How to Price — Alert Enterprise Quote Tool

Overview & Platform

Entry point for pricing any Guardian deployment — read this first, then jump to the relevant module.

COMPANY CONFIDENTIAL — NOT FOR CUSTOMER DISTRIBUTION. This guide is for Alert Enterprise internal sales and authorised channel partners only. Never share pricing information with customers directly — use only formally approved CPQ output, quote documents, or order forms.

v7.0

Guide Version

Q2 2026

Effective Date

112

Catalog SKUs

10

Scenario Templates

Annual

Price Model

ACV

Revenue Type

Platform Modules at a Glance

Module	Description	Base SKU
PIAM	Physical Identity & Access Management — core identity governance engine	PIAM-GUARDIAN-PLT-ENT-BASE
VIM	Visitor Identity & Access Management — enterprise visitor processing	VIM-ADV-ENT-BASE
Healthcare PVM	Patient Visitor Management with HL7 EMR integration	GRD-PVM-HL7-HEALTHCARE-BASE
ePermit	Contractor & permit management	VIM-EPERMIT-BASE-FULL
Mobile	NFC digital credential issuance via AE Wallet / Google / Apple	GRD-ADD-MOB-CRD-WLT
SOC Insights	Security operations analytics & AI/ML anomaly detection	GRD-ADD-SOC-INST-BASE-PKG
Asset Gov	Enterprise asset tracking & lifecycle governance	GRD-ADD-AST-GOV

Universal Quoting Rules

All software pricing is Annual Contract Value (ACV) — repeats every year.
Cloud deployments must include an AWS-INFRA-* SKU.
On-prem deployments must comply with SRS guides — Pre-Sales sign-off mandatory.
Every deployment needs PMO services in the quote (50–80% of Year 1 ACV).
Connectors beyond OOTB require separate ADD-CON-* (or AE-CON-*) SKUs.
Volume discounts apply to software — never to infrastructure.
Confirm the latest version of this guide before any commercial proposal.

Seller Quick Tips

ENT-BASE-PKG vs ENT-BASE

Use ENT-BASE-PKG when self-service + access mgmt are needed — it bundles all three at a ~20% discount vs buying separately. Only use ENT-BASE when those modules are genuinely out of scope. The quote builder auto-detects and nudges you to swap.

SOC Insights — Standard vs Plus

Standard = alarm analytics, building utilisation. Plus = AI/ML — intelligent alarm reduction, behaviour anomaly detection, predictive maintenance. They are mutually exclusive. Plus requires AWS-INFRA-SOC-PLUS (not AWS-INFRA-SOC).

ServiceNow — Model A vs Model B

Model A: Guardian platform + ServiceNow connector (GRD-ADD-SNOW-WAS). Customer has both. Model B: Guardian runs natively inside customer's ServiceNow — uses AE-GRD-SNOW-* SKUs only, no AWS-INFRA. Confirm architecture before any SNOW quote.

Mobile — Enterprise vs MESH

Enterprise Mobile (this pricebook): 5,000+ credentials, direct-to-end-user. MESH Programme: channel-only, 0–5,000 credentials — separate framework, NOT in this pricebook. You are only compensated on Enterprise Mobile. Always check which programme applies before investing.

Version History

Version	Date	Key Changes
R1.1	28 Apr 2026	NEW: VIM-ADV-ENT-HOST (host-license model for corporate VIM, replaces VIM-ADD-VIM-PS) · PIAM-GUARDIAN-PLT-ENT-CONTRACTOR-IDENTITY (contractor/vendor/tenant identity add-on for PIAM, MOQ 20) · 55 tiered add-on infra SKUs across SCIM, EPIC EMR, Staging, Secure DMZ, SIEMS families · DEPRECATED for corporate VIM: VIM-ADD-VIM-PS (retained for Healthcare PVM only)
v7.0	Q2 2026	VIM-ADD-VIM-AP → VIM-ADD-VIM-PS (rename) · AWS-INFRA-MOB-S discontinued · VIM-ADD-VIM-MOB-CRED formalised at $0.769/day · PIAM package incentive clarified · Healthcare PVM + ePermit added
v6.0	Q3 2025	PROF-SRV-FUNC-CONSLT updated $200→$225/hr · AWS-INFRA-MOB-S deprecation notice
v5.0	Q1 2025	Mobile wallet pricing formalised (was POR) · SMS bundles restructured to T1/T2/T3
v4.0	Q4 2024	GRD-ADD-SNOW-WAS introduced · PMO rate card updated
v3.0	Q3 2024	SOC Insights Plus (AI/ML) added · Connector types clarified

0.5 Deal Shape & License Type

Three license modes drive pricing behaviour across every module. Pick the right one in the topbar before adding line items — the math reflows when you change it.

Default is SaaS. Customer-Hosted modes (Subscription or Perpetual) are exceptions, not the norm. Most quotes are SaaS — only switch when the customer has an explicit reason. See the perpetual warning modal for the talking points.

License Type comparison

Mode	Software pricing	INFRA	Recurring	SaaS validation
SaaS (AE Cloud-Hosted) Default	Standard list price	Required — hard-blocked on export without it	Annual subscription	Hard error if no INFRA
Subscription (Customer-Hosted)	Standard list price (same as SaaS)	Suppressed (customer hosts it)	Annual subscription	Validation off
Perpetual (Customer-Hosted)	Software × 4 (Y1 one-time)	Suppressed	SSA: 22% of Y1 perpetual fee, Y2+, term picker (1/3/5 yr default 3)	Validation off

Key seller insight: the software price is identical for SaaS and Self-Hosted Subscription. There is no software premium for going on-premise. If the customer just wants on-prem hosting, use Self-Hosted Subscription — same ACV, same comp, customer hosts it. Perpetual is only for genuine CapEx-vs-OpEx preference.

Perpetual — what changes mechanically

All section='software' SKUs (PIAM-*, VIM-*, GRD-*, ADD-*, AE-GRD-SNOW-*) multiplied by ×4 for the Y1 one-time perpetual license fee
Discount stacking applies to the post-multiplier price (i.e. discount the ×4 figure, not the base subscription rate). Floor prices still apply.
AE-CON-* per-vendor connectors are NOT multiplied — they stay at standard rates
INFRA SKUs are suppressed (math returns 0, panel dimmed with a "Suppressed — Customer-Hosted" banner). Line items stay so a switch back to SaaS restores them.
Professional Services and Kiosk Hardware unchanged — standard T&M / standard ROM
Y2+ shows SSA only — 22% of Y1 perpetual software total, flat across the selected term, no annual escalation
5-Year TCO row relabels to "Total Contract Value (Y1 + N yr SSA)" with the matching math

Perpetual warning modal

Selecting Perpetual from the License Type picklist always fires a mandatory confirm modal — every time, not just the first time. The modal has three actions:

Action	Result
Confirm — Continue with Perpetual	Apply perpetual pricing. If line items exist, an extra confirm gates the recalc.
Cancel — Use SaaS	Revert picklist to SaaS. No pricing changes.
Cancel — Self-Hosted Subscription	Switch to Self-Hosted Subscription instead. Same software price as SaaS; INFRA still suppressed.

