diff --git a/src/app/[orgId]/settings/(private)/idp/[idpId]/general/page.tsx b/src/app/[orgId]/settings/(private)/idp/[idpId]/general/page.tsx
index 2bd3ef13..cdbe5f0e 100644
--- a/src/app/[orgId]/settings/(private)/idp/[idpId]/general/page.tsx
+++ b/src/app/[orgId]/settings/(private)/idp/[idpId]/general/page.tsx
@@ -46,7 +46,7 @@ import IdpTypeBadge from "@app/components/IdpTypeBadge";
 import { useTranslations } from "next-intl";
 import { AxiosResponse } from "axios";
 import { ListRolesResponse } from "@server/routers/role";
-import AutoProvisionConfigWidget from "@app/components/private/AutoProvisionConfigWidget";
+import AutoProvisionConfigWidget from "@app/components/AutoProvisionConfigWidget";
 
 export default function GeneralPage() {
     const { env } = useEnvContext();
diff --git a/src/app/[orgId]/settings/(private)/idp/create/page.tsx b/src/app/[orgId]/settings/(private)/idp/create/page.tsx
index 2f248077..6bae6075 100644
--- a/src/app/[orgId]/settings/(private)/idp/create/page.tsx
+++ b/src/app/[orgId]/settings/(private)/idp/create/page.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import AutoProvisionConfigWidget from "@app/components/private/AutoProvisionConfigWidget";
+import AutoProvisionConfigWidget from "@app/components/AutoProvisionConfigWidget";
 import {
     SettingsContainer,
     SettingsSection,
diff --git a/src/app/[orgId]/settings/(private)/idp/page.tsx b/src/app/[orgId]/settings/(private)/idp/page.tsx
index f8d888c0..7ff12d64 100644
--- a/src/app/[orgId]/settings/(private)/idp/page.tsx
+++ b/src/app/[orgId]/settings/(private)/idp/page.tsx
@@ -2,7 +2,7 @@ import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { AxiosResponse } from "axios";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import IdpTable, { IdpRow } from "@app/components/private/OrgIdpTable";
+import IdpTable, { IdpRow } from "@app/components/OrgIdpTable";
 import { getTranslations } from "next-intl/server";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 
diff --git a/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/credentials/page.tsx b/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/credentials/page.tsx
index 2fa2b753..7ee84129 100644
--- a/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/credentials/page.tsx
+++ b/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/credentials/page.tsx
@@ -23,9 +23,6 @@ import {
 } from "@server/routers/remoteExitNode/types";
 import { useRemoteExitNodeContext } from "@app/hooks/useRemoteExitNodeContext";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
-import { build } from "@server/build";
 import {
     InfoSection,
     InfoSectionContent,
@@ -36,6 +33,8 @@ import CopyToClipboard from "@app/components/CopyToClipboard";
 import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
 import { InfoIcon } from "lucide-react";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 export default function CredentialsPage() {
     const { env } = useEnvContext();
@@ -45,6 +44,8 @@ export default function CredentialsPage() {
     const t = useTranslations();
     const { remoteExitNode } = useRemoteExitNodeContext();
 
+    const { isPaidUser } = usePaidStatus();
+
     const [modalOpen, setModalOpen] = useState(false);
     const [credentials, setCredentials] =
         useState<PickRemoteExitNodeDefaultsResponse | null>(null);
@@ -57,16 +58,6 @@ export default function CredentialsPage() {
     const [showCredentialsAlert, setShowCredentialsAlert] = useState(false);
     const [shouldDisconnect, setShouldDisconnect] = useState(true);
 
