Plans
Three ways to work with us.
Every plan starts the same way — an application, read by an analyst. Nothing activates before we have spoken.
Two of these are ongoing protection. The third is a single answer about a single phone, for someone who does not want a subscription and may never need one. Which one fits is a conversation, not a checkbox — and it is a conversation we would rather have before you pay for anything.
Ongoing
Protect
Continuous, on-device defence for someone at real risk who is comfortable running it themselves.
- One device included — more can be added
- Up to three analyst investigations a year
- First response the next working day
- Written finding within five working days
- Threat intelligence pushed to the device
- Credential-leak monitoring, reviewed by an analyst
- No named analyst
Apply for Protect
Ongoing · limited availability
Managed
Everything in Protect, run for you by a named analyst who already knows your case before you call.
- Two devices included — more can be added
- Investigations whenever you need one
- First response the same working day
- Written finding within three working days
- A named analyst, and consultation calls
- Credential-leak monitoring, reviewed and escalated
Managed availability is limited, and that is deliberate rather than a sales tactic — a named analyst who is looking after a hundred people is not a named analyst. If we are at capacity when you apply, we will say so plainly and tell you when that changes.
Apply for Managed
One-time
Investigation
A single forensic examination of a single handset, for someone who needs an answer now and nothing after it.
- One device, examined once, properly
- Guided capture — you keep control of your phone
- Full written report, explained by a human
- Findings you can hand to a lawyer or an editor
- No subscription, nothing recurring
- No ongoing monitoring afterwards
If the examination finds something, we will tell you what to do next whether or not you ever become a subscriber.
Request an investigation
Side by side
| Protect | Managed | Investigation |
|---|
| Devices included | 1 | 2 | 1, once |
| Analyst investigations | 3 per year | As needed | A single examination |
| First response | Next working day | Same working day | By arrangement |
| Written finding | Within 5 working days | Within 3 working days | Full report |
| Named analyst | — | Yes | The examiner on your case |
| Consultation calls | — | Yes | Report walkthrough |
| Continuous on-device detection | Yes | Yes | — |
| Credential-leak monitoring | Yes | Yes, escalated | — |
| Availability | Open | Limited | Case by case |
How pricing works
We quote on the call, not on this page. Not to be coy — because the right plan depends on what you actually face, how many devices carry it, and whether you need someone reachable the same day. Quoting before that conversation would mean quoting before we know.
- Annual or quarterly. Annual is discounted; quarterly is at list. There is no monthly billing, deliberately — recurring monthly collection in India pulls in a mandate framework whose failure modes would cost our subscribers more attention than it saves them money.
- Your price is your price. What you are quoted at approval is snapshotted and held. If a later block of Managed seats opens at a higher price, existing subscribers stay where they are.
- All prices are inclusive of GST. We issue a tax invoice for every payment taken
directly. Purchases made through Apple’s App Store are invoiced by Apple, which is the seller of
record for those.
- Sponsored seats exist. Journalists and human-rights defenders working without institutional backing should apply anyway and say so in their application. We would rather find a way than lose the case.
What happens after you apply
- An analyst reads your application. A person, not a filter. This usually takes a day or two.
- You speak to us — online, or in person if that is safer for you. This is where the plan and the price are settled.
- You pay, and only then does anything activate. The approval and the entitlement are separate events on purpose; there is no working access sitting unused in between.
- You install and enrol, with the app store account you told us about.
If you are in the middle of something right now, say so. An application that opens with "I think my phone is compromised and I have a hearing on Thursday" gets read differently from one that does not. Write it in the first line.
Start an application → · How we handle your data · What we actually build