[ PRICING ]
What it costs
The calculators and the HSM simulator are free with an account. What is paid is the BENCH — keeping named keys and test cards, replaying a battery, producing a dossier, and pointing the whole thing at a real payShield.
Free
Anyone with an account
$0
forever, with an account
The whole web forever, and the desktop app with a sign-in.
- What you get
- The starter bench: 3 named keys · 2 test cards · 1 replayable battery · 100 MCP calls a day — every run kept for a week, the newest three.
- The cryptographic tools
- Five tools with no account at all
- The payShield 10K simulator
- Host commands against the simulator
- The AI assistant
- Session sync across your devices
- Your LMKs and smart cards persist
- The live activity tape
- History of your operations
- Export your operation history
- KeyLab Desktop
- Test cards per scheme
- Named keys that fill a command in
- Record a battery and replay it
- The tools, callable by a coding agent
- The KPCS exam, sat on the bench
Pro
One engineer with a bench
$29
a month · $290 a year saves two
Sign in first
The bench features — persistence, scenarios, the dossier, and your own HSM on the wire.
- Everything in Free, plus
- Talk to a real payShield over TCP
- More than one workspace
- A terminal that produces the transaction
- The tape survives a restart
- Export the run as a report
- A KMIP bench
- The simulator and KMIP, callable by a coding agent
On the roadmap · 2
- The payment PKI, end to end
- More AI credits
Business
A team that has to agree on what happened
$415
per seat, per year · 3 seats minimum
Sign in first
Shared workspaces, and a dossier that carries a name. From $1,245 a year.
| 3–9 seats | $415 |
| 10–24 seats | $380 |
| 25+ seats | $365 |
Billed annually.
- Everything in Pro, plus
- Workspaces the team shares
- Roles and permissions
- Seat administration
On the roadmap · 3
- A sealed dossier with a named author
- Diff between sealed runs
- What the team did
Enterprise
An isolated network and a procurement department
Talk to us
contract, procurement, and a network with no way out
Runs where there is no network, and buys through a contract.
- Everything in Business, plus
- Nothing beyond Business ships yet. What is coming:
On the roadmap · 9
- Air-gapped, on an offline licence
- Run the battery from a pipeline
- Service accounts and key allowlists
- API audit trail and SIEM export
- SSO/SAML and SCIM provisioning
- Data residency
- SLA and a named engineer
- Contract, MSA/DPA, PO and invoicing
- Source code escrow
Compare plans
What each plan includes, line by line.
| Capability | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Calculator | ||||
| The cryptographic tools | ||||
| HSM Simulator | ||||
| The payShield 10K simulator | ||||
| Host commands against the simulator | ||||
| Bench HSM | ||||
| Talk to a real payShield over TCP | — | |||
| PoS Simulator | ||||
| A terminal that produces the transaction | — | |||
| Cards | ||||
| Test cards per scheme | 2 | |||
| Keys | ||||
| Named keys that fill a command in | 3 | |||
| Evidence dossier | ||||
| Export the run as a report | — | |||
| KMIP | ||||
| A KMIP bench | — | |||
| Platform | ||||
| The tools, callable by a coding agent | 100 calls a day | |||
| The simulator and KMIP, callable by a coding agent | — | |||
| Payment PKI | ||||
| API & CI/CD | ||||
| Platform | ||||
| Five tools with no account at all | ||||
| The AI assistant | ||||
| Session sync across your devices | ||||
| Your LMKs and smart cards persist | ||||
| The live activity tape | ||||
| History of your operations | ||||
| Export your operation history | ||||
| KeyLab Desktop | ||||
| More than one workspace | — | |||
| The tape survives a restart | — | |||
| Record a battery and replay it | 1 | |||
| The KPCS exam, sat on the bench | ||||
| Workspaces the team shares | — | — | ||
| Roles and permissions | — | — | ||
| Seat administration | — | — | ||
On the roadmap · 14 lines, by the plan they will join
- ProThe payment PKI, end to end
- ProMore AI credits
- BusinessA sealed dossier with a named author
- BusinessDiff between sealed runs
- BusinessWhat the team did
- EnterpriseAir-gapped, on an offline licence
- EnterpriseRun the battery from a pipeline
- EnterpriseService accounts and key allowlists
- EnterpriseAPI audit trail and SIEM export
- EnterpriseSSO/SAML and SCIM provisioning
- EnterpriseData residency
- EnterpriseSLA and a named engineer
- EnterpriseContract, MSA/DPA, PO and invoicing
- EnterpriseSource code escrow
FAQ
What is free?
The 51 cryptographic tools and the payShield simulator, with an account — plus a starter bench: 3 named keys, 2 test cards and 1 replayable battery. What is paid is the bench at full size — unlimited keys, cards and batteries, the dossier, and pointing it all at a real HSM.
Can I subscribe right now?
Yes. Pro and Business open a Stripe checkout from this page and take effect the moment it completes; Enterprise starts with a conversation. Cancel any time from Subscription and billing — the period you paid for stays open.
Is a seat a person or a workspace?
A person in your account. The same colleague opening five of your workspaces is one seat, because they are one human. Administrators take no seat at all: they govern people and inventory and never operate.
What happens if I stop paying?
Nothing is deleted. The workspace goes read-only: you keep seeing your keys, cards and batteries, and you can still export them — you just cannot create or run new ones until you subscribe again. You will also still hold the wrapped blocks, because they were always yours.
Can my colleagues see my keys?
A workspace can file new material as private to whoever created it, shared only with the people they name, and the server enforces that. It is access control, not separate cryptography: keys are wrapped under the LMK of the bench you point at, so two workspaces on the same LMK hold blocks that open in the same place.
Do you store the commands I send to my HSM?
Not on a paid plan. The operation is counted; the payload is never written. On a free account the request and response are kept for thirty days so support can replay a failing command, and the app says so where the command is typed.
Do I need to install anything?
No for the web. The desktop app exists for the one thing a browser cannot do — a TCP connection to a payShield on your network — and it is free with a sign-in.
When is Enterprise the answer?
When the network has no way out, or procurement is in the room. An air-gapped lab cannot reach an auth server, so it runs on an offline licence.