-    const { licenseStatus, isUnlocked } = useLicenseStatusContext();
-    const subscription = useSubscriptionStatusContext();
-
-    const isSecurityFeatureDisabled = () => {
-        const isEnterpriseNotLicensed = build === "enterprise" && !isUnlocked();
-        const isSaasNotSubscribed =
-            build === "saas" && !subscription?.isSubscribed();
-        return isEnterpriseNotLicensed || isSaasNotSubscribed;
-    };
-
     const handleConfirmRegenerate = async () => {
         try {
             const response = await api.get<
@@ -203,7 +194,7 @@ export default function CredentialsPage() {
                                     setShouldDisconnect(false);
                                     setModalOpen(true);
                                 }}
-                                disabled={isSecurityFeatureDisabled()}
+                                disabled={isPaidUser(tierMatrix.rotateCredentials)}
                             >
                                 {t("regenerateCredentialsButton")}
                             </Button>
@@ -212,7 +203,7 @@ export default function CredentialsPage() {
                                     setShouldDisconnect(true);
                                     setModalOpen(true);
                                 }}
-                                disabled={isSecurityFeatureDisabled()}
+                                disabled={isPaidUser(tierMatrix.rotateCredentials)}
                             >
                                 {t("remoteExitNodeRegenerateAndDisconnect")}
                             </Button>
diff --git a/src/app/[orgId]/settings/access/users/create/page.tsx b/src/app/[orgId]/settings/access/users/create/page.tsx
index 7d8ad2cd..08737f5e 100644
--- a/src/app/[orgId]/settings/access/users/create/page.tsx
+++ b/src/app/[orgId]/settings/access/users/create/page.tsx
@@ -47,7 +47,8 @@ import { ListIdpsResponse } from "@server/routers/idp";
 import { useTranslations } from "next-intl";
 import { build } from "@server/build";
 import Image from "next/image";
-import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 type UserType = "internal" | "oidc";
 
@@ -75,7 +76,7 @@ export default function Page() {
     const api = createApiClient({ env });
     const t = useTranslations();
 
-    const subscription = useSubscriptionStatusContext();
+    const { hasSaasSubscription } = usePaidStatus();
 
     const [selectedOption, setSelectedOption] = useState<string | null>(
         "internal"
@@ -237,7 +238,7 @@ export default function Page() {
         }
 
         async function fetchIdps() {
-            if (build === "saas" && !subscription?.subscribed) {
+            if (build === "saas" && !hasSaasSubscription(tierMatrix.orgOidc)) {
                 return;
             }
 
diff --git a/src/app/[orgId]/settings/clients/machine/[niceId]/credentials/page.tsx b/src/app/[orgId]/settings/clients/machine/[niceId]/credentials/page.tsx
index 024f4cd7..17c958ce 100644
--- a/src/app/[orgId]/settings/clients/machine/[niceId]/credentials/page.tsx
+++ b/src/app/[orgId]/settings/clients/machine/[niceId]/credentials/page.tsx
@@ -19,9 +19,6 @@ import { useTranslations } from "next-intl";
 import { PickClientDefaultsResponse } from "@server/routers/client";
 import { useClientContext } from "@app/hooks/useClientContext";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
-import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
-import { build } from "@server/build";
 import {
     InfoSection,
     InfoSectionContent,
@@ -33,6 +30,8 @@ import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
 import { InfoIcon } from "lucide-react";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { OlmInstallCommands } from "@app/components/olm-install-commands";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 export default function CredentialsPage() {
     const { env } = useEnvContext();
@@ -54,17 +53,7 @@ export default function CredentialsPage() {
     const [showCredentialsAlert, setShowCredentialsAlert] = useState(false);
     const [shouldDisconnect, setShouldDisconnect] = useState(true);
 
-    const { licenseStatus, isUnlocked } = useLicenseStatusContext();
-    const subscription = useSubscriptionStatusContext();
-
-    const isSecurityFeatureDisabled = () => {
-        const isEnterpriseNotLicensed = build === "enterprise" && !isUnlocked();
-        const isSaasNotSubscribed =
-            build === "saas" && !subscription?.isSubscribed();
-        return (
-            isEnterpriseNotLicensed || isSaasNotSubscribed || build === "oss"
-        );
-    };
+    const { isPaidUser } = usePaidStatus();
 
