Pricing
Our list price, and the terms that go with it. MSP partner pricing is available; ask us. Nothing here is billed by how many gigabytes your clients happen to generate. The AI usage Hal runs is a second bill, from Anthropic to your own account, that you see and control directly.
$5
per identity, per month
Nothing is billed by ingestion volume. That is the line item that makes every other SIEM quote unpredictable, and removing it is what lets you quote a managed-security number and keep it.
Per identity
$5 per identity per month, list price. An identity is a directory account that can sign in. In Microsoft 365 that is every account with sign-in enabled, licensed or not; in Google Workspace, every user who is not suspended or archived, mailbox or not. Guests count too: a guest signs in, and Hal reads those sign-ins. Servers, workstations and network devices count too: each server or network device as two identities and every two workstations as one, and you are billed on whichever is greater.
Minimum
$600 per month, which covers up to 120 identities. Below 120 you pay the minimum; above it you pay $5 each.
MSP partner pricing
Available. MSPs delivering Hal to their clients: contact us for partner pricing.
Setup
None. There is no onboarding fee and no setup fee, however many tenants you connect.
Free trial
14 days, free, with no obligation. Get in touch and see on your own tenants. A card or US bank account is saved with Stripe before your instance is set up, and nothing is charged during the 14 days. Tell us before they end and nothing is ever charged; otherwise billing begins the next day, with the rest of that month prorated.
Term
None. Month to month, and you can cancel with 30 days’ notice.
How it's counted
Once a day, across every tenant you’ve connected, every server and workstation running Hal’s collector, and every network device sending Hal its syslog. The same email address counts once, whether it appears in a client’s Microsoft and Google directories or in two clients’ tenants; a guest counts by its own address, so one person invited into several tenants is one identity. A server, workstation or network device counts if it reported to Hal in the 24 hours before the count. A server or network device counts as two identities, and workstations as one for every two, rounded up. The day’s billable count is the greater of the identities and what the servers, workstations and network devices count as. Invoices are generated on the first of each month for that month, at the highest daily billable count of the month before; the first invoice after an evaluation that began in the same month uses the evaluation’s peak instead. A directory Hal cannot reach on a given day records what could be counted, never an estimate.
What isn't billed
No onboarding fee, no platform fee, no per-integration charge, no per-log-source charge, and no charge by ingestion volume. A client having a noisy month does not change your invoice.
AI usage
Billed separately, by Anthropic, to you. The per-identity price is HAL AI’s fee. The AI usage Hal runs, triage, the second-opinion gate, investigations, the night shift and chat, runs on your own Anthropic account and API key, so Anthropic bills it to you directly and you set the cap. It depends on your volume and the models you choose, and the portal’s Costs page shows every dollar of it. Setting up the account → · The levers that move it →
Worked example · 300 identities
300 identities × $5$1,500
Monthly minimum$600
Billed monthly$1,500
No setup fee.
Your book
300 × $5$1,500
Monthly minimum$600
Billed monthly$1,500
An estimate at list price, not a quote. It counts identities only: servers, workstations and network devices can count for more, and when they do, the count follows them, as How it's counted explains. We put the real figure in writing before you commit to anything.
02 What that includes
Dedicated instanceYour data never touches another customer's infrastructure.
Every log sourceMicrosoft 365, Google Workspace, Entra ID, Windows endpoints, routers and firewalls, CrowdStrike Falcon, Zendesk and 1Password.
365-day searchable retentionAcross every source, on every client.
Every integrationSlack, Microsoft Teams, NinjaOne, ConnectWise PSA, Hudu, IT Glue and Meraki, at no additional charge.
Signed PDF investigation reportsOn demand, cryptographically signed, verifiable by anyone.
The AI analystBy web chat and in Slack, in plain English.
Self-service portalAlerts, dashboards, cost visibility and model selection.
03 Why per identity
Ingestion pricing makes your bill a function of your clients' behavior.
A chatty firewall, a misconfigured verbose logging setting, or one client's bad month, and the invoice moves. You cannot quote a managed-security line item on top of a cost you cannot predict.
Identities move slowly, you already know the number, and it is the same basis you bill your own clients on.
04 Questions about the price
What is not counted as an identity?
Anything that cannot sign in. In Microsoft 365 that is every disabled account, which by default includes shared mailboxes and room and equipment mailboxes, because Exchange creates those with sign-in blocked; an enabled account counts, including a guest you have enabled. In Google Workspace, suspended and archived users are not counted. You are billed for accounts that can sign in, not for objects in a directory, and never by licence. Servers, workstations and network devices are counted separately from identities, and whichever of the two is greater is billed, never the two added together.
How do I check the count?
Settings → Billing in your portal shows the day’s billable count, this month’s high-water mark and the previous month’s peak, with each client’s identities, servers, workstations and network devices. An invoice’s figure is already there when the invoice arrives: Previous Month’s Peak, or, on a first invoice that uses the evaluation’s peak, Monthly High-Water. A day’s identities are the accounts with sign-in enabled in your Entra admin center, guests included, plus the active users in your Google Admin console, less the addresses that appear more than once, so you can reconcile them against your own tenants. You can reconcile the day’s servers and workstations against Logs → Endpoints in your portal and against your own RMM, and the day’s network devices against Logs → Network. What the Billing page shows →
Peak or average?
Peak: an invoice uses the highest daily billable count, not the average. An average is a number you cannot reconstruct from your own tenants and your own RMM, and we would rather you could check the invoice. The peak an invoice uses is recorded before the invoice is generated, so it is already on your Billing page when the invoice arrives.
Does adding a client change the price?
Only by what that client adds to the billable count: its identities, and its servers, workstations and network devices. There is no per-client fee and no onboarding fee, however many tenants you connect.
What if I am under 120 identities?
You pay the $600 minimum. That floor is what makes a dedicated instance work at small scale.
Want the number for your actual book?
Tell us your identity count across your tenants and we'll put your partner pricing in writing. Ask about the free 14-day trial in the same message and we will set it up on your own tenants, with no obligation either way.
- 01You ask us your questions. No deck, no demo dataset.
- 02You sign a short evaluation agreement, and we stand up your own instance.
- 03You connect one tenant from your own admin console. Hal watches it for 14 days.
- 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.