Comp reminder: you are compensated on ACV. On a perpetual deal, only the ACV-equivalent component of Y1 is treated at full ACV commission rates. The remainder of Y1 (the uplift above standard annual subscription value) is treated as a one-year sale for comp purposes. Make sure you understand the impact before positioning perpetual as the preferred path.

Forecast-window toggles (proposal output)

Two independent checkboxes on Step 8 (Review) shape the proposal output. Both default off — use only when the customer wants a specific term view.

Toggle	Effect
Hide Year 4 & Year 5	3-year deal view. Y4/Y5 forecast columns drop. TCO row relabels to "3-Year Total Cost of Ownership" and recomputes.
Hide Year 2 & Year 3	Stacks with Y4/Y5 to give a 1-year-term view. Both on → only Y1 column shows, TCO row relabels to "1-Year Total Cost of Ownership".

Y2/Y3 alone (without Y4/Y5 also hidden) is an unusual combination — supported but TCO stays at 5-year since the math would otherwise be misleading.

1. VIM — Visitor Identity Management

Enterprise visitor processing, lobby management, self-service kiosks.

VIM-ADV-ENT-BASE is required for standalone VIM deployments. Base includes 1 lobby + 1,000 named hosts + 1 SSO. If Guardian PIAM is already active, skip ENT-BASE and use VIM-ADV-LOBBY + VIM-ADV-ENT-HOST only. Permanent cardholder use cases require combination with PIAM part numbers.

R1.1 licensing change (28 Apr 2026): Corporate / enterprise VIM now licenses by named host (VIM-ADV-ENT-HOST, $2 / host / year) — NOT by processing station. VIM-ADD-VIM-PS is deprecated for corporate VIM (retained only for Healthcare PVM, which keeps the processing-station model via GRD-ADD-PVM-HEALTHCARE-PS).

Included Out of the Box

Visitor pre-registration & host invitation workflows
Lobby Dashboard — check-in/out, photo capture, screening, observations
Self-service kiosk application
Visitor survey, NDA capture, photo capture, badge printing
Watchlist & denied-parties screening (add-ons for external databases)
Host & visitor notifications (SMS requires GRD-ADD-SMS-* SKUs)
1× Host Information Sync Connector (AD/LDAP or CSV)
1× SSO integration

SKUs

Part Number	Description	Model
VIM-ADV-ENT-BASE	Enterprise Base — 1 Lobby + 1,000 Hosts + 1 SSO	Per Base
VIM-ADV-LOBBY	Additional Visitor Lobby	Per Lobby/yr
VIM-ADV-ENT-HOST NEW R1.1	Additional Host License (corporate VIM) — replaces VIM-ADD-VIM-PS	$2 / Host / yr
VIM-ADD-VIM-MOB-CRED	Temporary Visitor Mobile Credential	Per Visitor/day
VIM-ADD-VIM-PS DEPRECATED for corporate	Additional Processing Station — retained for Healthcare PVM only	Per Station/yr

R1.1 (28 Apr 2026): Corporate VIM moves to per-host licensing. New quotes for corporate / enterprise VIM should use VIM-ADV-ENT-HOST in place of VIM-ADD-VIM-PS. Healthcare PVM continues to use processing stations via GRD-ADD-PVM-HEALTHCARE-PS.

Validated Peripherals (Key)

Device	Vendor / Model
Camera	Logitech Brio 101 / C930e / C920 PRO
QR/Barcode	Zebra DS5502 · Honeywell 1900G-SR
Document Scanner	Thales AT10K · Canon DR-C225
Badge Reader	RF IDeas WAVE ID Plus · HID Omnikey
Card Printer	HID Fargo HDP5000 / DTC4250e
Label Printer	DYMO LabelWriter 550 / 4XL

AE certifies individual peripherals only, not combined assemblies. Custom kiosk builds need pre-sales tech review.

2. Healthcare Patient Visitor Management

HL7 EMR integration · Inpatient, Outpatient, Corporate healthcare visitor workflows.

Healthcare visitor use cases ONLY. Corporate visitor use cases must be purchased separately using standard VIM SKUs. Screening (sex offender, criminal) requires additional part numbers — NOT included by default.

What's Included

Inpatient admission (ADT) synchronisation from EMR
Patient location & status real-time updates
Visitor eligibility validation — configurable rules
Outpatient pre-registration via SIU scheduling messages
Real-time HL7 ADT/SIU event-driven workflow updates
1× SSO Connector + 1× Directory Connector + 1 Lobby included

Part Number	Description	Cost Model
GRD-PVM-HL7-HEALTHCARE-BASE	Healthcare PVM Base — OOTB: 1× EPIC + 1× PACS + 1× SSO + 1× Directory + 1× Lobby + 1,000 hosts	Per Base/yr
GRD-ADD-PVM-HEALTHCARE-LOBBY	Additional Visitor Lobby	Per Lobby/yr
GRD-ADD-PVM-HEALTHCARE-PS	Additional Visitor Processing Station	Per Station/yr
ADD-CON-EPIC OOTB in base	EPIC EMR Integration Connector — 1× included free in PVM base. Quote separately ONLY for a second EPIC system.	Per Integration Point
ADD-CON-PACS OOTB in base	PACS Bi-directional Connector — 1× included free in PVM base. Quote separately ONLY for a second PACS system.	Per Integration Point
AWS-INFRA-PVM-* NEW R1.3	Healthcare PVM infrastructure stack — pick the tier matching total lobby count (BASE 1–5, 5–10, 10–20, 20–30, 30–40, 40–50, 50–100, 100–150, 200–250). Identical pricing to CORP VIM stack.	Per Year
INFRA-HEALTHCARE-EPIC-GW NEW R1.3	EPIC DMZ Gateway — mandatory for every Healthcare PVM deployment. Single flat $10,629.60/yr regardless of identity count (capacity is throughput-bound: 50K msgs/hour). Replaces the old 11-tier INFRA-HEALTHCARE-EPIC-{tier} family.	Per Year

EPIC infrastructure rule (R1.3): Every Healthcare PVM deployment must include INFRA-HEALTHCARE-EPIC-GW ($10,629.60/yr). The quote builder auto-adds it when the PVM base is in scope. One license per deployment covers all EPIC systems up to 50K msgs/hour; above that = POR (engage pre-sales).

3. ePermit — Contractor Visitor & Permit Management

Contractor onboarding, permit-to-work, compliance workflows.

Choose the correct base: VIM-EPERMIT-BASE-FULL when both VIM and ePermit are new. VIM-EPERMIT-BASE-ADDON when extending an existing VIM-ADV-ENT-BASE deployment. The quote builder will block these if misconfigured.

