Keeper Business Pricing: Plans, Annual Costs and Add-Ons

Keeper Business pricing starts at $2 per user per month for Business Starter, $4 for Business and $6 for Enterprise, with annual billing. Those are Keeper's own published starting rates dated July 2026. A quote can differ from a published starting rate, so check the US checkout or sales quote before approving a purchase.

The least expensive plan isn't always the least expensive deployment. A small team can buy a vault and sharing features, while an IT department that needs SSO, SCIM or SIEM evidence may need Enterprise and separately priced modules. This guide shows the license math, the actual control differences and a quote worksheet you can use before renewal.

How much does Keeper cost for businesses?

Keeper lists three password-management plans, and each price is a per-user monthly equivalent when billed annually. The table below uses the July 2026 figures from Keeper's updated plan guide. A quote can differ, so treat these as published starting prices rather than a guaranteed contract.

Plan	Starting monthly rate	Annual cost per seat	Buyer fit
Business Starter	$2	$24	A small team with basic vault and sharing needs
Business	$4	$48	A growing team that needs delegated administration
Enterprise	$6	$72	An IT team that needs SSO and automated provisioning

The annual cost column is simply the monthly equivalent multiplied by twelve. It doesn't include add-ons, any negotiated discount or applicable taxes. A monthly equivalent isn't evidence that Keeper offers a pay-monthly contract at the same rate. Ask for the actual payment schedule, because cash flow and license term aren't the same thing.

Keeper's Business Starter tier targets teams of 5 to 10 users. Keeper's July plan guide says Business requires a minimum of five users. It doesn't provide a reliable public minimum for every Enterprise quote, so don't extrapolate the Starter limit to Enterprise. If you're pricing one to four employees, confirm eligibility with Keeper rather than forcing the Starter formula into a checkout it may not support.

What does Keeper cost at different team sizes?

Your first budget estimate is seats times the published monthly equivalent times twelve. That gets you a clean baseline, but it won't capture the add-ons or any minimums beyond those explicitly published. The table below makes the baseline visible so procurement can separate license cost from the rest of the purchase.

Team size	Business Starter	Business	Enterprise
Team of 5	$120	$240	$360
Team of 10	$240	$480	$720
Team of 25	Not eligible	$1,200	$1,800
Team of 50	Not eligible	$2,400	$3,600
Team of 100	Not eligible	$4,800	$7,200

The seat totals above are illustrative list-price calculations, not invoices or quotes. Starter is shown only within its stated user range. Enterprise amounts are starting-price estimates; the quote is the authority for an actual deployment.

Take a team of 50 employees. At Keeper's published starting rates, Business has a $2,400 annual license baseline and Enterprise has a $3,600 baseline. That's a $1,200 annual difference before add-ons. If Enterprise removes manual account administration through SSO and provisioning, compare the avoided IT work against that difference. Measure the hours your admins spend on account changes during the trial and compare that figure against the difference.

For 100 users, the Enterprise starting baseline is $7,200 per year. The arithmetic is simple, but the budget definitely isn't finished until you've asked who receives a paid seat, whether contractors count, what happens to dormant seats and which modules your security requirements actually need.

The calculator is a quick comparison, not a quote builder. It leaves out Business Starter because that tier stops at ten users. A spreadsheet that enforces eligibility and a quote-specific add-on schedule is safer for a procurement approval.

What do the Keeper Business plans actually include?

The important boundary is how the company controls identities, not how many passwords employees can save. Keeper's plan matrix separates basic vault management, delegated team administration and identity-provider-driven provisioning. Match the control to the operating task that prompted your purchase.

Business Starter: basic shared credentials for a small team

Starter covers an encrypted vault, an admin console, credential sharing and autofill. A five-person services company might use it to replace a shared spreadsheet of application logins. One administrator invites users, creates a team policy and checks that shared records aren't living in personal browser notes.

It isn't the right default for a department with a complicated joiner, mover and leaver process. The issue isn't vault capacity. It's whether you can assign administrative responsibility by team, automatically provision from your identity provider and show the auditor what happened. Those controls are different from simply storing a secret.

Keeper's current comparison page also describes basic two-factor authentication and password sharing. You should still test who can create shared folders, who can re-share a record and how quickly a departing user's access can be removed. A cheap seat price doesn't make a weak ownership process acceptable.

