Everyone talks about the security features, but the pricing page is a maze. I've been through three sales calls and still don't have a clear picture of what the final invoice looks like.
What's the real cost beyond the per-user license? I'm looking at things like API call limits for integration. If you exceed them, does it trigger a new tier or just throttling? What about support? Is proper 24/7 phone support an add-on, or is it the standard email ticket system they try to push you onto? Then there's data egress. If we need to pull our own logs or security event data out at scale for our SIEM, are there charges associated with that volume?
Most importantly, how flexible is the contract on user count fluctuations? If we have seasonal staff, are we locked into a fixed annual count, or is there a mechanism for true monthly adjustment without a penalty? The sales reps are vague until you get to the negotiation table. I want to hear from people who have the contract in hand. What line items showed up that you didn't expect?
Show me the data
Oh man, you've hit the nail on the head. The per-user license is just the entry fee. The big one for us was the SIEM data export. Pushing logs to Splunk at volume wasn't covered in our base tier, we got hit with a separate data commitment fee after the first 5GB per day. That was a nasty surprise on month two.
On support, true 24/7 phone was an add-on for us, and not a cheap one. The standard plan is email/business hours.
For the seasonal staff question, we negotiated a quarterly true-up clause. We're locked into an annual minimum, but we can adjust upwards quarterly and they'll true-down at renewal. Getting that in writing was key. Without it, you're stuck with the annual count.
Data doesn't lie, but dashboards sometimes do.
Your list of questions is exactly right. SIEM data egress is a major hidden cost. They bill it as a "Platform Data Commitment" and it's separate from your user licenses. It's not just about volume either - we found the API for pulling those logs has strict rate limits that triggered throttling, not a new tier. But if you need to increase those limits, that's another conversation with sales.
On support, the default is indeed email with business hours phone. True 24/7 phone support came with a 20% uplift on our total contract value. They called it "Premium Support" and bundled a few other things we didn't need just to justify the price.
For user counts, the standard contract is an annual minimum commit. The quarterly true-up another poster mentioned is possible, but we had to push hard for it. Without that clause, you're paying for peak headcount all year. Get every flexibility point in writing before you sign - their standard agreement has none of it.
-- bb
You've perfectly mapped the sales gauntlet. The API call limits are particularly devious - they throttle silently, but the sales script treats any discussion of raising them as a major architectural change requiring a "technical review," which is code for a new quote with a 30% margin built in.
That quarterly true-up everyone mentions? It exists, but they anchor the minimum at 85% of your peak forecast. So if you spike for the holidays, you're still paying for most of those seats during your off-season. The flexibility is an illusion unless your lows are very, very low.
The line item that actually made me laugh was "Deployment Services" for their cloud connector. It was a mandatory fee for a PDF we could have downloaded. They only waived it after we threatened to walk.
It's just pattern matching
That quarterly true-up is the real killer. Ours was structured as an 80% minimum of our peak quarterly forecast, which basically locked us into paying for seats we weren't using for entire quarters. You have to fight hard just to get a fair adjustment mechanism, and even then, it's based on their definition of "peak."
On the API call limits, our experience matched yours: silent throttling. We only noticed when our automation scripts started failing intermittently. Getting those limits raised required a new "technical services" add-on that felt totally manufactured. The line item just said "Enhanced API Capacity."
And don't forget the mandatory "onboarding and configuration" fee. It was non-negotiable until our legal team pointed out the auto-renewal clause buried on page 17. Suddenly, they were willing to "waive" the fee in exchange for a three-year term. It's all a game.
Automate all the things.