Included Out of the Box

Contractor company onboarding & profiles
Worker pre-registration & qualification tracking
Digital induction & safety acknowledgement
Multi-level permit-to-work approval workflow
Work order & scope management

Contractor check-in/out enforcement vs permit status
Real-time contractor presence tracking
Permit expiry & renewal workflows
Compliance document management
Full audit trail + PACS integration

Base includes: 1 Processing Point · 5 Vendor Companies · 5 ePermit Admins · 1 Host Sync Connector. ePermit Contractor Access Hubs are SEPARATE from VIM Visitor Processing Stations.

Part Number	Description	Cost Model
VIM-EPERMIT-BASE-FULL	ePermit Full Base — VIM + ePermit combined	Per Base/yr
VIM-EPERMIT-BASE-ADDON	ePermit Add-On — extend existing VIM-ADV-ENT-BASE	Per Base/yr
VIM-ADD-EPERMIT-HUB	Additional Contractor Processing Point	Per Point/yr
GRD-ADD-EPERMIT-VENDOR	Additional Vendor Company (beyond 5)	Per Company/yr
GRD-ADD-EPERMIT-ADMIN	Additional ePermit Administrator	Per Admin/yr

4. Guardian PIAM — Physical Identity & Access Management

Core identity governance engine · Hire-to-retire lifecycle automation.

Lead with ENT-BASE-PKG. It bundles PIAM + Access Management + Self-Service Portal with a built-in ~20% discount. Only use ENT-BASE if self-service and access mgmt are genuinely not in scope. The quote builder detects this automatically and offers a one-click bundle swap.

SKU Decision Tree

1

Does the customer need self-service + access governance?

YES → use PIAM-GUARDIAN-PLT-ENT-BASE-PKG (20% discount). NO → PIAM-GUARDIAN-PLT-ENT-BASE + modules as needed.

2

Mobile-credential-only deployment?

Use PIAM-GUARDIAN-PLT-MOB-BASE. Upgrade to ENT-BASE if any PIAM governance feature is needed later.

3

Count the identities

MOQ: 2,000 identities for ENT-BASE / ENT-BASE-PKG. MOQ: 1,000 for MOB-BASE. Identity metric = total active cardholders in PACS managed via PIAM.

4

Add infrastructure

All cloud deployments require AWS-INFRA-ADV. On-prem requires SRS compliance + Pre-Sales sign-off.

5

Count connectors

ENT-BASE includes 3 OOTB (1 HR, 1 AD/SSO, 1 CSV). Every additional system needs an ADD-CON-* SKU, or a vendor-specific AE-CON-PACS-* / AE-CON-IDP-* SKU. Each connector must be specified in the SoW.

Part Number	Description	MOQ	OOTB Connectors
PIAM-GUARDIAN-PLT-ENT-BASE-PKG	Full package — PIAM + Access Mgmt + Self-Service (20% discount)	2,000	4 (1 HR, 1 AD, 1 CSV, 1 PACS)
PIAM-GUARDIAN-PLT-ENT-BASE	Core PIAM engine only	2,000	3 (1 HR, 1 AD, 1 CSV)
PIAM-GUARDIAN-PLT-MOB-BASE	Mobile credential-only PIAM	1,000	3 (1 HR, 1 AD, 1 CSV)
PIAM-GRD-ADD-ACCS-MGMT	Access Management — area owners, SoD, periodic reviews	—	Requires ENT-BASE
PIAM-GRD-ADD-EMP-PRTL	Employee Self-Service Portal	—	Requires ENT-BASE
PIAM-GUARDIAN-PLT-ENT-CONTRACTOR-IDENTITY NEW R1.1	Contractor / Vendor / Tenant Identity License — delegated identity mgmt, tenant/vendor portal, badge & access workflows. ONLY for third-party identities — NOT for employees.	20	Requires ENT-BASE or ENT-BASE-PKG

Contractor Identity (R1.1) — when to use it: vendor/tenant org management, delegated contractor onboarding/offboarding, contractor badge & access workflows, self-service portal for external users, periodic contractor access reviews. Typically deployed alongside PIAM-GUARDIAN-PLT-ENT-BASE-PKG + ADD-CON-RECON. Licensing restriction: only for contractor / third-party identities. Employees license through standard PIAM Base. $20 / identity / year, MOQ 20.

5. Mobile Access

Enterprise Mobile (5k+) · NFC digital credentials · Google & Apple Wallet.

Enterprise Mobile = 5,000+ credentials, direct sales. Under 5,000 credentials via channel = MESH Programme (separate framework, NOT in this pricebook). You are ONLY compensated on Enterprise Mobile. Always confirm which programme applies before investing time.

Mobile SKU Selection

Part Number	Use Case	Dependencies	Key Note
PIAM-GUARDIAN-PLT-MOB-BASE	Mobile-only PIAM tier	AWS-INFRA-MOB	MOQ 1,000. Upgrade to ENT-BASE if PIAM governance needed.
GRD-ADD-MOB-CRD-WLT	Perm employee Google/Apple Wallet credential	AWS-INFRA-MOB + PIAM-MOB-BASE + ADD-CON-FULL	Price includes HID/Wavelynx + Wallet fees. Enterprise 5k+ only.
GRD-ADD-PART-MOB-CRD	Partner mobile credential (no AE Wallet app)	PIAM-PLT	WaveLynx does NOT support this model. Confirm provider first.
VIM-ADD-VIM-MOB-CRED	Temporary visitor mobile credential	VIM-ADV-ENT-BASE or PLT	Per visitor/day. Web workflow, no AE Wallet dependency.

Q2 2026: AWS-INFRA-MOB-S has been discontinued. All mobile deployments must now use AWS-INFRA-MOB regardless of identity volume.

6. SMS Notifications & Watchlist Screening

Geographic SMS tiers · Real-time denied-party screening.

SMS Notification Bundles

Match the part number to the destination country of the recipient — not the deployment country. Multinational deployments may need multiple SMS tiers in the same quote.

PN	Tier	Key Markets
GRD-ADD-SMS-T1	Tier 1 — Core	US, Canada, UK, Ireland, Australia, NZ, France, Germany, NL, Belgium, Spain, Italy, Switzerland + major EU/APAC/LATAM
GRD-ADD-SMS-T2	Tier 2 — Standard	Saudi Arabia, Kuwait, Egypt, Israel, Kenya, Nigeria, Ghana, Tanzania + Middle East / Africa
GRD-ADD-SMS-T3	Tier 3 — Premium	Gabon, Madagascar, Rwanda, Bhutan, American Samoa, Monaco, Andorra, French overseas territories
GRD-ADD-SMS-POR	POR	Countries not in T1–T3. Contact Revenue Operations. Sanctioned countries excluded from all tiers.

