Plans, capabilities, and limits
Document: LK-MAN-EN-04 · Version: 0.1
Last updated: 2026-07-18 · Status: draft / requires commercial and product review
Audience: owners, procurement, security, and operations
This table reflects product defaults on the stated date; it does not replace a quote or contract. Temporary overrides can change an organization's result.
Contents
<a id="reading-the-table"></a>
1. Reading the table
- ✓: enabled by default.
- —: not enabled by default.
Pro+: available on Pro and Business.- Two internal backward-compatibility keys for Brand Protection represent one visible capability.
- The UI may hide, lock, or show an upgrade notice; the backend also enforces capability and limit.
- Check Billing for the active organization's effective entitlements.
<a id="capability-matrix"></a>
2. Capability matrix
| Capability | Free | Pro | Business | Note |
|---|---|---|---|---|
| Basic DNS and email | ✓ | ✓ | ✓ | Essential posture |
| ASM Normal | ✓ | ✓ | ✓ | Cadence by plan |
| Basic uptime | ✓ | ✓ | ✓ | Monitors and retention are limited |
| Security cases | ✓ | ✓ | ✓ | Remediation traceability |
| Unified finding alerts | ✓ | ✓ | ✓ | Operational inbox |
| Risk score | ✓ | ✓ | ✓ | Aggregate prioritization |
| Webhooks | — | ✓ | ✓ | Subject to plan maximum |
| Quiet hours | — | ✓ | ✓ | Alert policy |
| Advanced alerting | — | ✓ | ✓ | Expanded rules |
| Advanced TLS posture | — | ✓ | ✓ | Advanced assessment |
| CT auto-discovery | — | ✓ | ✓ | Certificate Transparency |
| Multi-organization | — | ✓ | ✓ | Multiple account contexts |
| Identity Leaks | — | ✓ | ✓ | Restricted handling required |
| Full DNS and email | — | ✓ | ✓ | Expanded assessment |
| Multi-region uptime | — | ✓ | ✓ | Regional coverage and consensus |
| Uptime status pages | — | ✓ | ✓ | Controlled publication |
| Reports | — | ✓ | ✓ | Executive/technical and PDF |
| Brand Protection | — | — | ✓ | Brand and impersonation |
| API access | — | — | ✓ | Scoped keys |
| DMARC RUA ingest/inbound | — | — | ✓ | Aggregate reports |
| DMARC assistant | — | — | ✓ | Guided workflow |
| ASM Plus | — | — | ✓ | Greater depth and concurrency |
<a id="limit-matrix"></a>
3. Limit matrix
| Per-organization limit | Free | Pro | Business |
|---|---|---|---|
| Maximum domains | 2 | 50 | 200 |
| Maximum verified domains | 1 | 25 | 200 |
| General retention | 14 days | 90 days | 180 days |
| TLS check interval | 720 min | 60 min | 15 min |
| Alert channels | 1 | 5 | 20 |
| Webhooks | 0 | 5 | 20 |
| Expiry thresholds | 3 | 5 | 7 |
| Minimum deduplication | 60 min | 30 min | 15 min |
| DNS/email interval | 1,440 min | 360 min | 60 min |
| ASM Normal interval | 1,440 min | 720 min | 180 min |
| ASM Plus interval | Not applicable | Not applicable | 180 min |
| ASM Plus concurrency | 0 | 0 | 20 |
| ASM Plus rate limit | 0 | 0 | 300/min |
| Uptime monitors | 2 | 50 | 200 |
| Minimum uptime interval | 900 s | 300 s | 60 s |
| Uptime retention | 7 days | 30 days | 90 days |
| Uptime timeout | 5,000 ms | 10,000 ms | 15,000 ms |
| Uptime regions | 1 | 3 | 5 |
| Status pages | 0 | 1 | 10 |
Limits are organization-level and may interact. For example, having uptime enabled does not prevent a creation request from being rejected after reaching max_uptime_monitors.
<a id="enforcement-and-overrides"></a>
4. Enforcement and overrides
The service resolves effective entitlement using:
- the plan assigned to the organization;
- baseline feature flags and limits;
- applicable, unexpired capability or limit overrides;
- current consumption;
- role and resource authorization.
Results can be cached for up to five minutes. After a commercial change or override, wait for refresh or follow the operations invalidation procedure.
An override must not bypass authorization, multi-tenant isolation, or security controls. Record owner, justification, value, and expiry.
<a id="operational-selection"></a>
5. Operational selection
| Main need | Minimum-plan reference |
|---|---|
| Small inventory, basic posture, cases, and risk | Free |
| More domains, reports, Identity Leaks, advanced TLS/DNS, multi-region, webhooks | Pro |
| API, Brand Protection, DMARC RUA/assistant, ASM Plus, and high limits | Business |
Final selection should consider volume, frequency, retention, regions, integrations, and contractual obligations—not only the presence of one feature.
Change control: v0.1 — initial matrix based on product defaults, 2026-07-18.