Custom CNAME's are available to all paid plans, to request yours to be set up, please get in touch with us via the support portal.
For an SSL protected CNAME, we charge an additional £30 per month. This covers the cost of setting up a separate load balancer for the custom domain and the necessary SSL termination, naturally we would also need you to provide a valid SSL certificate and key so we can enforce the policy.
It is also possible to enable SSL using Cloudflare's free SSL, though it requires having Cloudflare manage your DNS.
If you are running in Hybrid mode then there is no additional charge since the CNAME would be going via your own load balancer and servers and no configuration changes would be needed on our part (unless you will be needing a custom CNAME for your portal).