Pricing
Pricing built for MSPs, and lean IT teams.
Replace half your stack, keep your margins, and start with 2 domains free. You pay per seat: the greater of devices or M365 / Google users, never both. Billing is month-to-month, with no long-term contracts and no high-water-mark billing.
Scout
A free domain scanner that shows clients their own attack surface.
2 domains free, forever. Extra domains $15/mo each.
- External attack-surface scan
- Embeddable scanner widget
- Basic DMARC monitoring
Grow
Replace your RMM with a security-first platform.
A seat is the greater of devices or M365 / Google Workspace licensed users, never both. Min 5 seats.
- RMM agent (Win/Mac/Linux)
- Patch & system monitoring
- M365 / Google Workspace monitoring
- Remote support & audit reports
Professional
For MSPs scaling past 10 clients.
A seat is the greater of devices or M365 / Google Workspace licensed users, never both. Min 5 seats.
- Everything in Grow, plus:
- M365 change monitoring
- SaaS & shadow-AI discovery
- File change monitoring + help desk
- AV/EDR deployment · unlimited remote support
- Google Workspace export up to 100 users / 50 TB (upgradeable)
Complete
The full security platform from one vendor, on one bill.
A seat is the greater of devices or M365 / Google Workspace licensed users, never both. Starts at $298.75/mo, which includes your first 25 seats.
- Everything in Professional, plus:
- Every GRC compliance framework, included
- Administrator elevation and execution prevention (no kernel driver)
- M365/Entra/Azure config backup
- Google Workspace export up to 1,000 users / 5,000 TB (Lavawall Backup)
- CRM, web chat, SharePoint, security training
- Technician checklists with live monitoring data
All tiers are month-to-month and priced per seat (the greater of devices or M365 / Google Workspace licensed users, never both). Prices in CAD. No base fee, no long-term contracts, and no high-water-mark billing.
Volume discounts apply automatically, with no negotiation: 5% from 51 seats, 10% from 251, 15% from 1,001, 20% from 5,001.
Pay annually and two months are free. Go over what you prepaid in a busy month and you're billed the difference for that month only, and it drops back when your usage does. No lock-in to a past peak, and your data is always yours to export.
Registered not-for-profit or charity? 50% off.
Registered charities and not-for-profits get half off every tier and module under our Community Good initiative, and ThreeShield gives 10% of its consulting back to registered charities. You get the same platform, validated cryptography, and Canadian data residency, plus training and compliance built for your sector.
Individual Services: no plan required
Buy exactly the module you need. Nothing you don't.
No tier, no platform commitment, and no base fee: the "Individual Services" plan is $0, and you add only the modules you want. It suits internal IT teams that need one thing done right.
Every à la carte module is also included, fully or partially, in the tiers above (see each card). Administrator elevation and execution prevention work without a kernel driver.
Regulated? Optional hardware
FIPS 140-3 logins need a validated key
If a rule requires FIPS 140-3, Lavawall® can restrict sign-in to FIPS 140-3 validated security keys, checked against the NIST CMVP list at registration and every login. That is a one-time hardware purchase, not a Lavawall fee: you buy the keys, and Lavawall enforces them. The model we recommend and enforce is the YubiKey 5C NFC FIPS (140-3). See FIPS 140-3 support for exactly what it covers, and what it does not.
Need the audit, not just the platform?
ThreeShield, the CISSP/CISA team that builds Lavawall®, delivers the assessments, compliance readiness, and Tier-3 response behind the tools. You get the platform and the people in one relationship.
Lavawall pricing FAQ
- How is a seat counted, per device or per user?
- A seat is the greater of your managed devices or your Microsoft 365 / Google Workspace paid licensed users, whichever number is higher, never the two added together. A person who uses more than one device is one seat, and a device shared by more than one person is one seat. There is no separate per-user charge.
- Is Lavawall really month-to-month?
- Yes. There are no long-term contracts, no minimum term, and no high-water-mark billing. You're never charged for a peak seat count from three months ago; costs go down when you shrink, the same way they go up when you grow. Pay annually and two months are free. If your usage runs past what you prepaid in a busy month, you're billed the difference for that month only, and it returns to the prepaid level when your usage does. The paid tiers do have a starting size (Grow from 5 seats, Professional from 5, Complete from 25), but there is no contract length or lock-in, and your data is always yours to export.
- Why does Complete start at 25 seats?
- 25 seats is the break-even on the parts of the bundle that don't scale down. Complete bundles modules priced per company rather than per seat (the GRC compliance framework, business-resilience and impact-assessment documents, and PCI ASV), so their cost doesn't shrink with a smaller client. Bought à la carte, those alone run about C$328/month, more than the 25-seat starting price. The floor is not a barrier: a client under 25 seats who only needs one Complete feature, say Application Control + PAM, can buy it à la carte as an Individual Service with no plan.
- Do I have to buy a plan, or can I buy just one module?
- Either. Pick a tier for a bundled platform, or buy any single module as an Individual Service with no plan and no commitment. Internal IT teams often start with one module; MSPs usually pick a tier per client.
- What's the difference for internal IT vs an MSP?
- The platform is identical. MSPs get multi-tenant management, white-label options, and per-client billing; internal IT just manages one organization, at the same transparent per-seat rates.
- CAD or USD?
- Both. Toggle the currency at the top of the page, and you're billed in the currency you select. Canadian customers can pay in Canadian dollars by Interac, Canadian pre-authorized debit, or Canadian credit card.