# Advanced Security Add-on Billing The Advanced Security add-on is billed as a percentage increase to your organization’s pre-support Confluent Cloud charges. Eligible charges include all Confluent Cloud usage across all products, such as Apache Kafka®, Connect, and Flink. The only exclusions are Support and Gateway add-on charges. In the Confluent Cloud billing UI and on invoices, Advanced Security add-on charges appear as a distinct non-cluster-specific charge rather than as a per-cluster line item. For pricing details, see [Confluent Cloud pricing](https://www.confluent.io/pricing/). ## Migration for existing users If your organization was already using BYOK or higher IAM limits before the Advanced Security add-on was available, you can continue to use these features with these conditions: - If your organization already uses higher IAM limits, you keep those limits permanently. - If your organization already uses BYOK, you continue to have access to BYOK through March 15, 2027, or until the end of your commit term, whichever is later. See your email for your applicable date. After your applicable date, you need to enable the Advanced Security add-on or clear out your BYOK usage by deleting all resources with self-managed encryption and all your encryption keys. For availability questions or interest in security capabilities, contact Confluent Support or your Confluent account team. ## Related content - [Advanced Security add-on](../../security/advanced-security.md#advanced-security-add-on) - [FAQ for Confluent Cloud Billing](../billing-faq.md#billing-faq)