Billing & plans
SafeHanded is priced per organisation with included technicians, not per seat — usage per technician is occasional, so seats never block adoption. Extra technicians are cheap; Auditors are free. For: Owners. Manage everything under Settings → Billing.
| Plan | For | Includes |
|---|---|---|
| Free | IT shops, tiny teams, evaluation | A small number of technicians and a monthly cap on requests and shares, email delivery, short audit retention. |
| Team | Internal IT | Unlimited requests and shares, SAML and SCIM, directory, one ticketing adapter, custom domains, the API and signed webhooks, one SIEM stream, longer audit retention, Slack/Teams notifications. |
| MSP | MSPs | Everything in Team, plus clients, per-client branding and domains, all adapters, client reports and more SIEM streams (5, plus 2 per client). |
For current prices and exact limits, see the pricing page on the SafeHanded site. Larger team, or need to pay by invoice? Email sales@safehanded.com.
Trials
Section titled “Trials”Every new organisation starts with a 14-day trial of the MSP plan, with no card needed. During the trial you get full product access. Until you verify your domain, a trial is treated as anonymous on public trust surfaces. The handoff page shows your name and logo, marked Name not verified, with a caution the recipient must accept; your custom wording and contacts stay hidden, and emails, texts and the link checker use a neutral account name, so a trial can’t borrow another brand’s trust.
You can verify your domain on a trial (Settings → Verification). Recipients then see your branding and verified domain with a Trial badge and a short notice that you’re on a trial, your contacts are marked as unconfirmed, and anyone can connect Microsoft people search, not only a Microsoft administrator. Subscribing removes the badge; a custom address needs a paid plan as well as a verified domain.
- Technicians count towards your plan’s included seats; add more at the per-seat rate.
- Auditors don’t count — add as many read-only reviewers as you need.
- Owners and Admins always take a technician seat, as they can handle credentials.
- Extra technicians are billed automatically. Once every included technician is taken (counting pending invitations), the Invite page says the next person will be billed as an extra technician and shows the price. They’re added to the subscription, prorated, when they accept. Changing someone to a seat role or re-enabling them works the same way.
- Owners are emailed whenever the number of billed extra technicians goes up or down, and the change is recorded in the audit log as “Extra technicians changed”.
Your bill and renewal date
Section titled “Your bill and renewal date”The Subscription card shows:
- Renews on the date your plan renews, and whether it’s monthly or annual. A plan you’ve cancelled shows Cancels on instead.
- Next invoice: the amount Stripe will charge on that date, including VAT if Stripe adds it. It’s hidden if Stripe can’t be reached.
Annual plans: Owners get an email 30 days before the renewal with the date and the amount. To change plan or cancel, do it before then under Manage billing. Monthly plans get no reminder.
On Team and MSP, the Texts card shows the texts SafeHanded has sent for you this month:
- how many you’ve used of your allowance, for example “87 of 145 this month”;
- how the allowance is made up, for example “100 included + 45 for 3 extra technicians”;
- when it resets, and how many texts weren’t sent because it ran out.
There are two different dates. Your text allowance resets on the 1st of each month. Your billing date is when your plan renews. Removing a technician lowers the allowance straight away, so it can run out before the 1st.
Owners get an email and a notification at 80% and 100% of the allowance, once each a month. If you run out two months running, the card suggests adding technicians, upgrading or connecting your own Twilio. Texts through your own Twilio aren’t counted. See SMS delivery.
Feature gating at a glance
Section titled “Feature gating at a glance”- Sign in with Microsoft or email, with passkeys, is on every plan, including Free.
- Your own sign-in connection (Microsoft Entra, OpenID Connect or SAML, plus SCIM provisioning), joining automatically by domain or group, and Require single sign-on are on Team and above.
- Directory autocomplete, Slack / Teams notifications and sending from your own mailbox are on Team and above. On Free, email notifications go from SafeHanded’s own address.
- The generic webhook, with automatic purge on ticket close, is on every plan.
- SAML sign-in and SCIM provisioning are on Team and above. If a plan lapses, the SAML connection is kept but SAML sign-in stops, SCIM calls are refused, and members sign in with email and passkey (or another allowed provider) until you upgrade.
- Presets, request-from-ticket triggers, ticket-reply delivery and certificate attachment are on Team and above.
- The public API and signed webhooks are on Team and above.
- SIEM streaming is on Team and above: one stream on Team; five, plus two per client, on MSP.
- Clients and all adapters are on MSP and above.
- Free stays fully functional for the core send/reveal loop.
- Every plan has a few service limits (file storage, API keys, webhooks, API rate) set well above normal use.
When you downgrade
Section titled “When you downgrade”Nothing is deleted when you move to a plan with less. What changes:
More ticketing connections than the plan includes
Section titled “More ticketing connections than the plan includes”Free and Team include one ticketing connection (Free: the generic webhook only). If you have more when the plan changes, everything keeps working for 14 days while you choose.
- Owners get an email and a notification, and again 3 days before the end.
- Owners and Admins see this on the dashboard and the Integrations page: “Your plan includes 1 ticketing connection. Choose which to keep by 21 Oct.” Owners get Choose.
- Choose which to keep lists your connections. Tick as many as the plan includes and select Save. The others are paused.
- If nobody chooses, SafeHanded keeps the oldest and pauses the rest, and emails the Owners which were paused.
- You can change which one runs at any time: open a paused connection and select Choose which to keep.
A paused connection keeps its settings and tokens, but does nothing: it doesn’t check tickets, post notes or replies, attach certificates, or create requests from tickets. Closing a ticket linked to a paused connection doesn’t destroy the credential. The request page says so; finish those requests yourself, or resume the connection.
After you upgrade, nothing restarts by itself. Open each paused connection and select Resume.
Integrations your plan no longer includes
Section titled “Integrations your plan no longer includes”SIEM streams, Teams and Slack, Twilio, directories, your own mailbox, your own sign-in connections and webhooks stay listed, marked Not on your plan. They don’t run, and they can’t be edited, tested or turned back on. The only action is Remove (webhooks also keep Deliveries). Upgrade and the normal controls come back, with your settings intact.