     const handleConfirmRegenerate = async () => {
         try {
@@ -191,7 +180,7 @@ export default function CredentialsPage() {
                                     setShouldDisconnect(false);
                                     setModalOpen(true);
                                 }}
-                                disabled={isSecurityFeatureDisabled()}
+                                disabled={isPaidUser(tierMatrix.rotateCredentials)}
                             >
                                 {t("regenerateCredentialsButton")}
                             </Button>
@@ -200,7 +189,7 @@ export default function CredentialsPage() {
                                     setShouldDisconnect(true);
                                     setModalOpen(true);
                                 }}
-                                disabled={isSecurityFeatureDisabled()}
+                                disabled={isPaidUser(tierMatrix.rotateCredentials)}
                             >
                                 {t("clientRegenerateAndDisconnect")}
                             </Button>
diff --git a/src/app/[orgId]/settings/general/auth-page/page.tsx b/src/app/[orgId]/settings/general/auth-page/page.tsx
index 9ffa8e04..0bd48286 100644
--- a/src/app/[orgId]/settings/general/auth-page/page.tsx
+++ b/src/app/[orgId]/settings/general/auth-page/page.tsx
@@ -1,5 +1,5 @@
 import AuthPageBrandingForm from "@app/components/AuthPageBrandingForm";
-import AuthPageSettings from "@app/components/private/AuthPageSettings";
+import AuthPageSettings from "@app/components/AuthPageSettings";
 import { SettingsContainer } from "@app/components/Settings";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
diff --git a/src/app/[orgId]/settings/logs/access/page.tsx b/src/app/[orgId]/settings/logs/access/page.tsx
index 6da993ba..13f31952 100644
--- a/src/app/[orgId]/settings/logs/access/page.tsx
+++ b/src/app/[orgId]/settings/logs/access/page.tsx
@@ -13,14 +13,13 @@ import { ArrowUpRight, Key, User } from "lucide-react";
 import Link from "next/link";
 import { ColumnFilter } from "@app/components/ColumnFilter";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
 import { build } from "@server/build";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
 import axios from "axios";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 export default function GeneralPage() {
     const router = useRouter();
@@ -28,8 +27,8 @@ export default function GeneralPage() {
     const api = createApiClient(useEnvContext());
     const t = useTranslations();
     const { orgId } = useParams();
-    const subscription = useSubscriptionStatusContext();
-    const { isUnlocked } = useLicenseStatusContext();
+
+    const { isPaidUser } = usePaidStatus();
 
     const [rows, setRows] = useState<any[]>([]);
     const [isRefreshing, setIsRefreshing] = useState(false);
@@ -208,11 +207,7 @@ export default function GeneralPage() {
         }
     ) => {
         console.log("Date range changed:", { startDate, endDate, page, size });
-        if (
-            (build == "saas" && !subscription?.subscribed) ||
-            (build == "enterprise" && !isUnlocked()) ||
-            build === "oss"
-        ) {
+        if (!isPaidUser(tierMatrix.accessLogs) || build === "oss") {
             console.log(
                 "Access denied: subscription inactive or license locked"
             );
@@ -642,11 +637,7 @@ export default function GeneralPage() {
                 // Row expansion props
                 expandable={true}
                 renderExpandedRow={renderExpandedRow}
-                disabled={
-                    (build == "saas" && !subscription?.subscribed) ||
-                    (build == "enterprise" && !isUnlocked()) ||
-                    build === "oss"
-                }
+                disabled={!isPaidUser(tierMatrix.accessLogs) || build === "oss"}
             />
         </>
     );
diff --git a/src/app/[orgId]/settings/logs/action/page.tsx b/src/app/[orgId]/settings/logs/action/page.tsx
index 040a1920..515fd2b9 100644
--- a/src/app/[orgId]/settings/logs/action/page.tsx
+++ b/src/app/[orgId]/settings/logs/action/page.tsx
@@ -4,15 +4,14 @@ import { DateTimeValue } from "@app/components/DateTimePicker";
 import { LogDataTable } from "@app/components/LogDataTable";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
-import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient } from "@app/lib/api";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
 import { build } from "@server/build";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { ColumnDef } from "@tanstack/react-table";
 import axios from "axios";
 import { Key, User } from "lucide-react";
@@ -26,8 +25,8 @@ export default function GeneralPage() {
     const t = useTranslations();
     const { orgId } = useParams();
     const searchParams = useSearchParams();
-    const subscription = useSubscriptionStatusContext();
-    const { isUnlocked } = useLicenseStatusContext();
+
+    const { isPaidUser } = usePaidStatus();
 
