Discovered my biggest customer has been sharing their login with 14 people at their company. Do I say something?
My product has per-seat pricing. $29/user/month. My biggest customer pays for 3 seats. $87/month. They've been with me for 11 months. Great relationship. Use the product heavily. Yesterday I was checking usage analytics and noticed something weird. Their account had usage from 14 distinct IP addresses in the last month. Different cities. Usage patterns that don't make sense for 3 people. They're sharing one login across their whole team. By my pricing, they should be paying for 14 seats. $406/month. They're paying $87. That's $319/month I'm losing. $3,828/year from a single customer. But here's my dilemma: They're my biggest customer by usage. They genuinely love the product. They've referred 2 other companies to me. If I enforce the seat policy, they might churn entirely. I'd lose $87/month plus their goodwill plus future referrals. If I don't enforce it, I'm subsidizing a customer who's technically violating terms. And if other customers find out, why would they pay full price? Options I'm considering: Say nothing and hope they eventually upgrade voluntarily. (Unlikely but avoids conflict.) Reach out diplomatically. "Hey noticed some unusual login patterns, want to make sure security is good. Also here's a team plan that might fit better." Give them a path to compliance. Enforce strictly. "Our records show X users, please upgrade or we'll need to restrict to licensed seats." Might lose them entirely. Grandfather them at current rate but lock it in. "Your price stays the same but we're implementing device verification going forward." I genuinely don't know the right move here. The money matters but the relationship also matters. How would you handle this?