For organisations
One licence covers everyone who signs in from your tenant. Bought here, not in the app. Enter your Entra tenant domain at checkout and the licence is active the moment an admin taps Activate license in Settings.
Up to 500 devices
One Entra tenant with 500 or fewer Windows devices in Intune.
Billed annually · applicable sales tax added at checkout
- Unlimited LAPS and BitLocker reveals
- Every admin in the tenant, no seat count
- Copy to clipboard, recents and favourites, app lock
- Nothing to install or configure server-side
Unlimited devices
One Entra tenant, any number of devices.
Billed annually · applicable sales tax added at checkout
- Everything in Enterprise 500
- No device ceiling to track or true up
- Every admin in the tenant, no seat count
- Nothing to install or configure server-side
MSP organisation
All technicians at one MSP, across any number of customer tenants.
Billed annually · applicable sales tax added at checkout
- Everything in Enterprise, for every technician
- Switch between customer tenants in the app
- Keyed to your MSP's own tenant, not each customer's
- Add technicians and customers without telling us
Checkout is hosted by Stripe. Kainor never sees your card number. Need an invoice, a purchase order number, ACH or net-30 terms instead? Email connor@kainor.com and we will invoice you directly.
For individuals
Free covers evaluation and light use. Pro is a subscription bought inside the app through the App Store, with a free trial.
| Plan | Price | What you get | Where |
|---|---|---|---|
| Free | $0 | Unlimited device search and detail, rotation dates, BitLocker key metadata, and 5 credential reveals per rolling 30 days, LAPS and BitLocker combined. Enough to prove it works against your tenant and watch the reads appear in your own audit log. | App Store |
| Pro | $1.99 / mo $19.99 / yr |
Unlimited reveals, copy to clipboard, BitLocker key rotation, recents and favourites, biometric app lock. For one admin, on their own devices. | In the app |
| MSP Pro | $49.99 / yr | Everything in Pro plus switching between customer tenants. For an individual technician; per technician. | In the app |
Individual subscriptions are managed entirely by Apple: billing, cancellation and refunds go through your App Store account.
What happens after you buy an organisation licence
-
You enter your tenant at checkout
The checkout form asks for your Microsoft Entra tenant domain (for example
contoso.com) or the tenant ID. We resolve it to your tenant's GUID using Microsoft's public discovery document. No sign-in, no permission in your tenant. -
Your licence row is written automatically
When Stripe confirms payment, the licence is recorded against your tenant GUID: the tier, the term, and the Stripe subscription reference. That is the entire record. Your name, email and billing details stay in Stripe, where they have to live anyway; none of it is copied to us.
-
Any admin activates it in the app
In LAPSlock, Settings → Activate license. The app sends only your tenant GUID and receives a signed entitlement. Every admin who signs in from your tenant gets the same result. There are no licence keys to distribute and no accounts to create.
Questions
Why is the licence keyed to a tenant instead of to users?
Because it is the only key that requires nothing from you. The app already knows which tenant it is signed into. Keying on that means no seats to count, no user list to send us, and no personal data on our side. A tenant GUID identifies an organisation, not a person.
We have 520 devices. Which Enterprise band?
Unlimited. The 500-device band is on the honour system: nothing in the app counts your devices, and nothing reports the count to us. If you outgrow it, email us and we will move you to unlimited for the difference.
What does the licence check actually send?
Your tenant GUID, roughly once a month, over HTTPS, to a single Azure Function that returns a signed tier. Not device names, not user names, not how often anyone revealed a password. The full request and response contract is published as ENTITLEMENT-API.md, and the how it works page explains how to verify it yourself.
Can we pay by invoice, purchase order or ACH?
Yes. Email connor@kainor.com with the tier and your tenant domain. You will receive a Stripe invoice that accepts ACH and card, with your PO number on it and net-30 if you need it. Vendor forms and security questionnaires are answered by the same address.
What if we cancel?
The licence runs to the end of the paid year and then the tenant returns to the free tier. Nothing is deleted, nobody is locked out of the app, and the reveal meter simply applies again.
Does the free tier really stay free?
Yes. Five reveals a month is the permanent floor, not a trial that expires. It exists so a sceptical admin can verify every claim we make before paying for anything.