Plans and security

#Billing model

The billing unit is the workspace, and there is no account or organisation layer sitting above workspaces. Your plan, your monthly credit and every capacity limit in the table below belong to that one workspace. Payments are handled with Stripe (checkout flow and customer portal).

When you open a new workspace, a step appears after it is created so you can choose its plan. You can skip that step and carry on with the Free plan, and you can upgrade whenever you want to.

You can have more than one workspace, and each carries its own plan and its own credit. Credit spent in one does not affect another, and each is billed separately. Moving one workspace to the Team plan does not upgrade the others. Opening a new workspace does not use up an allowance from your current plan either, because the new one starts on the Free plan and you can upgrade it separately if you want to.

The basic principle is "capacity is limited, features are open." The feature difference between plans is almost nil, so on every plan you can use nearly everything. What changes are the numeric capacities, meaning spaces, seats, connectors, triggers and storage. The single exception is SSO (Enterprise).

There are two routes for LLM usage. If you add no key at all, agents run from Orbi's shared pool (Gemini), which needs nothing set up and comes out of your credit. If you add your own API key (Settings → API Keys), the cost is billed directly to your own provider account and the same work spends far less credit. Your own key always takes priority.

#Credit

Usage is measured in monthly credit tied to your plan. The period is your subscription's billing period, so credit renews on your payment day each month rather than on the first of the month. On the free plan the period runs from the day you created the workspace. The date range your remaining credit covers is written on the Settings → Plan page. When you run from the shared pool (with no key), the real model cost plus a service share is deducted as credit. When you run with your own key, it is not the full cost that is deducted but only a small platform share, so the same credit package lasts many times longer. Web searches also come out of credit, because search runs through Orbi's central infrastructure.

Quota behaviour holds no surprises.

• Work in progress is never cut off half-way. Because of that a job can overrun the last credits of your quota. The overrun is deducted once from the next period's quota and settled there. If the overrun is larger than that quota too, the rest carries to the period after it and is settled there, so the debt does not pile up, it wears off period by period.
• When credit runs out, only new runs stop starting. Cards stop with an explanatory error, scheduled work is skipped until credit renews, and chat says so plainly.
• Early notices at 75% and 90%, and a "ceiling reached" notification at 100%, go to Admins (each threshold once a month).
• You watch the remaining credit on the meter under Settings → Plan.

If credit runs out there are four ways forward. You can move up a plan, buy a credit pack (from the button on the Settings → Plan page, where the pack is added to your balance right away), wait for the new period to start, or connect your own API key and carry on spending credit far more slowly. Only the plan's included quota resets at the end of a period, because purchased credits never expire and whatever you do not use carries over to the next periods.

If you want the work never to stop, you can turn on automatic top-up (Settings → Plan). It is off by default, and when you turn it on you set three things. You choose the threshold the remaining credit has to fall below, how many credits are bought each time, and the maximum number of charges in a period. That last number is the seatbelt, because a charge does not go on forever during an unexpectedly busy stretch. Every charge is reported to you, and if a charge is declined the setting stays on but the system goes back to stopping and telling you, and it asks you to update your payment method.

Automatic top-up has two more guards against an unexpected amount. You can also set how much money may be spent in a single period, because the number of charges alone does not cap spending and a price change makes the same number of charges cost more. And the amount you agreed to is recorded when you save the setting. If the credit pack price later goes up, automatic top-up stops on its own and asks you to approve the new amount. A price drop stops nothing, and you simply pay less.

#Plan limits

Every row in the table applies to one workspace.

Feature (per workspace)	Free	Starter	Team	Enterprise
Monthly price	Free	$29	$99	Talk to us
Monthly credits	300	1,500	6,000	Custom
Spaces (besides Genel)	0	3	Unlimited	Unlimited
Seats (people + agents)	3	6	25	Unlimited
Workspace-wide connection (connector/MCP)	1	3	Unlimited	Unlimited
Active flows/triggers	2	5	Unlimited	Unlimited
Policies (automatic rules)	1	3	Unlimited	Unlimited
Agents running at the same time	1	3	10	30
File storage	1 GB	10 GB	50 GB	Unlimited
Personal MCP connection	✅	✅	✅	✅
Collection → app screen	Unlimited	Unlimited	Unlimited	Unlimited
Creating your own agents	✅	✅	✅	✅
Orbi Proactive mode (morning briefing, reminders, weekly plan)	❌	❌	✅	✅
SSO	❌	❌	❌	✅

Spaces split the workspace into lines of work (Spaces). Genel exists on every plan and is not counted, so on Free you work in Genel only. Boards and channels are unlimited.