     const [rows, setRows] = useState<any[]>([]);
     const [isRefreshing, setIsRefreshing] = useState(false);
@@ -195,10 +194,7 @@ export default function GeneralPage() {
         }
     ) => {
         console.log("Date range changed:", { startDate, endDate, page, size });
-        if (
-            (build == "saas" && !subscription?.subscribed) ||
-            (build == "enterprise" && !isUnlocked())
-        ) {
+        if (!isPaidUser(tierMatrix.actionLogs)) {
             console.log(
                 "Access denied: subscription inactive or license locked"
             );
@@ -496,11 +492,7 @@ export default function GeneralPage() {
                 // Row expansion props
                 expandable={true}
                 renderExpandedRow={renderExpandedRow}
-                disabled={
-                    (build == "saas" && !subscription?.subscribed) ||
-                    (build == "enterprise" && !isUnlocked()) ||
-                    build === "oss"
-                }
+                disabled={!isPaidUser(tierMatrix.actionLogs) || build === "oss"}
             />
         </>
     );
diff --git a/src/app/[orgId]/settings/logs/page.tsx b/src/app/[orgId]/settings/logs/page.tsx
index 45b5a7de..d9663e72 100644
--- a/src/app/[orgId]/settings/logs/page.tsx
+++ b/src/app/[orgId]/settings/logs/page.tsx
@@ -1,54 +1,3 @@
-"use client";
-import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import AuthPageSettings, {
-    AuthPageSettingsRef
-} from "@app/components/private/AuthPageSettings";
-
-import { Button } from "@app/components/ui/button";
-import { useOrgContext } from "@app/hooks/useOrgContext";
-import { userOrgUserContext } from "@app/hooks/useOrgUserContext";
-import { toast } from "@app/hooks/useToast";
-import { useState, useRef } from "react";
-import {
-    Form,
-    FormControl,
-    FormDescription,
-    FormField,
-    FormItem,
-    FormLabel,
-    FormMessage
-} from "@/components/ui/form";
-import { Input } from "@/components/ui/input";
-
-import { z } from "zod";
-import { useForm } from "react-hook-form";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { createApiClient } from "@app/lib/api";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { formatAxiosError } from "@app/lib/api";
-import { AxiosResponse } from "axios";
-import { DeleteOrgResponse, ListUserOrgsResponse } from "@server/routers/org";
-import { useRouter } from "next/navigation";
-import {
-    SettingsContainer,
-    SettingsSection,
-    SettingsSectionHeader,
-    SettingsSectionTitle,
-    SettingsSectionDescription,
-    SettingsSectionBody,
-    SettingsSectionForm,
-    SettingsSectionFooter
-} from "@app/components/Settings";
-import { useUserContext } from "@app/hooks/useUserContext";
-import { useTranslations } from "next-intl";
-import { build } from "@server/build";
-
 export default function GeneralPage() {
-    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
-    const router = useRouter();
-    const api = createApiClient(useEnvContext());
-    const t = useTranslations();
-    const { env } = useEnvContext();
-
-    return <p>dfas</p>;
+    return null;
 }
diff --git a/src/app/[orgId]/settings/resources/proxy/[niceId]/general/page.tsx b/src/app/[orgId]/settings/resources/proxy/[niceId]/general/page.tsx
index 1ed8eb17..303b3c46 100644
--- a/src/app/[orgId]/settings/resources/proxy/[niceId]/general/page.tsx
+++ b/src/app/[orgId]/settings/resources/proxy/[niceId]/general/page.tsx
@@ -50,9 +50,6 @@ import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import z from "zod";
-import { build } from "@server/build";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
-import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { RadioGroup, RadioGroupItem } from "@app/components/ui/radio-group";
 import {
@@ -64,6 +61,7 @@ import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { GetResourceResponse } from "@server/routers/resource/getResource";
 import type { ResourceContextType } from "@app/contexts/resourceContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 type MaintenanceSectionFormProps = {
     resource: GetResourceResponse;
@@ -77,8 +75,6 @@ function MaintenanceSectionForm({
     const { env } = useEnvContext();
     const t = useTranslations();
     const api = createApiClient({ env });
-    const { isUnlocked } = useLicenseStatusContext();
-    const subscription = useSubscriptionStatusContext();
     const { isPaidUser } = usePaidStatus();
 
     const MaintenanceFormSchema = z.object({
@@ -159,15 +155,6 @@ function MaintenanceSectionForm({
         }
     }
 
