buying, cancelling, refunding or exhausting it never changes an identity, the Resolver record or the free baseline.
  • One paid tier per billing scope.

Integrations and questions

Works with what you already run.

  • Your free Service & Workload Passports and their bindings.
  • AEC, the capacity pool every family shares.
  • TrustOps: the only place the plan is bought, changed or cancelled.

Build and integrate it from code: APIs, AI, Data & Software(opens in a new tab — developers.ecocitizenz.com)

Can I buy it today?
Each tier below states its current acquisition state, read from TrustOps. TrustOps publishes the tiers and their prices and shows whether online purchase is open.
Does the plan change my Service & Workload Passports?
No. It is a commercial entitlement only: buying, cancelling, refunding or exhausting it never changes an identity, the Resolver record or the free baseline.
Is it a certification of my estate?
No. The plan is never a certification.

Related

Keep the identity free. Add this when the outcome is worth it.

Your Service & Workload Passport stays free. Service & Workload estate operating plan sits above it and is acquired in TrustOps.

Configure in TrustOps(opens in a new tab — trustops.ecocitizenz.com)