Keeper Security licensing is the set of terms under which Keeper Security sells its password manager, privileged access management (PAM), secrets management, remote connection and endpoint privilege products to organisations and managed service providers (MSPs). Business customers sign the SaaS Terms of Use. Under them Keeper grants “a nonexclusive, non-transferable (except as otherwise expressly authorized herein), worldwide, internal only license during the term of this Agreement” to use the Services set out in a valid Order.[1] Catalog proof: Licence is non-exclusive, non-transferable, worldwide and internal only.
The core unit is the user. Business Starter, Business and Enterprise are each priced per user per month and billed annually.[2] The Terms of Use define Authorized End Users as individuals with credentials to the Software.[1] PAM, endpoint privilege management and the MSP model add other units: PAM users, non-human identities, workloads, endpoint seats and an average daily licence count.
The contracting entity depends on where the customer is. Customers in Europe contract with Keeper Security EMEA Limited in Cork and those in Japan with Keeper Security APAC KK in Tokyo. Everyone else contracts with Keeper Security, Inc. in Chicago, and each entity’s own law and courts apply.[1] The contract terms are covered in Keeper Security Terms of Use.
Editions
Keeper publishes its plan structure but loads prices into the page dynamically. The figures were not captured for this article.[2]
| Offering | Unit and how it is sold | Deeper article |
|---|---|---|
| Business Starter | Per user, annual; “Protection for 5–10 users”[2] | Business and Enterprise plans and add-ons |
| Business | Per user, annual; adds shared team folders, delegated administration, a free Family Plan per user[2] | same |
| Enterprise | Per user, by quote; adds SCIM, AD/LDAP, SSO/SAML, role-based access control, developer APIs[2] | same |
| Add-ons (ARAM, Compliance Reporting, BreachWatch, KeeperChat, Secure File Storage) | Bought through the Admin Console for Business and Enterprise[3] | same |
| KeeperPAM and the Privileged Access Manager Add-On | Custom pricing through Sales; add-on per PAM user[4][5] | KeeperPAM, Secrets Manager and Connection Manager licensing |
| Keeper Secrets Manager, Keeper Connection Manager, Endpoint Privilege Manager | KSM per user per year; KCM by add-on and licence key; EPM endpoint seats[8][10][9] | same |
| KeeperMSP base plans (Business, Enterprise, Plus) | Average daily licence usage, billed monthly in arrears[6] | MSP and partner licensing |
Personal and Family plans are sold to consumers and are not covered here, except where a business licence grants them.
Metrics
Keeper’s documents name these units.
| Unit | Catalog row | Where it applies |
|---|---|---|
| Authorized End User | User | All business plans and per-user add-ons |
| User of PAM features | Privileged Access Manager Add-On user | Privileged Access Manager Add-On |
| Non-human identity and workload | Active NHI, Workload | KeeperPAM volume tiers |
| Endpoint | Endpoint seat | Endpoint Privilege Manager |
| Storage | Secure File Storage (pooled) | Secure File Storage |
| Daily average of licences in use | Average Daily License Usage | KeeperMSP |
| MSP add-on units | KCM user (MSP), API call bundle (Secrets Manager, MSP) | KeeperMSP Secure Add-Ons |
The PAM add-on counts the “Number of Users using the Business or Enterprise Features AND PAM Features”. A base Business or Enterprise licence is still needed for every user.[4] The KeeperPAM page defines an Active NHI as a non-human identity managed in the Keeper Vault that transacts through the Keeper Gateway. A Workload is an AI agent or local process whose privileges are governed by Endpoint Privilege Manager policies.[5] For practitioner context on per-user units see named-user licensing.
Counting / floors
Annual fees and mid-term additions. Subscription Fees are “billed and collected annually in advance”. All fees are nonrefundable.[1] Users added mid-year are charged the prorated share of the per-user annual fee. Keeper’s example is that a user added after six months costs 50% of the annual fee.[1] There is no published true-down. Catalog proof: Subscription Fees are annual, in advance and non-refundable; Users added mid-term are prorated.
Plan thresholds. Business Starter covers 5 to 10 users. If a Business Starter account goes above 10 users, the plan “will automatically be updated to Keeper Business”.[2][3] Endpoint Privilege Manager is “Sold in blocks of 50 licenses”.[3] KeeperPAM includes 24 annual active NHIs and 5,000 monthly workloads at no cost, with volume tiers above that.[5] Catalog proof: Business Starter covers 5 to 10 users; Business Starter above 10 users moves to Keeper Business; Endpoint Privilege Manager sold in blocks of 50; KeeperPAM includes 24 active NHIs and 5,000 monthly workloads.
MSP consumption. For MSPs, Keeper keeps daily licence counts and uses the daily average at month end to calculate charges.[6] A deleted user stops counting from the following day.[12] Catalog proof: MSP licences billed on average daily usage, monthly in arrears; Deleted MSP user stops counting the following day.
Virtualization & partitioning
Keeper licenses people, identities, endpoints and storage, not processors or hosts, so no core or partitioning rule appears in the retrieved documents. The nearest equivalents are the KeeperPAM Active NHI and Workload units.[5] Self-hosted Keeper Connection Manager runs as a gateway in a customer environment. Version 2.19 and later needs a licence key from the Admin Console, and the key requires a KeeperPAM licence or the KCM On-Prem Add-on.[10] Catalog proof: Keeper Connection Manager 2.19 and later needs a licence key.
Cloud / BYOL
The password manager, Secrets Manager and KeeperPAM are delivered as Keeper-hosted cloud services, so bring-your-own-licence does not arise. Secrets Manager is described as a cloud-native service that integrates with cloud and on-premises environments.[8] FedRAMP High and GovRAMP authorisation is listed as “GovCloud only”.[2]
Programs
- Add-ons. Reporting, compliance, dark-web monitoring, messaging and storage add-ons are bought on top of a base plan. SIEM integration is marked “ARAM required”.[2] The “Recent Activity” and “All Security Events” reports are included in every Business and Enterprise subscription.[11] Catalog proof: SIEM integration requires ARAM; Built-in reports included; custom reports and alerts need ARAM.
- KeeperMSP consumption-based billing. MSPs pay monthly in arrears with “No long-term commitments on licenses”.[6] Add-on units differ by add-on.[7]
- Partner Terms. These cover resellers, distributors, MSP resellers and MSP distributors.[1]
- Free trial, Free Family Plan for business users, support tiers and Service Level Objectives. These come from the Terms of Use and the Enterprise Guide.[1]
Audits and compliance
The SaaS Terms of Use contain no customer audit clause of the kind found in on-premises licence agreements. Keeper meters users through its own Admin Console. Users can be added at any time “at then-current rates” and are billed pro rata.[1] The customer may not “circumvent any security or licensing protocols”.[1] Partners, unlike customers, must cooperate with “any audit or review reasonably required to confirm compliance”.[1] In practice the licence position equals the console user count against the purchased quantity, plus the add-on quantities in the Subscriptions tab.[3] Catalog proof: No circumvention of licensing protocols or resale; Partners must cooperate with Keeper compliance audits. For the general discipline see software license audit and true-up.
Out of scope
- List prices. They load dynamically on the pricing pages and were not captured. KeeperPAM, Secrets Manager and Connection Manager are quoted.[5]
- Personal, Family, Student and Military and Medical consumer plans.
- Negotiated Orders, quotes, partner Schedule 1 discount schedules and Partner Portal program terms, which are not public.
- KeeperDB, Remote Browser Isolation and Forcefield pricing, for which no licensing document beyond the PAM feature list was retrieved.
- Litigation. No court case about Keeper software licensing was found in a primary court record.