[ PRICING ]
What it costs
The calculators and the HSM simulator are free with an account. What is paid is the BENCH — keeping named keys and test cards, replaying a battery, producing a dossier, and pointing the whole thing at a real payShield.
Free
Anyone with an account
$0
forever, with an account
The whole web forever, and the desktop app with a sign-in.
- What you get
- The cryptographic tools
- Five tools with no account at all
- The payShield 10K simulator
- Host commands against the simulator
- The AI assistant
- Session sync across your devices
- Your LMKs and smart cards persist
- The live activity tape
- History of your operations
- Export your operation history
- KeyLab Desktop
Pro
One engineer with a bench
$29
a month · $290 a year saves two
Opens soon
The bench features — persistence, scenarios, the dossier, and your own HSM on the wire.
- Everything in Free, plus
- Talk to a real payShield over TCP
- More than one workspace
- A terminal that produces the transaction
- Test cards per scheme
- Named keys that fill a command in
- The tape survives a restart
- Record a battery and replay it
- Export the run as a report
- A KMIP benchbeing built
- The payment PKI, end to endbeing built
- More AI creditsbeing built
Business
A team that has to agree on what happened
$415
per seat, per year · 3 seats minimum
Opens soon
Shared workspaces, and a dossier that carries a name. From $1,245 a year.
| 3–9 seats | $415 |
| 10–24 seats | $380 |
| 25+ seats | $365 |
Billed annually.
- Everything in Pro, plus
- Workspaces the team shares
- Roles and permissions
- A sealed dossier with a named authorbeing built
- Diff between sealed runsbeing built
- What the team didbeing built
- Seat administration
Enterprise
An isolated network and a procurement department
Talk to us
contract, procurement, and a network with no way out
Runs where there is no network, and buys through a contract.
- Everything in Business, plus
- Air-gapped, on an offline licencebeing built
- Run the battery from a pipelinebeing built
- Service accounts and key allowlistsbeing built
- API audit trail and SIEM exportbeing built
- SSO/SAML and SCIM provisioningbeing built
- Data residencybeing built
- SLA and a named engineerbeing built
- Contract, MSA/DPA, PO and invoicingbeing built
- Source code escrowbeing built
Compare plans
What each plan includes, line by line.
| Capability | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Calculator | ||||
| The cryptographic tools | ||||
| HSM Simulator | ||||
| The payShield 10K simulator | ||||
| Host commands against the simulator | ||||
| Bench HSM | ||||
| Talk to a real payShield over TCP | — | |||
| PoS Simulator | ||||
| A terminal that produces the transaction | — | |||
| Cards | ||||
| Test cards per scheme | — | |||
| Keys | ||||
| Named keys that fill a command in | — | |||
| Evidence dossier | ||||
| Export the run as a report | — | |||
| A sealed dossier with a named authorbeing built | — | — | ||
| KMIP | ||||
| A KMIP benchbeing built | — | |||
| Payment PKI | ||||
| The payment PKI, end to endbeing built | — | |||
| API & CI/CD | ||||
| Run the battery from a pipelinebeing built | — | — | — | |
| Service accounts and key allowlistsbeing built | — | — | — | |
| Platform | ||||
| Five tools with no account at all | ||||
| The AI assistant | ||||
| Session sync across your devices | ||||
| Your LMKs and smart cards persist | ||||
| The live activity tape | ||||
| History of your operations | ||||
| Export your operation history | ||||
| KeyLab Desktop | ||||
| More than one workspace | — | |||
| The tape survives a restart | — | |||
| Record a battery and replay it | — | |||
| More AI creditsbeing built | — | |||
| Workspaces the team shares | — | — | ||
| Roles and permissions | — | — | ||
| Diff between sealed runsbeing built | — | — | ||
| What the team didbeing built | — | — | ||
| Seat administration | — | — | ||
| Air-gapped, on an offline licencebeing built | — | — | — | |
| API audit trail and SIEM exportbeing built | — | — | — | |
| SSO/SAML and SCIM provisioningbeing built | — | — | — | |
| Data residencybeing built | — | — | — | |
| SLA and a named engineerbeing built | — | — | — | |
| Contract, MSA/DPA, PO and invoicingbeing built | — | — | — | |
| Source code escrowbeing built | — | — | — | |
FAQ
What is free?
The 51 cryptographic tools and the payShield simulator, with an account. What is paid is the bench around them — keeping named keys and test cards, replaying a battery, producing a dossier, and pointing it all at a real HSM.
Can I subscribe right now?
Not yet. Create an account and the bench is open to you — you will hear from us when subscriptions open.
Is a seat a person or a workspace?
A person in your account. The same colleague opening five of your workspaces is one seat, because they are one human. Administrators take no seat at all: they govern people and inventory and never operate.
What happens if I stop paying?
Nothing is deleted. The workspace goes read-only: you keep seeing your keys, cards and batteries, and you can still export them — you just cannot create or run new ones until you subscribe again. You will also still hold the wrapped blocks, because they were always yours.
Can my colleagues see my keys?
A workspace can file new material as private to whoever created it, shared only with the people they name, and the server enforces that. It is access control, not separate cryptography: keys are wrapped under the LMK of the bench you point at, so two workspaces on the same LMK hold blocks that open in the same place.
Do you store the commands I send to my HSM?
Not on a paid plan. The operation is counted; the payload is never written. On a free account the request and response are kept for thirty days so support can replay a failing command, and the app says so where the command is typed.
Do I need to install anything?
No for the web. The desktop app exists for the one thing a browser cannot do — a TCP connection to a payShield on your network — and it is free with a sign-in.
When is Enterprise the answer?
When the network has no way out, or procurement is in the room. An air-gapped lab cannot reach an auth server, so it runs on an offline licence.