-    const isSecurityFeatureDisabled = () => {
-        const isEnterpriseNotLicensed = build === "enterprise" && !isUnlocked();
-        const isSaasNotSubscribed =
-            build === "saas" && !subscription?.isSubscribed();
-        return (
-            isEnterpriseNotLicensed || isSaasNotSubscribed || build === "oss"
-        );
-    };
-
     if (!resource.http) {
         return null;
     }
@@ -197,7 +184,7 @@ function MaintenanceSectionForm({
                                 name="maintenanceModeEnabled"
                                 render={({ field }) => {
                                     const isDisabled =
-                                        isSecurityFeatureDisabled() ||
+                                        isPaidUser(tierMatrix.maintencePage) ||
                                         resource.http === false;
 
                                     return (
@@ -264,7 +251,7 @@ function MaintenanceSectionForm({
                                                         defaultValue={
                                                             field.value
                                                         }
-                                                        disabled={isSecurityFeatureDisabled()}
+                                                        disabled={isPaidUser(tierMatrix.maintencePage)}
                                                         className="flex flex-col space-y-1"
                                                     >
                                                         <FormItem className="flex items-start space-x-3 space-y-0">
@@ -337,7 +324,7 @@ function MaintenanceSectionForm({
                                                 <FormControl>
                                                     <Input
                                                         {...field}
-                                                        disabled={isSecurityFeatureDisabled()}
+                                                        disabled={isPaidUser(tierMatrix.maintencePage)}
                                                         placeholder="We'll be back soon!"
                                                     />
                                                 </FormControl>
@@ -363,7 +350,7 @@ function MaintenanceSectionForm({
                                                     <Textarea
                                                         {...field}
                                                         rows={4}
-                                                        disabled={isSecurityFeatureDisabled()}
+                                                        disabled={isPaidUser(tierMatrix.maintencePage)}
                                                         placeholder={t(
                                                             "maintenancePageMessagePlaceholder"
                                                         )}
@@ -392,7 +379,7 @@ function MaintenanceSectionForm({
                                                 <FormControl>
                                                     <Input
                                                         {...field}
-                                                        disabled={isSecurityFeatureDisabled()}
+                                                        disabled={isPaidUser(tierMatrix.maintencePage)}
                                                         placeholder={t(
                                                             "maintenanceTime"
                                                         )}
diff --git a/src/app/[orgId]/settings/sites/[niceId]/credentials/page.tsx b/src/app/[orgId]/settings/sites/[niceId]/credentials/page.tsx
index 7f1eab20..0dbd864e 100644
--- a/src/app/[orgId]/settings/sites/[niceId]/credentials/page.tsx
+++ b/src/app/[orgId]/settings/sites/[niceId]/credentials/page.tsx
@@ -20,9 +20,6 @@ import { PickSiteDefaultsResponse } from "@server/routers/site";
 import { useSiteContext } from "@app/hooks/useSiteContext";
 import { generateKeypair } from "../wireguardConfig";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
-import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
-import { build } from "@server/build";
 import {
     InfoSection,
     InfoSectionContent,
@@ -40,6 +37,8 @@ import {
 import { QRCodeCanvas } from "qrcode.react";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { NewtSiteInstallCommands } from "@app/components/newt-install-commands";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 export default function CredentialsPage() {
     const { env } = useEnvContext();
@@ -65,17 +64,7 @@ export default function CredentialsPage() {
     const [loadingDefaults, setLoadingDefaults] = useState(false);
     const [shouldDisconnect, setShouldDisconnect] = useState(true);
 
-    const { licenseStatus, isUnlocked } = useLicenseStatusContext();
-    const subscription = useSubscriptionStatusContext();
-
-    const isSecurityFeatureDisabled = () => {
-        const isEnterpriseNotLicensed = build === "enterprise" && !isUnlocked();
-        const isSaasNotSubscribed =
-            build === "saas" && !subscription?.isSubscribed();
-        return (
-            isEnterpriseNotLicensed || isSaasNotSubscribed || build === "oss"
-        );
-    };
+    const { isPaidUser } = usePaidStatus();
 