Business: delegated administration and organizational structure

Business adds shared team folders, delegated administration and more advanced organizational structure. Keeper also advertises a free Family Plan for each Business user. That benefit may help adoption, but don't count a personal subscription as a security control in the business ROI model.

Picture an IT lead who supports finance, customer support and engineering. Business lets the organization move beyond one administrator handling every shared record. The control design still needs a named owner for each shared vault, an approver for access changes and a documented offboarding path. Delegation without an ownership register can spread ambiguity rather than solve it.

The price jump from Starter to Business is easy to justify when a team grows past Starter eligibility. It's less automatic when a small company only needs simple sharing. Test actual administrator duties during the trial, then choose the smallest plan that supports the workflow. Don't pay for a tier because its name sounds more enterprise-ready.

Enterprise: identity-provider integration and governance

Enterprise adds SAML single sign-on, SCIM provisioning, Active Directory/LDAP sync, advanced two-factor authentication, role-based access control and developer APIs. Those are the features to examine when IT already manages workforce identities in an IdP and needs predictable onboarding and offboarding.

A practical test is to create a temporary employee in your identity provider, assign a group, provision Keeper access and then remove that group. Record what happens to the user's access, shared records and audit evidence. If the lifecycle depends on a manual export or a helpdesk ticket, you've found a process gap that a higher plan name alone won't fix.

Keeper's Enterprise plan is still a password-management and identity-access product. Its standard tier shouldn't be treated as an automatic purchase of secrets rotation, privileged session recording or SIEM forwarding. Those capabilities may require separate modules. Put each requirement in the quote as a named line item instead of assuming it's bundled.

• Basic credential sharing for an eligible small teamBusiness Starter, if the team fits its 5 to 10 user range.
• Delegated administration across departmentsBusiness is the first tier to evaluate for administrative control.
• SAML SSO, SCIM or AD/LDAP lifecycle automationEnterprise is the relevant password-manager tier.
• SIEM forwarding or custom audit event reportsBudget ARAM separately; validate the integration during a trial.
• Automated secrets rotation or privileged session recordingRequest a KeeperPAM or relevant add-on quote, not just a vault license.

Which Keeper features cost extra?

Keeper sells secure add-ons alongside its password-management tiers. That matters because a base plan can cover vault access while a security program needs evidence collection, dark-web alerts or privileged-access controls. Keeper's add-on page identifies the modules, but it doesn't publish a dependable USD price for every one. Leave add-on lines blank until Keeper quotes them in writing.

Advanced Reporting and Alerts Module (ARAM)

ARAM is the add-on to price when your SIEM needs Keeper events. Keeper's SIEM documentation explicitly says that SIEM integration requires ARAM, while KeeperPAM includes it. The documentation describes event filtering, external logging and alerts. This is a separate purchasing question from whether a standard plan includes basic activity reporting.

For an audit, ask for a sample event export that shows a user identifier, the action, timestamp, resource reference and policy outcome. Then confirm whether the fields match your internal evidence retention and access-review process. Keeper advertises support for more than 300 event types in its SIEM documentation, but your team should validate the particular events it needs rather than buying based on the headline count.

BreachWatch and secure file storage

Keeper lists BreachWatch and secure file storage among its add-ons. BreachWatch is positioned for monitoring exposed credentials. The practical question is who receives the alert, who owns remediation and how closure is documented. If you can't assign those steps, buying an alert feed won't produce a defensible response process.

Secure file storage may matter when users need to share documents with credentials. Ask whether the quoted allowance covers your retention needs and whether access permissions can be reviewed separately from the passwords. Keeper doesn't publish a universal add-on rate, so the amount belongs in your vendor quote.

Secrets management, privileged sessions and endpoint privilege

Keeper's plan guide positions KeeperPAM as the package for secrets management, privileged sessions, endpoint privilege management and automated credential rotation. It lists KeeperPAM pricing as custom. Its separate Endpoint Privilege Manager entry starts at $36 per endpoint per year, billed annually, in the July 2026 guide. That endpoint price isn't a substitute for a complete KeeperPAM quote.

An infrastructure team should inventory the workloads it needs to protect before asking for a PAM proposal. Count the relevant human users, service identities, endpoints and target systems separately. Ask which unit each add-on uses for billing. A per-user vault quote and an endpoint-based privilege quote shouldn't be combined as though they had the same denominator.

Is Keeper billed monthly or annually?

