Plans and limits
Every limit and feature flag, and which tier unlocks it.
Tiers
| Free | Pro | Team | Enterprise | |
|---|---|---|---|---|
Price | $0 | $12/mo | $49/mo | Custom |
Workspaces you may own | 1 | Unlimited | Unlimited | Unlimited |
Seats | 1 | 1 | 5 included | Unlimited |
Projects | 3 | Unlimited | Unlimited | Unlimited |
Infrastructure resources | 25 | Unlimited | Unlimited | Unlimited |
Runbooks | 10 | Unlimited | Unlimited | Unlimited |
Secrets | Unlimited | Unlimited | Unlimited | Unlimited |
Features by tier
Every plan
| Feature | Category |
|---|---|
End-to-end encryption | Security |
Multi-factor authentication | Security |
Device management | Security |
CLI runbook execution | Runbooks |
Search | Productivity |
Pro and above
| Feature | Category |
|---|---|
Credential and runbook version history | History |
Restore previous versions | History |
Advanced search and filters | Productivity |
Resource favorites | Productivity |
Custom tags | Productivity |
Bulk actions, import and export | Productivity |
Offline metadata cache | Productivity |
Automatic backups | Backup |
Team and above
| Feature | Category |
|---|---|
Team members and invitations | Team |
Shared resources, profiles, and secrets | Team |
Role-based access control | Team |
Access requests and approval workflows | Security |
Audit logs and access history | Audit |
Access and expiry notifications | Team |
Organization and security policies | Policies |
Enterprise
These are not yet built. They appear in the product marked as coming soon, and are listed here so nobody plans around something that does not exist.
| Feature | Status |
|---|---|
SAML SSO | Coming soon |
OIDC | Coming soon |
SCIM provisioning | Coming soon |
LDAP | Coming soon |
Self-hosting and air-gapped deploys | Coming soon |
Compliance reports and audit export | Coming soon |
Just-in-time access | Coming soon |
IP restrictions | Coming soon |
Session recording | Coming soon |
Dynamic credentials | Coming soon |
Limit keys
A 402 PLAN_LIMIT_REACHED response names the limit it hit in limit_key.
| Key | Counts |
|---|---|
| Workspaces you own. Memberships elsewhere do not count. |
| Accepted memberships of this workspace. Pending invitations do not count until accepted. |
| Projects in this workspace. |
| SSH targets, database targets, AWS profiles, and Kubernetes contexts. Profiles are free. |
| Runbooks in this workspace. |
How limits are enforced
Limits are checked by middleware at the route, so an endpoint cannot forget one. A blocked action returns 402 with the current plan, the required plan, and the limit that was hit - enough for the interface to explain it without guessing.
Feature gates behave the same way, returning 402 FEATURE_NOT_IN_PLAN with the feature and the tier that unlocks it. Features marked coming soon are shown in the product but never enforced, since there is nothing behind them yet.
The canonical definition lives in config/plans.php. The entitlement service, the middleware, the shared interface props, and the pricing page all read from it, so limits are never hardcoded anywhere else - including in this table, which is transcribed from it and should be checked against it if the two ever disagree.
Something here wrong or missing? Tell us.