     // Fetch site defaults for wireguard sites to show in obfuscated config
     useEffect(() => {
@@ -279,7 +268,7 @@ export default function CredentialsPage() {
                                             setShouldDisconnect(false);
                                             setModalOpen(true);
                                         }}
-                                        disabled={isSecurityFeatureDisabled()}
+                                        disabled={isPaidUser(tierMatrix.rotateCredentials)}
                                     >
                                         {t("regenerateCredentialsButton")}
                                     </Button>
@@ -288,7 +277,7 @@ export default function CredentialsPage() {
                                             setShouldDisconnect(true);
                                             setModalOpen(true);
                                         }}
-                                        disabled={isSecurityFeatureDisabled()}
+                                        disabled={isPaidUser(tierMatrix.rotateCredentials)}
                                     >
                                         {t("siteRegenerateAndDisconnect")}
                                     </Button>
@@ -389,7 +378,7 @@ export default function CredentialsPage() {
                             <SettingsSectionFooter>
                                 <Button
                                     onClick={() => setModalOpen(true)}
-                                    disabled={isSecurityFeatureDisabled()}
+                                    disabled={isPaidUser(tierMatrix.rotateCredentials)}
                                 >
                                     {t("siteRegenerateAndDisconnect")}
                                 </Button>
diff --git a/src/app/auth/org/page.tsx b/src/app/auth/org/page.tsx
index 8dd9c4a2..81f4af8a 100644
--- a/src/app/auth/org/page.tsx
+++ b/src/app/auth/org/page.tsx
@@ -14,7 +14,7 @@ import {
     LoadLoginPageResponse
 } from "@server/routers/loginPage/types";
 import { GetSessionTransferTokenRenponse } from "@server/routers/auth/types";
-import ValidateSessionTransferToken from "@app/components/private/ValidateSessionTransferToken";
+import ValidateSessionTransferToken from "@app/components/ValidateSessionTransferToken";
 import { isOrgSubscribed } from "@app/lib/api/isOrgSubscribed";
 import { OrgSelectionForm } from "@app/components/OrgSelectionForm";
 import OrgLoginPage from "@app/components/OrgLoginPage";
diff --git a/src/app/layout.tsx b/src/app/layout.tsx
index ed7635e3..0844eb62 100644
--- a/src/app/layout.tsx
+++ b/src/app/layout.tsx
@@ -5,7 +5,7 @@ import { ThemeProvider } from "@app/providers/ThemeProvider";
 import EnvProvider from "@app/providers/EnvProvider";
 import { pullEnv } from "@app/lib/pullEnv";
 import ThemeDataProvider from "@app/providers/ThemeDataProvider";
-import SplashImage from "@app/components/private/SplashImage";
+import SplashImage from "@app/components/SplashImage";
 import SupportStatusProvider from "@app/providers/SupporterStatusProvider";
 import { priv } from "@app/lib/api";
 import { AxiosResponse } from "axios";
diff --git a/src/components/private/AuthPageSettings.tsx b/src/components/AuthPageSettings.tsx
similarity index 94%
rename from src/components/private/AuthPageSettings.tsx
rename to src/components/AuthPageSettings.tsx
index 5d7a4cb2..619a0dfe 100644
--- a/src/components/private/AuthPageSettings.tsx
+++ b/src/components/AuthPageSettings.tsx
@@ -28,7 +28,7 @@ import { ListDomainsResponse } from "@server/routers/domain";
 import { DomainRow } from "@app/components/DomainsTable";
 import { toUnicode } from "punycode";
 import { Globe, Trash2 } from "lucide-react";
-import CertificateStatus from "@app/components/private/CertificateStatus";
+import CertificateStatus from "@app/components/CertificateStatus";
 import {
     Credenza,
     CredenzaBody,
@@ -42,10 +42,10 @@ import {
 import DomainPicker from "@app/components/DomainPicker";
 import { finalizeSubdomainSanitize } from "@app/lib/subdomain-utils";
 import { InfoPopup } from "@app/components/ui/info-popup";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { build } from "@server/build";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
-import { PaidFeaturesAlert } from "../PaidFeaturesAlert";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 // Auth page form schema
 const AuthPageFormSchema = z.object({
@@ -75,7 +75,7 @@ function AuthPageSettings({
     const t = useTranslations();
     const { env } = useEnvContext();
 
