In this article, we provide an explanation of the use of MSSP partners’ credits.
General Rules
Each activated product is charged according to the attached Credit Table.
Billing always runs from the 26th to the 25th of each month.
Once a product is activated for monitoring in the Tenant, it will be charged even if it remains active for only one day during the month.
The platform does not block monitoring, even if the credit package contracted by the MSSP has been exceeded.
Takedowns are charged in the month in which they are resolved.
Takedowns considered Reup, meaning reopened and handled again, are disregarded.
The products Brand Protection, Deep & Dark Web, and Online Piracy are charged according to the brand’s size: Starter, Business, Corporate, or Enterprise.
When a customer has three or more brands, only the two largest brands (based on size) will be charged.
Effective as of November 1, 2025. Before that: It was charge the three largest brands
Example: If a customer has: 1 Enterprise brands, 1 Corporate brand, 1 Business brand.
The billing will consider: 1 Enterprise brand and 1 Corporate brand. The Business brand will not be charged.
Cyber Threat Intel (CTI) is charged as soon as the Workspace is activated, even if no technology has been added for monitoring.
Data Leakage is charged for each unique asset with active monitoring.
What is considered a Data Leakage asset?
Asset name | Monitoring |
BINs | Credit Card Exposure |
Domain | Employee credencial exposure, customer credencial exposure and code secret exposure |
Tracking tokens | Database Exposure |
App | Customer credential exposure |
Third-party login page | Employee credential exposure |
No additional credits are charged for Data Breach Mentions monitoring.
Credits table
Product | Unity | Credits |
Brand Protection | Starter Brand | 35 |
Brand Protection | Business Brand | 70 |
Brand Protection | Corporate Brand | 210 |
Brand Protection | Enterprise Brand | 280 |
Deep Web | Starter Brand | 35 |
Deep Web | Business Brand | 70 |
Deep Web | Corporate Brand | 210 |
Deep Web | Enterprise Brand | 280 |
Online Piracy | Starter Brand | 21 |
Online Piracy | Business Brand | 56 |
Online Piracy | Corporate Brand | 140 |
Online Piracy | Enterprise Brand | 224 |
Data Leakage | Assets | 6 |
VIPs | VIPs | 7 |
Takedown | Tkds | 4 |
Threat Hunting | Each Threat Hunting credit | 1 |
Supply Chain Intel | Vendor | 5 |
Cyber Threat Intel (CTI) | Workspace | 48 |
The Infrastructure Exposure (1024 IPs – 8 credits) product was discontinued on December 25, 2025. As of this date, the infrastructure monitoring functionality will be integrated into CTI (Cyber Threat Intel).
If you see Infrastructure Exposure charges on past invoices, this refers to a legacy pricing model that was active until December 25, 2025. At that time, Infrastructure Exposure monitoring was billed as a package of 1024 IPs for 8 credits.
FAQ
1 - How does the counting of subdomains work in Data Leakage monitoring?
When the same domain is registered more than once (whether as a main domain or as a subdomain), the system performs deduplication and considers only a single entry for billing purposes.
⚠️ Important: If the same domain is configured in different use cases within the same Axur offering (for example, Corporate Credential Leakage and Code Secret Leakage), it will also be counted only once.
2 - What are Monthly Allocation?
The Monthly Allocation feature ensures that each tenant maintains the minimum billing amount agreed upon in the contract, providing greater predictability and security for all parties involved.
Users can view this amount directly on the Tenant Management screen, ensuring full transparency regarding the defined limit. For security and compliance reasons, changing this value is not permitted.