Watchlist Screening — ADD-WATCHLIST-TESSERA UPDATED R1.4

Real-time screening against external denied-party & criminal watchlist databases
R1.4 list price: $0.40/scan (corrected from $1.40 — set incorrectly at initial publication)
Every screen = discrete API call — including repeat screenings of same individual
Requires 1× ADD-CON-FULL connector
Must be deployed with licensed PIAM or VIM platform
Estimate annual volume + 20% buffer. Annual true-up required
US NSOR & criminal databases only at publication. Other regions = POR

R1.4 discount eligibility (NEW): ADD-WATCHLIST-TESSERA is now subject to standard tier volume discounts (up to 40% E-tier) and VAR/channel discounts (up to 30%). Discounts apply sequentially, not additively.

ABSOLUTE FLOOR — $0.12/scan. Regardless of combined tier + VAR discounts, no quote may go below $0.12/scan. Deal Desk must enforce on every Tessera-bearing quote.

7. Hosting & Infrastructure

AWS-INFRA-* base SKUs · R1.1 tiered INFRA-* add-ons · SRS compliance for on-prem · Not subject to volume discounts.

On-prem deployments — SRS COMPLIANCE IS MANDATORY. AE will not certify, support, or provide SLA guarantees for deployments not built to published SRS standards. Pre-Sales Technical team MUST be engaged at scoping stage. No exceptions. Required SRS guides: Guardian PIAM, VIM, SOC Insights, Mobile Access, ePermit + any module-specific SRS in scope.

Core AWS Infrastructure SKUs

Part Number	Use With	Capacity	Key Note
AWS-INFRA-ADV	PIAM, VIM, PIAM+VIM	10,000 identities · 350k visits/yr · 5 mobile creds/identity	Most common. Add expansion for >10k.
AWS-INFRA-ADV-EXPANSION	Above AWS-INFRA-ADV 10k limit	Per identity	Not volume-discountable.
AWS-INFRA-MOB	Mobile-only (no PIAM/VIM)	10,000 identities	Replaces discontinued AWS-INFRA-MOB-S.
AWS-INFRA-MOB-EXPANSION	Above MOB 10k limit	Per identity	—
AWS-INFRA-SOC	SOC Insights Standard — ADD to other INFRA, don't replace	10,000 identities + 10,000 devices	Combine with AWS-INFRA-ADV.
AWS-INFRA-SOC-PLUS	SOC Insights Plus (AI/ML) — ADD to other INFRA	10,000 identities + 10,000 devices	Must use PLUS not standard SOC.
AWS-INFRA-VIM-CORP-* NEW R1.3	Corporate VIM standalone only (not needed if AWS-INFRA-ADV active)	Tiered by lobby count: BASE 1–5, 5–10, 10–20, 20–30, 30–40, 40–50, 50–100, 100–150, 200–250 + per-lobby expansion ($2,266) + per-visit overage ($0.0927)	R1.3 split: use CORP for corporate VIM, PVM for healthcare. 4 new mid-range tiers fill the old 10→50 gap.
AWS-INFRA-PVM-* NEW R1.3	Healthcare PVM standalone (mandatory pair: INFRA-HEALTHCARE-EPIC-GW)	Same 9 lobby tiers as CORP + per-lobby / per-visit expansions	Identical pricing to CORP — separation enforces EPIC-GW pairing.
INFRA-SINGLE-TENANT	Dedicated single-tenant hosting	Custom	Not at MSRP — management approval required.
INFRA-MIT-HYBRID	Hybrid cloud hosting	Custom	POR. Pre-Sales approval required.
AE-BYOI-DEPLOY NEW	Customer-hosted (BYOI — on-prem or customer Azure/AWS/GCP)	Per Deployment · $0	Drop this onto the quote when the customer is hosting Guardian themselves. Zero AE infra fee. SRS compliance mandatory + pre-sales architectural review for AI/ML, advanced analytics, managed services.

R1.3 Add-On Infrastructure Families UPDATED R1.3

Add-on rules: these all extend the base AWS-INFRA-* SKU — they never replace it. Most families have 11 identity tiers from 10K → 800K (tier suffix uses K-format: -10K … -800K). EPIC is now the single flat-rate exception. Not subject to volume discounts. Annual cadence. All prices R1.3 (+3% from R1.2 plus full re-curves on several families).

INFRA-HEALTHCARE-EPIC-GW — EPIC DMZ Gateway MANDATORY for PVM NEW R1.3

Mandatory for every Healthcare PVM deployment. Single flat $10,629.60/yr regardless of identity tier — capacity is throughput-bound (50K EPIC msgs/hour per instance), not identity-bound. Replaces the old 11-tier INFRA-HEALTHCARE-EPIC-{10K…800K} family. One license per deployment covers all EPIC systems within that deployment. Above 50K msgs/hour = POR — engage pre-sales. Auto-paired by the quote builder when GRD-PVM-HL7-HEALTHCARE-BASE is in scope.

INFRA-SCIM-SERVER-* — SCIM 2.0 Provisioning Infrastructure RENAMED R1.3

Quote whenever a SCIM 2.0 connector is in scope for automated identity provisioning between Guardian PIAM and an external IdP (Okta, Entra ID, Ping, etc.). SCIM has the same high real-time API volume profile as EPIC — needs its own server infrastructure. R1.3 re-curve: $2,985 (10K) → $82,621 (800K). Tier identifiers now use K-suffix (e.g. INFRA-SCIM-SERVER-10K) — renamed from R1.1's full-numeric form (-10000 etc.).

INFRA-STAGING-ENV-* — Staging / Pre-Production Environment

Dedicated non-production AWS environment mirroring production. Recommended for all Phase 2+ deployments and any customer with formal change-management / QA / compliance requirements. Required when the customer needs to test integrations, upgrades, or config changes before promoting to production. R1.3 re-curve: $4,087 (10K) → $112,924 (800K).

INFRA-SECURE-DMZ-* — Secure DMZ / Reverse Proxy

Reverse proxy + gateway agent + tenant portal endpoints. Quote when network segmentation between Guardian and external systems is required, when mobile credential check-in / check-out is in scope, or when advanced security policies require traffic inspection at the platform boundary. R1.3 steeper re-curve: $2,472 (10K) → $68,135 (800K) — much steeper than R1.1's flat $2,400–$9,600 band.

INFRA-SIEMS-* — Third-Party SIEM Integration

Infrastructure for integrating Guardian telemetry with enterprise SIEMs (New Relic, Splunk, Datadog, etc.) — centralised security monitoring and incident response. Quote when standard CloudWatch monitoring is insufficient. Common in regulated industries (financial services, healthcare, government, critical infrastructure). R1.3 curve: $6,180 (10K) → $169,938 (800K). Sanity-check before quoting 500K+.

AWS-INFRA-ADV-PIAM-* — PIAM Volume-Tier Infrastructure NEW R1.3

PIAM infrastructure sized by total managed identity population. Use when identity count exceeds the flat AWS-INFRA-ADV 10K ceiling. 11 tiers: $24,874 (10K) → $746,031 (800K). PIAM only — combined stacks (VIM, SOC, Mobile) require separate module infrastructure on top.

