Priced on the people you protect

What exactly is a “monitored user”?

Somebody at your company whose accounts and activity XIBA watches — typically your headcount in the directory you connect. It is the billing basis for Pro and Max, and it is not the same as a person who logs in.

Do I pay for everyone who logs in to XIBA?

No, and the two numbers are deliberately far apart. Logins are capped separately — 1 on Free, 2 on Pro, 5 on Max — and they cost nothing. You are billed on the people being protected, not on the people doing the protecting.

We have fewer people than the minimum. What do we pay?

The minimum. Pro starts at 25 monitored users and Max at 50, so a team of 20 on Pro pays for 25. Below that, Free is genuinely free and has no time limit — it is usually the better answer until you grow into a paid tier.

What happens when our headcount changes?

You change the monitored-user count on your subscription and Stripe works out the proration — what it comes to depends on where in the billing period the change lands, so the figure comes from Stripe rather than from us. Billing is monthly, so there is no annual commitment to unwind.

What happens to our monitoring if we downgrade or cancel?

Everything you are already monitoring keeps being monitored. The plan limits are additive — they decide whether you can add something new, and never remove what exists. A cancelled account drops to Free and simply stops accepting new assets; the door readers and links you were already watching are still watched. Silently stopping security checks because a card expired is not a billing policy.

Is there a trial of the paid plans?

No — and that is a deliberate answer rather than a gap. Free is the trial: no card, no countdown, and you can stay on it indefinitely. It runs the same detection engine as the paid tiers on a smaller number of assets, so what you evaluate is the real product.

How does billing work day to day?

Pro and Max are paid by card through Stripe, and you get Stripe's billing portal for receipts, payment methods and cancellation — nothing goes through us to change. If procurement needs something else, talk to us before you buy.

How is our data handled?

Integration credentials are encrypted with AES-256-GCM before storage and are never returned to the browser once saved. Every read and write is scoped to your organisation, and administrative actions are recorded in an audit log you can search.

Something not answered here? Ask us directly.