What a seat means. People and AI are not counted separately. Creating an agent also spends a seat, because an agent is a team member that takes on work and writes comments on the board (Agents). Orbi's own orchestrator does not count, because it is part of the system rather than part of your headcount. You can fill Free's three seats with one person and two agents, or with three people.

Active flows/triggers is the total of flows that are not paused plus active incoming triggers. What you have paused does not count towards the limit, so you can pause an old one and set up a new one.

Agents running at the same time works like this. If you queue more cards at once than your plan allows, none of them is cancelled. The extras wait their turn and start in order as the runs ahead of them finish. While a card waits its state says "queued" and you do not have to do anything. If you want more work running at the same time, upgrading the plan is the only way.

Request rate has a ceiling too. There is a limit on how many requests each member can send per minute, and that ceiling rises with the plan. The ceiling is per member rather than per office, so colleagues sharing the same internet connection do not eat into each other's allowance. Operations that run AI (queueing a card, chat, starting a flow) and file uploads are counted separately, because they cost more than an ordinary save. If you go over the ceiling the request is refused briefly, and trying again a few seconds later is enough.

On-premise deployment does not appear in the table, because it is a separate service that can be added to any plan and is arranged with the sales team, described below. One person can open at most one free workspace. Workspaces you join by invitation do not count, and moving your workspace to a paid plan frees you to open a free one again. Each workspace you open comes with its own plan. If a paid workspace goes back to free while you already have a free one, the returning workspace stops receiving its monthly free credits. It keeps working, and credits you purchased stay valid. More in Roles and invites.

Monthly or yearly? There is a switch above the plan cards on the Settings → Plan page. Paying yearly costs ten months' worth, so two months are free, and the cards show both the yearly amount and what it works out to per month. Your monthly credit renews monthly either way, because paying yearly does not hand you a year's credit at once, since credit is a monthly entitlement. Renewal follows your interval too, so a yearly subscription renews once a year for the yearly amount, and the line on the Plan page says so. Prices include VAT. The amount you see on screen is the amount you pay and no tax is added on top. The invoice shows the net amount and the VAT separately.

There are two currencies. Customers paying from Turkey use Turkish lira, customers paying from abroad use US dollars. You pick the currency above the plan cards, and the default follows your interface language. While a subscription is running its currency does not change, because every renewal stays in the currency you started with, which is why the picker is hidden for the duration. If you cancel your subscription, you can pick the currency again when you subscribe anew.

If a plan card says the plan is not on sale in the currency you picked, that plan has no price in that currency. You can pick another currency or get in touch with us.

Discount codes. If you have a discount code, type it above the plan cards on the Settings → Plan page and press Apply. If the code is valid, the cards show the discounted amount and the purchase is made at that price. Some codes are valid only on certain plans, and with such a code the discounted amount appears only on those plans' cards. If you switch between monthly and yearly, the discount is recalculated for the interval you picked. There are two kinds of code, and which one you have is written next to it. Some apply to the first payment only, while others apply to every renewal for as long as your subscription lasts. A code can be used only once per workspace.

Moving to a cheaper plan. A move to a lower plan takes effect at the end of your period rather than straight away. You keep what you paid for until then, and on that day you move to the new plan and are charged its price. Nothing is charged when you make the change. The scheduled change is shown on the Plan page, where it names the plan and the billing frequency you are moving to, and you can cancel it any time before it happens. Moving up does not wait, because an upgrade applies immediately, and if a scheduled change is waiting at that moment it is dropped, since your latest decision is the one that counts. Cancelling your subscription clears it too.

Changing how often you are billed. Switching between monthly and yearly is not a plan change. Your plan stays the same and only the billing frequency changes. Pick the tab you want on the Plan page and use the button on your current plan's card. The change takes effect at the end of your period and nothing is charged at that moment. You keep the period you paid for, and the new frequency starts at your next renewal.

Plan changes, upgrades, downgrades and cancellation are handled from the Settings → Plan page. When you cancel, your subscription keeps running until the end of the period, and once it ends you drop to the Free plan while your data is not deleted. When money is refunded is set out in the Refund and cancellation policy, and the terms of sale in the Distance selling agreement. Before buying a plan or extra credits you need to read both and tick the consent box, because the purchase buttons stay disabled until you do.

So that you lose nothing without warning, admins are told in advance in two cases. They are told when a subscription has been cancelled and will not renew, and when a payment could not be taken. Seven days before the end of the period, an in-app notification and an email go out, and a band appears on the Settings › Plan page. When a payment fails, the plan is not downgraded straight away. Your access continues for another seven days, and if you update the payment method within that time there is no interruption. During those seven days the payment is retried once a day on its own, so you do not need to do anything else after fixing your card. If you would rather not wait, the link in the band takes you straight to your payment method.