-    const { hasSaasSubscription } = usePaidStatus();
+    const { isPaidUser } = usePaidStatus();
 
     // Auth page domain state
     const [loginPage, setLoginPage] = useState(defaultLoginPage);
@@ -177,7 +177,7 @@ function AuthPageSettings({
         try {
             // Handle auth page domain
             if (data.authPageDomainId) {
-                if (build === "enterprise" || hasSaasSubscription) {
+                if (isPaidUser(tierMatrix.loginPageDomain)) {
                     const sanitizedSubdomain = data.authPageSubdomain
                         ? finalizeSubdomainSanitize(data.authPageSubdomain)
                         : "";
@@ -361,7 +361,11 @@ function AuthPageSettings({
                                                 onClick={() =>
                                                     setEditDomainOpen(true)
                                                 }
-                                                disabled={!hasSaasSubscription}
+                                                disabled={
+                                                    !isPaidUser(
+                                                        tierMatrix.loginPageDomain
+                                                    )
+                                                }
                                             >
                                                 {form.watch("authPageDomainId")
                                                     ? t("changeDomain")
@@ -376,7 +380,9 @@ function AuthPageSettings({
                                                         clearAuthPageDomain
                                                     }
                                                     disabled={
-                                                        !hasSaasSubscription
+                                                        !isPaidUser(
+                                                            tierMatrix.loginPageDomain
+                                                        )
                                                     }
                                                 >
                                                     <Trash2 size="14" />
@@ -395,7 +401,9 @@ function AuthPageSettings({
 
                                     {env.flags.usePangolinDns &&
                                         (build === "enterprise" ||
-                                            !hasSaasSubscription) &&
+                                            !isPaidUser(
+                                                tierMatrix.loginPageDomain
+                                            )) &&
                                         loginPage?.domainId &&
                                         loginPage?.fullDomain &&
                                         !hasUnsavedChanges && (
@@ -424,7 +432,7 @@ function AuthPageSettings({
                         disabled={
                             isSubmitting ||
                             !hasUnsavedChanges ||
-                            !hasSaasSubscription
+                            !isPaidUser(tierMatrix.loginPageDomain)
                         }
                     >
                         {t("saveAuthPageDomain")}
@@ -477,7 +485,10 @@ function AuthPageSettings({
                                     handleDomainSelection(selectedDomain);
                                 }
                             }}
-                            disabled={!selectedDomain || !hasSaasSubscription}
+                            disabled={
+                                !selectedDomain ||
+                                !isPaidUser(tierMatrix.loginPageDomain)
+                            }
                         >
                             {t("selectDomain")}
                         </Button>
diff --git a/src/components/private/AutoProvisionConfigWidget.tsx b/src/components/AutoProvisionConfigWidget.tsx
similarity index 100%
rename from src/components/private/AutoProvisionConfigWidget.tsx
rename to src/components/AutoProvisionConfigWidget.tsx
diff --git a/src/components/private/CertificateStatus.tsx b/src/components/CertificateStatus.tsx
similarity index 100%
rename from src/components/private/CertificateStatus.tsx
rename to src/components/CertificateStatus.tsx
diff --git a/src/components/private/IdpLoginButtons.tsx b/src/components/IdpLoginButtons.tsx
similarity index 100%
rename from src/components/private/IdpLoginButtons.tsx
rename to src/components/IdpLoginButtons.tsx
diff --git a/src/components/LoginOrgSelector.tsx b/src/components/LoginOrgSelector.tsx
index 4e9dcd83..8e2627dd 100644
--- a/src/components/LoginOrgSelector.tsx
+++ b/src/components/LoginOrgSelector.tsx
@@ -2,11 +2,9 @@
 
 import { useState } from "react";
 import { Button } from "@app/components/ui/button";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { Separator } from "./ui/separator";
 import LoginPasswordForm from "./LoginPasswordForm";
-import IdpLoginButtons from "./private/IdpLoginButtons";
+import IdpLoginButtons from "./IdpLoginButtons";
 import { LookupUserResponse } from "@server/routers/auth/lookupUser";
 import UserProfileCard from "./UserProfileCard";
 
