N30
Talk to us
N30.ai

Pricing · One price a year

One plan for the size of your company.

Count the people who work at your company; that is your plan. One price a year covers everything on the card. Engineers holding CISSP, CEH, CISA and CISM do the work and sign the letter.

How many people work at your company?

1 to 10 people

Essentials

$899 a year

Your insurer’s security questions, answered in writing

Tested

  • External penetration test, every quarter

Checked each quarter

  • Email spoofing protection (SPF, DKIM, DMARC)
  • Post-quantum encryption on your website
  • Website and domain expiry dates

Written

  • Incident response plan
  • Five core security policies
  • Vendor list, reviewed each year

Proof

  • Evidence folder
  • Signed attestation letter with a verify link

Calls

  • Two a year
Start with Essentials

11 to 25 people

Program

$2,499 a year

Your website tested, and a written security program

Everything in Essentials, plus

Tested

  • Web application or API test (one application)

Written

  • Written risk assessment
  • Written information security program

People

  • Security awareness training for everyone
  • Tabletop exercise (a breach, rehearsed with you)

Proof

  • Annual report to the owner

Calls

  • Two a year, one of them the tabletop
Start with Program

26 to 75 people

Business

$6,500 a year

Your cloud accounts and vendors checked as well

Everything in Program, plus

Tested

  • Cloud configuration review (Microsoft 365, Google)

Checked each quarter

  • Systems newly open to the internet
  • Known flaws in the software you run online

Written

  • Service provider oversight (your vendors’ security)

People

  • Phishing exercise (a practice phishing email)

Calls

  • Quarterly
Start with Business

76 people and up

Enterprise

from $14,900 a year

Evidence for your auditor, your regulator and your board

Everything in Business, plus

Tested

  • Internal network test (as a stolen laptop would)
  • A second application test

Written

  • Readiness for your rule (FTC Safeguards, HIPAA, PCI)
  • Report to the board

People

  • A named lead for the year

Calls

  • Monthly
Talk to us
  • Every plan is annual and paid once a year, by card or bank account, on Stripe’s secure page.
  • Findings come ranked by what to fix first, in plain words. We read without changing wherever reading is enough, and never use denial-of-service.
  • A second web application, a mobile app or an internal network test can join any plan. We quote it before you commit.

In plain words

Penetration test
With your written permission, we try to break in as a criminal would. We report what worked and how to close it.
SPF, DKIM, DMARC
Three email settings that stop criminals sending mail that looks like it came from your company.
Post-quantum encryption
Protection for your website’s traffic against future quantum computers that could break today’s encryption. We measure whether yours has it.
Incident response plan
Who does what, and who is called, in the first hours after a break-in or a lost laptop.
Written risk assessment
What could go wrong at your company, how likely it is, and what you do about each risk.
Written information security program
Your security rules in one document: what the FTC Safeguards Rule requires of the firms it covers.
Attestation letter
A dated letter we sign, stating what we tested, when, and what we found. It is not a certification.
Readiness for your rule
The FTC Safeguards Rule (tax, lending, auto dealers), HIPAA (health) or PCI (card payments): gaps closed, evidence ready.

Questions

How do we know which plan is ours?
By headcount: employees and regular contractors together. A company of 18 is on Program; a company of 40 is on Business. If you grow during the year, the plan changes at the renewal.
What does each plan add?
Essentials tests you from outside each quarter and writes your core policies. Program adds a test of your website, the written program, training and a tabletop. Business adds your cloud accounts and vendors. Enterprise adds your internal network and readiness for your rule.
What do we need to provide?
Your domain names and answers to about ten questions on how your company works. From Program up we also test inside your website, and from Business your cloud. For those, you create a test account and remove it after.
Is the attestation letter a certification?
No. It is a dated letter we sign, stating what we measured, when, and who did it. Anyone can check it at its verify address. It is written to answer the questions insurers, banks and customers ask.
Can we change plans?
Yes. Write to us and we move you to another plan; a move down takes effect at the renewal. You can stop the renewal in one click on Stripe’s billing page. The year you paid for is delivered in full.

The first step

Choose the size of your company and start. We write to you within one business day to agree the dates.

Choose your size