Add-on Infra — When to Quote (R1.3)

Healthcare PVM in scope? → MUST add INFRA-HEALTHCARE-EPIC-GW (auto-added by the builder when GRD-PVM-HL7-HEALTHCARE-BASE is in the quote)
SCIM connector in scope? → MUST add INFRA-SCIM-SERVER-{tier} (tier suffix is K-format: -10K … -800K)
PIAM above 10K identities? → switch from flat AWS-INFRA-ADV to the tiered AWS-INFRA-ADV-PIAM-{tier} family
Phase 2+ / regulated industry / formal QA? → recommend INFRA-STAGING-ENV-{tier}
Mobile credentials, network segmentation, or tenant portal? → consider INFRA-SECURE-DMZ-{tier}
Customer SecOps requires enterprise SIEM? → quote INFRA-SIEMS-{tier}

8. Connectors & Integrations

ADD-CON-RECON · ADD-CON-PACS · ADD-CON-FULL · ADD-CON-EPIC · vendor-specific AE-CON-*

Selecting the wrong connector type is a common scoping error. Every additional connector beyond OOTB inclusions requires a separate ADD-CON-* SKU, or a vendor-specific AE-CON-PACS-* / AE-CON-IDP-* SKU. All connectors must be on the AE Connector Catalogue and specified in the SoW.

Connector Type Guide

ADD-CON-RECON — Reconciliation (Read Only)

One-way inbound integration. Pulls identity records, credential data, training prerequisites, alarm events, roster data into Guardian. Does NOT write back. Use for: HR/Identity sources beyond the 1 OOTB, LMS for training prerequisite enforcement, roster sync from ERP.

ADD-CON-PACS — PACS Bi-directional

Bi-directional integration with Physical Access Control Systems. Enables full cardholder, credential, access level, badge event, alarm sync. Integration depth varies by PACS API capability. Each discrete PACS requires its own ADD-CON-PACS license.

ADD-CON-FULL — Full Bi-directional Read/Write

Guardian reads from AND writes to the third-party system. Required for: Mobile Credential Providers (HID, Wavelynx) with GRD-ADD-MOB-CRD-WLT, Intrusion Panels, Alarm Mass Notification, Guest WiFi, LMS where Guardian writes completion data. Note: ADD-CON-FULL is already bundled with GRD-ADD-PART-MOB-CRD — do NOT add separately for that SKU.

ADD-CON-EPIC — EPIC EMR (Read Only — VIM only)

VIM-specific connector for EPIC Electronic Medical Record integration. One-way: reads patient admission, appointment, eligibility data from EPIC to drive visitor workflows. Not interchangeable with ADD-CON-RECON for EPIC use cases — this dedicated connector is required.

AE-CON-PACS-* — Vendor-specific PACS connectors

Matt's tool carries named vendor SKUs in addition to the generic ADD-CON-PACS: AMAG, Avigilon, Bosch, Brivo, CCure, Cisco, Continental, DMP, DSX, Gallagher, GE, Genetec, HID, Hirsch, Honeywell, Idemia, JCI, Kantech, Lenel S2, Matrix, Nedap, Open Options, RS2, S2Netbox, SiPass, SiPort, Vanderbilt. Use the specific vendor SKU when known for clearer quotes.

AE-CON-IDP-* — Vendor-specific Identity Provider connectors

Named IDP vendor SKUs: Active Directory, CSV, CyberArk, Entra ID, Google, Okta, OneLogin, Oracle, Ping Identity, SAP, Workday. Use the specific vendor SKU in place of a generic ADD-CON-RECON when the identity source is one of these.

9. SOC Insights

Standard (analytics) vs Plus (AI/ML/NLP) · Mutually exclusive per deployment.

Standard and Plus are mutually exclusive on the same deployment — the quote builder will block the combination. Plus requires AWS-INFRA-SOC-PLUS (not AWS-INFRA-SOC). The SOC INFRA SKU is added to the core INFRA SKU — not replacing it.

Standard — GRD-ADD-SOC-INST-BASE-PKG

Badge Events & Alarms consolidation from multiple sources
Alarm Analytics by Building, Reader, Time of Day/Week
Identity-Based Activity Reporting & Attendance Summaries
Door Reader Activity & Intelligent Alarm Correlation
Building Utilisation Reporting
100 monitored devices included

Add GRD-ADD-SOC-INST-DEVICE (per device) for >100 devices. Pair with AWS-INFRA-SOC.

Plus (AI/ML) — GRD-ADD-SOC-INST-PLUS-BASE-PKG

All Standard capabilities
ML-driven behaviour anomaly detection
Intelligent alarm reduction & noise suppression
Predictive maintenance analysis for devices
GenAI-powered NLP query of security event data
100 monitored devices included

Add GRD-ADD-SOC-INST-PLUS-DEVICE for >100 devices. Pair with AWS-INFRA-SOC-PLUS.

10. ServiceNow — Two Deployment Models

Model A: Guardian + SNOW connector · Model B: Guardian native on SNOW.

Confirm the architecture BEFORE quoting. Model A and Model B are fundamentally different. The quote builder enforces the separation, but confirm with the customer first. All ServiceNow pricing is in the dedicated Guardian on ServiceNow Pricebook — never invent figures.

Model A — Guardian + ServiceNow Integration

Customer has both Guardian PIAM AND ServiceNow
Guardian hosted on AE cloud or client servers
ServiceNow used as self-service request front-end only
SKU: PIAM-GUARDIAN-PLT-ENT-BASE + GRD-ADD-SNOW-WAS
AE does NOT provide ServiceNow licensing

Model B — Guardian on ServiceNow (Native)

Customer is ServiceNow-first — Guardian lives inside their SNOW
No separate Guardian platform deployed
No AWS-INFRA-* required — the builder will block this
Uses AE-GRD-SNOW-* SKU family exclusively
Customer needs active licensed SNOW instance

Model B SKUs

PN	Use When	Cost Model
AE-GRD-SNOW-PIAM-PKG	Full PIAM — identity governance, access rights, lifecycle	Per Identity · MOQ 2,000
AE-GRD-SNOW-VIM-PLT	VIM standalone — visitor management only, no PIAM. Includes 1,000 hosts out of the box.	Per Deployment
AE-GRD-SNOW-VIM-HOST NEW	Additional Host License (SNOW VIM) — beyond the 1,000 included in -PLT. Provisional at $2/host/yr; pending Sales Eng confirmation.	$2 / Host / yr
AE-GRD-MOB-PLT	Mobile credential only — no PIAM or VIM. Pair with AE-GRD-SNOW-EMP-MC	Per Deployment
AE-GRD-SNOW-VIM	Additional Visitor Lobby (up to 2,000 visitors/month)	Per Lobby/yr
AE-GRD-SNOW-EMP-MC	Employee NFC Mobile Credential. Price includes HID/Wavelynx + Wallet fees	Per Identity · MOQ 1,000
AE-GRD-SNOW-CONN	Additional connector beyond OOTB inclusions	Per Connector/yr

11. Additional Modules

Mustering · Identity Verification (IDV) · Asset Governance.