diff --git a/src/components/private/OrgIdpDataTable.tsx b/src/components/OrgIdpDataTable.tsx
similarity index 100%
rename from src/components/private/OrgIdpDataTable.tsx
rename to src/components/OrgIdpDataTable.tsx
diff --git a/src/components/private/OrgIdpTable.tsx b/src/components/OrgIdpTable.tsx
similarity index 99%
rename from src/components/private/OrgIdpTable.tsx
rename to src/components/OrgIdpTable.tsx
index 387fd3c7..8f53f484 100644
--- a/src/components/private/OrgIdpTable.tsx
+++ b/src/components/OrgIdpTable.tsx
@@ -2,7 +2,7 @@
 
 import { ColumnDef } from "@tanstack/react-table";
 import { ExtendedColumnDef } from "@app/components/ui/data-table";
-import { IdpDataTable } from "@app/components/private/OrgIdpDataTable";
+import { IdpDataTable } from "@app/components/OrgIdpDataTable";
 import { Button } from "@app/components/ui/button";
 import { ArrowRight, ArrowUpDown, MoreHorizontal } from "lucide-react";
 import { useState } from "react";
diff --git a/src/components/OrgLoginPage.tsx b/src/components/OrgLoginPage.tsx
index f2a8ae2a..26cc2381 100644
--- a/src/components/OrgLoginPage.tsx
+++ b/src/components/OrgLoginPage.tsx
@@ -3,7 +3,7 @@ import {
     LoadLoginPageBrandingResponse,
     LoadLoginPageResponse
 } from "@server/routers/loginPage/types";
-import IdpLoginButtons from "@app/components/private/IdpLoginButtons";
+import IdpLoginButtons from "@app/components/IdpLoginButtons";
 import {
     Card,
     CardContent,
diff --git a/src/components/private/RegionSelector.tsx b/src/components/RegionSelector.tsx
similarity index 100%
rename from src/components/private/RegionSelector.tsx
rename to src/components/RegionSelector.tsx
diff --git a/src/components/ResourceInfoBox.tsx b/src/components/ResourceInfoBox.tsx
index 187edb5b..36a507ea 100644
--- a/src/components/ResourceInfoBox.tsx
+++ b/src/components/ResourceInfoBox.tsx
@@ -11,7 +11,7 @@ import {
     InfoSectionTitle
 } from "@app/components/InfoSection";
 import { useTranslations } from "next-intl";
-import CertificateStatus from "@app/components/private/CertificateStatus";
+import CertificateStatus from "@app/components/CertificateStatus";
 import { toUnicode } from "punycode";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 
diff --git a/src/components/private/SplashImage.tsx b/src/components/SplashImage.tsx
similarity index 100%
rename from src/components/private/SplashImage.tsx
rename to src/components/SplashImage.tsx
diff --git a/src/components/private/ValidateSessionTransferToken.tsx b/src/components/ValidateSessionTransferToken.tsx
similarity index 100%
rename from src/components/private/ValidateSessionTransferToken.tsx
rename to src/components/ValidateSessionTransferToken.tsx
diff --git a/src/hooks/usePaidStatus.ts b/src/hooks/usePaidStatus.ts
index 41244a07..5d5fec2e 100644
--- a/src/hooks/usePaidStatus.ts
+++ b/src/hooks/usePaidStatus.ts
@@ -10,22 +10,23 @@ export function usePaidStatus() {
     // Check if features are disabled due to licensing/subscription
     const hasEnterpriseLicense = build === "enterprise" && isUnlocked();
     const tierData = subscription?.getTier();
-    const hasSaasSubscription = build === "saas" && tierData?.active;
+
+    function hasSaasSubscription(tiers: Tier[]): boolean {
+        return (
+            (build === "saas" &&
+                tierData?.active &&
+                tierData?.tier &&
+                tiers.includes(tierData.tier)) ||
+            false
+        );
+    }
 
     function isPaidUser(tiers: Tier[]): boolean {
         if (hasEnterpriseLicense) {
             return true;
         }
 
-        if (
-            hasSaasSubscription &&
-            tierData?.tier &&
-            tiers.includes(tierData.tier)
-        ) {
-            return true;
-        }
-
-        return false;
+        return hasSaasSubscription(tiers);
     }
 
     return {