The public business plan grid labels its rates per user per month, billed annually. That wording means the displayed monthly figure is a way to compare plans, not a promise that you can cancel after one monthly payment. A procurement approval should use the actual contract term and payment dates.

Ask Keeper to spell out the initial term, renewal term, invoice frequency, seat additions, seat reductions, refunds and notice requirements. The public plan grid doesn't settle those terms for your organization. If sales offers a discount, get the net seat price, term and any expiration date in the order form. A percentage off a list price isn't useful if you don't know the renewal baseline.

The same applies to a midterm employee departure. Don't assume a vacated seat becomes an automatic refund. Ask whether you can reassign it, when the count resets and whether a reduced headcount changes the renewal quote. The answers should be written into the buying record, not left in a call recap.

Does Keeper offer a free business trial?

Keeper advertises a 14-day business trial without a credit card. Its trial page says a team can explore the platform and invite colleagues before choosing a paid plan. That is clearly a useful window for a controlled evaluation, but it isn't a substitute for verifying the plan-specific entitlements after purchase.

Run the trial as a short operational test. Don't just check whether users like autofill. Test the identity lifecycle, shared-folder permissions, recovery process and the exact reports you would need in an audit. If you're considering Enterprise, confirm the SSO and provisioning behavior that will remain available after the trial ends.

A small pilot can uncover a costly mismatch. For example, a team might love the vault but discover that its intended access-approval workflow lives outside Keeper. That's a process design problem, not evidence that a more expensive vault tier automatically fixes approvals. Write down what Keeper does, what your IdP does and what still needs a human owner.

1. Define the buyer scenario

   List users, teams, privileged identities, directory systems and required evidence before comparing rates.

2. Run an access lifecycle test

   Invite a user, grant a shared record, change the role and remove access. Capture each result.

3. Validate the reporting boundary

   Check built-in activity reporting separately from ARAM, SIEM export and any PAM logs.

4. Request an itemized quote

   Ask for base seats, add-on units, term, payment schedule, renewal conditions and support.

5. Document a go or no-go decision

   Record the smallest sufficient tier, unresolved control gaps and who approved the spend.

How should IT budget for Keeper without missing audit costs?

Start with the password-manager license baseline, then add every control that your policy actually requires. The total cost isn't the published seat price. It's the contract you need to operate and prove access controls over the term.

Use a worksheet with separate columns for seat count, annual per-seat rate, add-on name, add-on billing unit, expected quantity, quoted annual price, contract start, renewal date, evidence owner and approval status. This forces an explicit answer when a requirement such as SIEM integration has no published USD add-on price.

A workable approval rule is simple: IT owns the technical fit, Security signs off on control coverage, Finance verifies the math and Procurement verifies the contract. If one of those owners is missing, the quote may be inexpensive but the decision isn't complete. The roles can sit with fewer people in a small company, but the checks still need named owners.

For service accounts, distinguish who owns an identity from who stores or rotates its credential. Keeper can manage credentials, while an ownership review still needs an inventory, a nominated owner and an attestation record. Our service account ownership matrix and non-human identity lifecycle guide show how to structure that evidence.

Is Keeper worth the price for your team?

Keeper is worth a trial for any team that needs managed credential sharing. At $24 to $72 per seat per year before add-ons, the seat license is the predictable part of the budget, so the add-ons and contract terms decide the real cost.

Keeper is a credible candidate when your organization needs managed password sharing and has a clear path from a small team to identity-provider integration. The published starting prices are approachable, but the cheapest tier won't fit every governance requirement. Choose by control boundary, not by the marketing label.

Business Starter fits an eligible small team that mainly needs encrypted storage and controlled sharing. Business becomes more attractive when administrators need to delegate responsibilities across departments. Enterprise is the relevant tier when your workforce access process depends on SAML SSO, SCIM or directory synchronization. If SIEM or privileged sessions are mandatory, ask for the complete module quote before comparing Keeper with another vendor.

A fair comparison also includes the internal effort to manage shared credentials. A password manager doesn't replace a system inventory, an access review or a named service-account owner. You can use our service account audit checklist to make that boundary explicit. If Keeper handles the vault but no one can explain who owns a privileged account, the organization still has an audit gap.

• Related pricing1Password Business Pricing
• Identity operationsService Account Ownership Matrix
• Audit workflowService Account Audit Checklist