Mustering Module

Emergency response, personnel accountability & evacuation management. Hardware not included — must be sourced separately.

PN	Description	Model
ADD-MUSTERING-BASE	Enterprise Base — includes 1 muster point	Per Deployment/yr
ADD-MUSTERING-MP	Additional Muster Point	Per Point/yr
MUSTERING-ADD-EMP	Per-identity license — use only when PIAM is NOT in project	Per Identity/yr

Identity Verification (IDV)

750+ ID types · 222 countries · Sold in 10,000-check blocks.

PN	Description	Model
ADD-IDV-IDPF	Standard OCR — automated ID data capture + auto-populate visitor forms + barcode/OCR cross-validation	Per 10k-check block
ADD-IDV-IDFRNC	Advanced — as IDPF plus Face Matching, Liveness Detection, Document Colour Validation	Per 10k-check block
ADD-IDV-SOR	Sex Offender Registry check — add-on to IDPF or IDFRNC only. Cannot deploy standalone	Per 10k-check block

Asset Governance — GRD-ADD-AST-GOV

Enterprise asset lifecycle management — digital and physical assets, self-service requests, audit trails.

Cost model: Per Block of 100 Assets.

12. PMO — Professional Services

Rate card · Always include in every quote · Guide band: 50–80% of Year 1 ACV.

Every deployment requires PMO services. Missing PS is the single most common cause of delayed deployments, cost overruns, and unhappy customers. Include PMO in EVERY quote — not just kiosk. The builder will warn if the PS section is empty.

PS Rate Card

Part Number	Role	Deliverables	Rate
PROF-SRV-PMO	Project Manager	Project Plan, activity tracking, deliverables, stakeholder comms	$300/hr
PROF-SRV-ARCHITECT	Solution Architect	Deployment architecture design, review & governance	$300/hr
PROF-SRV-TECH-CONSLT	Technical Consultant	System configuration, testing & go-live	$225/hr
PROF-SRV-FUNC-CONSLT	Functional Consultant	Use cases, FDD, UAT scripts, data validation	$225/hr
PROF-SRV-DOC-TRN	Documentation & Training	End user guides, badge admin guides, Train-the-Trainer	$175/hr

Guide band: 50–80% of Year 1 ACV for full AE delivery. Scope varies significantly based on: number of integrations, use case complexity, phasing, deployment model, and how much Convergint is delivering vs AE. Use the PS slider in the quote builder to apply.

Default Role Mix

The quote builder's "Apply Estimate" distributes the target budget across roles using this mix. Rep can hand-tune any role afterward.

Role	% of Target Budget	Typical Responsibility
PMO	15%	Oversight, cadence, milestones
Architect	15%	Design, review, governance
Technical Consultant	40%	Hands-on config, integration, go-live
Functional Consultant	20%	Use cases, FDD, UAT scripts
Doc & Training	10%	End-user guides, train-the-trainer

13. Kiosk Hardware ROM ONLY

ROM pricing only · KIOSK Information Systems · Always obtain project-specific quote before final proposal.

ROM PRICING WARNING. ALL KIOSK hardware pricing is ROM only. A project-specific quote MUST be obtained from KIOSK.com for EVERY engagement. Quotes valid 15–30 days. Never commit hardware pricing without a current valid KIOSK.com quote.

Build Configurations

Build	Name	Included Hardware	Form Factors
Build 1	Standard	Posiflex 21.5" touchscreen · Logitech C930e camera · Posiflex CD3601 barcode scanner · Posiflex MK-3100 PC (Tiger Lake i5, 8GB, 256GB SSD, Win 10 IoT LTSC)	Apex Countertop / Pedestal / Wallmount
Build 2	Std + Printer	Build 1 + DYMO LabelWriter 550 Turbo + Posiflex Status Indicator Light	Apex Countertop / Pedestal / Wallmount
Build 3	Std + Printer + ID Reader	Build 2 + Eseek M260 Driver Licence Magstripe Reader	Apex Pedestal only
Build 4/5	Full — Card Printer & RFID	Build 3 + Fargo HDP5000e ID Card Printer + RFIDeas WAVE ID Plus	Benchmark Pedestal ONLY

Every peripheral combination changes the physical enclosure geometry. Any change after order placement triggers a full redesign, re-test, and re-certification cycle — adding significant cost and resetting lead times. Lock the spec before ordering. All peripheral decisions must be validated by AE pre-sales.

Deployment Design Checklist

Work through every area before locking the spec and requesting a quote from KIOSK.com.

Printing: Hard ID card (Build 4/5) / Thermal rewritable (Build 2+) / Thermal visitor label (Build 2+) / No printing (Build 1). Returns bin needed?
RFID: Confirm PACS credential technology. Standard HID/MIFARE/SEOS → WAVE ID Plus included. Proprietary (Gallagher, dormakaba custom) → Free-Issue process required.
Biometrics: Fingerprint or palm vein? — significantly changes form factor and certification. Must be scoped with AE Solutions Architecture before any commitment.
Mounting: Freestanding / Wall mount (confirm structural) / Desk / Earthquake bolt-down (seismic zones mandatory) / Indoor or outdoor IP-rated?
OS & Network: Windows IoT confirmed. MDM enrolment platform? Corporate golden master needed? Fixed Ethernet (preferred) / WiFi / 5G? VLAN/firewall ports for KNECT IoT and Guardian VIM API confirmed with IT?
Certifications: Most models US-only. EU/EEA: CE mark (+4–8 weeks). UK: UKCA (separate). Other markets: confirm with KIOSK.com. IOR arranged?
ADA/Aesthetics: Custom RAL colour / skins / LED lighting? Brand sign-off? ADA-compliant geometry confirmed for selected form factor?
Contracts: Reseller contract with AE in place? End-user contract reviewed? Payment terms, insurance, liability agreed? Current KIOSK.com project-specific quote obtained?

OS Management Services requires Hardware Support Services. License entitlement must be purchased per kiosk before any service activation. Both available on 3-year or 5-year terms.

Hardware Support Package

Proactive remote monitoring & automated alerts via KNECT IoT
Advanced Exchange Warranty & Parts Hot Swap — factory-stocked, overnight dispatch
Complete Field Services — tech arrives with part in-hand, single-visit repair
Monthly reporting: Uptime, Hardware Status, IoT Campaign, KPI Status
Real-time KNECT IoT fleet dashboard

OS Support Package (requires HW Support)

Initial Kiosk Deployment Image — factory-loaded, QA-verified
Image Management — custom OS config, security hardening, full QA
KIOSK Security Suite: Host Device Control · Active Threat Protection · Drive Encryption · Stateful Firewall · Integrity Control
In-house KIOSK Technical Support Mon–Fri, automated ticketing

Additional Site Services

Service	Description	When Required
Site Survey	Methodical review: accessibility, utility readiness, logistics. Eliminates costly delays.	Recommended all. Mandatory for multi-site or complex installs.
Installation — Freestanding	Unpack, inspect, place, electrical & data connections, site rep training	Standard indoor pedestal/countertop.
Installation — Bolt-Down/Wall	As above + structural mounting, seismic bolt-down	Wall mount & all seismic zone deployments.
Preventative Maintenance	Semi-annual KIOSK technician visits — clean, inspect, test. Reduces false-failure RMAs ~60%	Recommended all deployments.
HIM License	One-time fee for full KIOSK API library access via KNECT IoT	Required if KNECT IoT integration in scope.