A payment disputed through your bank follows a different path. The moment a dispute is opened we change nothing. Your plan and your credit stay as they are, the payment simply shows as "disputed" in your history and admins are told. If the dispute is resolved in your favour, the payment becomes valid again. If the money goes back to the card, credits from a purchased pack are deducted from your balance, and if it was a subscription payment the plan drops to Free immediately. The seven days above do not apply here, because there is no payment problem to fix. Your data is not deleted in any case. If you think something is wrong, writing to us before opening a dispute is the fastest route.

#On-premise installation

Teams whose data has to stay inside the boundaries of the organisation can run Orbi on their own infrastructure. This is not a reduced version. It uses the same container images as the cloud installation, and new versions arrive through the same flow.

Where the data sits. Tasks, collections, files and chats live in your database and your object store (S3 compatible). The only traffic that leaves is the inference request going to the model provider you chose, and connecting a model inside the organisation removes that too.

Choice of model is yours. You use your own API key. The provider can be chosen separately at the workspace, the agent and the individual task level (see Models).

Identity. SSO (SAML / OIDC) connects it to your existing user directory and no separate password management is needed. Roles and workspace isolation work by exactly the same rules as in the cloud installation (see Roles and invites).

Note. On-premise installation is not a row in the plan table. It is a separate service that can be added to any plan and is arranged with the sales team. Installation and version upgrades are planned as part of the agreement.

#Security and privacy

#Tenant isolation

Every workspace's data stays inside it. A member of one workspace cannot see the task, file or record of a workspace they do not belong to, not even if they know its identifier. Access is enforced by role at every server endpoint.

#Identity and sessions

• Passwords are protected with bcrypt.
• Session tokens are stored hashed in the database.
• Every device is a separate session and you can end any one of them.
• A password reset closes every session.

#Encryption

• LLM API keys are stored encrypted with AES-256-GCM.
• Outgoing webhooks are signed with HMAC, so your endpoint can verify that the request really came from Orbi.

#Agents' access to the outside world

• Internal network protection (SSRF). Web tools cannot be pointed at the internal network, localhost or cloud metadata addresses. The check is made after the address is resolved.
• Separation of external content. Content arriving from outside, whether a web page, a file or the body of an incoming trigger, is labelled and presented to the agent as data. What the agent does is always determined by the job description you gave it, and external content does not take the place of that description.

#Autonomy limits

No approval is asked during execution, but every task has a system-wide budget ceiling (a maximum number of cycles and agent runs). The ceiling settles up front how far the cost can go, and the agent cannot see this limit, because if it knew, it would tend to cut quality and rush the work.

#Data retention

• Deleted files wait 30 days in the trash, then are deleted permanently.
• Deleted workspaces follow the same 30-day rule. Admins can restore them during that time, after which all the data is deleted permanently. Deleting an account anonymises your personal data. Details: Roles and invites.
• Payment records are the one exception. Even after a workspace is permanently deleted, the record of the payments made and of which plan applied when is kept. Financial records have a statutory retention period, and a payment dispute is answered from exactly these rows. They hold what was paid rather than who paid it, meaning the amount, the date and the plan. The detailed breakdown of your credit spending is not a financial record and is deleted with the rest of the data.
• Checklist steps are never deleted. A failed one is marked as an error, and the audit trail is preserved.
• The content of an artifact's last 10 versions is kept, and for older ones the record and the history remain.
• LLM models that leave the catalogue are not deleted but marked inactive, so your existing agent definitions are not broken.

#How long past records are kept

Your tasks, files, collections and agent definitions stay until you delete them. The past records the system keeps in the background do have a retention period, and once it runs out those records are cleaned up automatically.

Record	Period
Read notifications	90 days
Notifications (including unread ones)	1 year
A card's run history (what the agent did, step by step)	180 days
Lines inside a run in the Activity list	180 days
Runs and stand-alone actions in the Activity list	400 days
Usage and spending records	13 months
Admin activity log (who changed what)	13 months

In day-to-day use the only difference you will notice is this. The Trail tab on a card older than 180 days becomes empty. The card itself, its description, its checklist, its comments and its last summary stay where they are.

If you run your own installation, all of these periods can be configured, and your administrator can also leave any record to be kept indefinitely.

#Compliance

With SOC 2 and ISO 27001 as the goal, the audit log, encryption, secret management and tenant isolation were built into the architecture from the very beginning. Certification is on our roadmap and it has not been obtained yet.