RFID mismatch is the #1 credential failure. The reader technology MUST exactly match the customer's PACS. Mismatched = credential read failure on day one. Confirm DURING pre-sales scoping — not at installation.

Standard Reader — Build 4/5 (Included)

RFIDeas WAVE ID Plus Keystroke V2 — multi-technology reader, covers the vast majority of PACS deployments.

Technology	Standard Reader?
HID Prox (125kHz) / iCLASS / SE / Elite / SEOS	WAVE ID Plus
MIFARE Classic / DESFire / EV1 / EV2	WAVE ID Plus
LEGIC Advant / NFC ISO 14443	WAVE ID Plus
EM4100 / Indala / AWID (standard)	WAVE ID Plus
Gallagher T-Series	Free-Issue Required
dormakaba custom formats	Confirm with KIOSK.com & AE pre-sales
Encrypted legacy / custom PACS formats	Free-Issue Required
BLE / Mobile Credential	Confirm — requires specific BLE reader module

Free-Issue Process (Non-Standard RFID)

1

Pre-Sales Scoping

Flag non-standard RFID requirement to AE pre-sales before spec is locked. Must be confirmed before any order.

2

Reader Procurement

Partner procures required reader from PACS vendor. AE pre-sales confirms compatibility with KIOSK engineering first.

3

Ship to Factory

Partner ships reader(s) to KIOSK.com before manufacturing commences. Late arrival delays the entire build.

4

Factory Integration & QA

KIOSK integrates and tests with the free-issued reader. Credential read tested if partner provides a test card.

5

Onsite Acceptance

Partner tests credential read with live customer cards on the PACS during onsite acceptance before go-live.

Size for PEAK throughput — not average. A lobby processing 200 visitors/day can have 80% arrive in a 1-hour window. Always model the peak, add +1 for redundancy, and factor in your slowest workflow type.

Kiosk Sizing Calculator

This is the same calculator embedded in the quote builder's kiosk step — use it here to scope before building a quote.

Peak visitors per hour

Average transaction time

Minimum kiosks required

—

Quick Reference by Volume

Daily Visitors	Recommended Kiosks
<50/day	1 kiosk + receptionist fallback
50–200/day	2 kiosks (1 active + 1 redundancy)
200–500/day	3–4 kiosks
500+/day	4–6+ kiosks + staging area
Card issuance required	Pre-register visitors. Low throughput — plan additional kiosks.
Mixed visitor types	Calculate each type separately then sum.

Site Survey — What to Confirm

Physical Space

Floor space with door swing and ADA clearance
Cable routing path — power + network identified
Floor surface: level, stable, suitable for pedestal/bolt-down
Wall structural adequacy for wall-mount
Seismic zone — bolt-down mandatory?
Outdoor IP-rated enclosure needed?

Power & Network

Power outlet within 2m of kiosk location
Fixed Ethernet port at kiosk location (preferred over WiFi)
VLAN/firewall ports: KNECT IoT + Guardian VIM API confirmed with IT
WiFi: min -65dBm, WPA2+, static IP or DHCP reservation

Visibility & Environment

Screen not in direct sunlight (glare + touch issues)
Camera clear line of sight to approaching visitors
Adequate ambient lighting (not backlit from windows)
Visitor flow confirms kiosk placement is intuitive from entry

Installation Day QA

Screen + touch (all zones)
Camera (image quality, focus, lighting)
Barcode scanner (QR and 2D reads)
Label printer (test print, alignment, cut)
RFID reader (credential read with known card)
End-to-end check-in and check-out workflow
Host notification delivery (email/SMS)
Sign-off with site representative — document & retain

AE and KIOSK.com do NOT supply consumables. Partner or end user is responsible for procuring, stocking, and managing all consumables. Running out of consumables is the single most avoidable cause of kiosk downtime.

Daily & Operational Maintenance

Applies To	Component	Frequency	Task	Impact if Neglected
All Builds	Touchscreen	Daily / as needed	Clean with anti-static soft cloth. Spray on cloth first — never on screen.	Smearing reduces touch accuracy and readability
All Builds	Camera & Scanner	Weekly	Wipe lens and scanner window with lint-free cloth. No solvents.	Dirty scanner is #1 cause of false NDF returns
Builds 2, 3, 4/5	DYMO Label Roll	As depleted	Keep spare rolls on site. ~220 labels/roll. 300 visitors/day = 30+ rolls/month.	Empty roll = kiosk cannot complete check-in
Build 4/5	Fargo Ribbon Cassette	~250–500 prints	Replace when depleted. Keep min 2 spare cassettes on site.	No card printing. Site 100+/day may exhaust in 3–5 days.
Build 4/5	Fargo Card Hopper	Daily check	Load with Fargo-approved CR80 only. Fan cards before loading. Keep 500+ cards on site.	Wrong stock voids printer warranty. Causes jams.
Build 4/5	Fargo Cleaning Roller	Every ~500 prints or monthly	Run cleaning cycle via printer menu. Replace roller per manufacturer schedule.	Print quality decline → jams → head damage (not under warranty).

INTERNATIONAL DEPLOYMENT WARNING. Most KIOSK models are US-certified only. Any country outside the US requires country-specific certification — non-negotiable, cannot be bypassed, carries significant additional cost and timeline.

Country Certification Requirements

Market	Cert Required	Lead Time	Key Notes
United States	UL/FCC (already certified)	No additional time	KIOSK holds UL Listings for 120+ products. Custom builds may need testing.
EU / EEA	CE Marking (mandatory)	4–8 weeks + cost	Legal requirement. Every configuration change may require re-cert.
United Kingdom	UKCA (separate from CE)	4–8 weeks + cost	Post-Brexit — UK has own UKCA separate from CE.
Canada / Australia	IC / RCM	4–8 weeks + cost	Generally aligned with FCC but country-specific submissions.
India	BIS Certification	8–16 weeks + significant cost	Bureau of Indian Standards. Involves local testing lab.
Middle East	SASO / IECEE	6–12 weeks + cost	Country-by-country. Confirm with KIOSK.com for each target market.
Other	Varies	Confirm first	Never include international markets without confirming certification status with KIOSK.com.

Run certification PARALLEL with manufacturing — not after. 20 weeks manufacturing + 8 weeks CE sequential = 28 weeks. 20 weeks manufacturing + 8 weeks CE parallel = 20 weeks. KIOSK ISO17025 accreditation enables parallel testing during design stage.

NEVER commit to hardware pricing without a current KIOSK.com project-specific quote. All quotes valid 15–30 days only. Using ROM figures or historic pricing for client commitments is a contractual risk to the partner.

Risk Area	What It Means	What to Communicate to Customers
Raw Material Volatility	Kiosk pricing tied to commodity costs — steel, aluminium, plastics, electronics. Can shift significantly within weeks.	Quotes valid 15–30 days. Price lock requires signed PO against current KIOSK.com quote.
Semiconductor Shortages	Global chip shortages affect pricing and lead times.	Lead times not guaranteed until order confirmation. Build contingency into every project timeline.
Geopolitical Supply Chain	Tariffs, trade restrictions, sanctions can impact availability and cost. Posiflex manufacturing in Taiwan.	Pricing and availability subject to external market forces.
Build Queue & Lead Times	Standard 3–6 months from order confirmation. Custom builds longer.	Confirm current queue with KIOSK.com before committing any timeline.
Configuration Lock-In	Any change after order = full redesign, re-test, re-certification = major cost and timeline reset.	All peripheral decisions must be validated by AE pre-sales before ordering.

Indicative Project Timeline

Phase	Duration	Key Activities
Discovery & Spec	2–4 weeks	Build spec lock, site survey, AE Solutions Architecture sign-off
Quote & Order	1–2 weeks	KIOSK.com quote, contract, order placement
Manufacturing	8–20 weeks	Production queue, build, factory QA. Custom builds at upper end.
Certification (Intl)	4–12 weeks parallel	CE or country cert — run in parallel with manufacturing.
Shipping & Import	1–6 weeks	US domestic 1–2 weeks. International 4–6 weeks + customs.
Installation	1–5 days	Physical install, power, network, base config.
Acceptance & Go-Live	1–3 days	QA test suite, acceptance sign-off, go-live.

Worst-case planning: US standard 4–6 months. US custom 6–9 months. International worst-case 8–14 months. Stock builds best-case 8–12 weeks. Always plan worst-case first, then work back to best-case for customer expectations.

SLA timer starts at KIOSK.com — not at AE or partner. Partner delays in raising the ticket are NOT credited against KIOSK SLA performance. Software/application issues are escalated to AE under a separate AE MSA SLA.

99.5%

Platform SLA (post 60-day ramp)

30 min

Sev-1 response (from KIOSK receipt)

~60%

False-failure reduction (prev. maint.)

Next Day

Parts shipment (orders before 1pm MT)

60 days

Initial ramp before SLA begins

Severity	Definition	Initial Response	Cadence	Coverage
Sev 1 — Critical	Platform down; 90%+ cannot transact	30 min (extended hrs); 1hr after-hours	Every 2hrs until resolved	24x7x365
Sev 2 — Severe	Critical function impaired; 50%+ cannot transact	2 hours	Every 3hrs (extended support)	6am–6pm MT x7
Sev 3 — Moderate	Non-critical malfunction; minor degradation	End of next business day	Next business day	Business hours
Sev 4 — Low	Minor error; no data loss; small delay	End of 4th business day	Within 4 business days	Business hours

Support Contacts

Tier	Hours	Contact
Standard (HW Support plan)	Mon–Fri 8am–5pm MT	800-509-5471 · customercare@kiosk.com
Extended (Advanced Exchange Warranty)	Mon–Fri 6am–6pm MT + Sev-1 on-call 6pm–10pm · Sat 8am–5pm · Holidays Sev-1 on-call	855-661-2682

Partner FAQ — Straight Answers

Can I do the site survey and installation myself?

Yes — both are completely optional. No impact on warranty or support provided you follow the setup guides. Every Guardian Kiosk goes through full factory QA before dispatch — onsite = unbox → connect → power on → re-run QA → go live. Standard T&C: damage caused through negligent installation is not covered under warranty.

Do I have to purchase Hardware Support and OS Management?

Both are optional. Only skip if you can genuinely replicate in-house: remote fleet monitoring, advanced exchange/spare parts, field tech capacity, fleet reporting (HW Support) AND OS image creation/management, MDM, security suite (OS Mgmt). For the vast majority of partners, purchasing both is the right call.

What are partner obligations for a kiosk deployment?

Licence Entitlement: Ensure correct Guardian managed service licence per kiosk before activation.

Ticketing & SLA: Raise hardware tickets to KIOSK.com promptly — SLA timer starts at KIOSK receipt.

Pre-Sales Scoping: Confirm RFID, PACS compatibility, form factor, certifications before order. Changes after order are expensive.

Consumables: Partner/end user procures and manages all consumables — labels, card stock, ribbons, cleaning kits.

International: Partner arranges IOR, freight forwarder, customs, local VAT, receiving logistics. AE is not the IOR.

PM Services: Include AE PMO in every kiosk quote.

How do I handle pricing with the customer?

Always use current project-specific KIOSK.com quote — valid 15–30 days only. Never use ROM figures or historic pricing for commitments. Confirm rates with your AE Partner Manager before any customer commitment. For AE software, use the current pricebook and CPQ output — never share internal guides with customers.

14. Appendix & Reference

Supporting documents · SRS guides · Contact directory.

Supporting Reference Documents

Document	Purpose	When Needed
Scope of Works Template	Standard SoW for defining project deliverables, assumptions, exclusions	Every deployment
Use Case Library	Pre-built Guardian use cases across all modules	Pre-sales scoping
SLA — Cloud and On-Prem	Service Level Agreement terms for AE Cloud and client-hosted	Customer contract negotiation
Guardian PIAM SRS	Server sizing, OS, DB, HA/DR, security hardening for on-prem PIAM	All on-prem PIAM deployments — mandatory
Guardian VIM SRS	System requirements for on-prem VIM	All on-prem VIM deployments — mandatory
Guardian SOC Insights SRS	On-prem SOC Insights requirements	On-prem SOC deployments
Guardian Mobile Access SRS	On-prem Mobile Access requirements	On-prem Mobile deployments
Guardian ePermit SRS	On-prem ePermit requirements	On-prem ePermit deployments
Guardian VIM Supported Peripherals List	Official validated device list for VIM peripheral compatibility	Any custom kiosk or peripheral scoping
Guardian on ServiceNow Pricebook	All MSRP and cost model details for ServiceNow deployment models	Any SNOW-related opportunity
Kiosk Partner Guide (AEKIOSK-PG001)	Full channel partner reference	Any kiosk hardware opportunity

Always confirm you are working from the latest version of all documents before submitting any commercial proposal. Contact your AE representative or Revenue Operations if in doubt.

Contact Directory

Contact	Details
General & Partner Enquiries	info@alertenterprise.com · www.alertenterprise.com
Pre-sales & Scoping	Contact your AlertEnterprise Partner Manager
KIOSK Standard Support	800-509-5471 · customercare@kiosk.com
KIOSK Extended / Sev-1	855-661-2682
Document Change Requests	Email AE Partner Manager: Subject "[AEKIOSK-PG001] Change Request — [Description]"