Plans & limits
Four plans: Free, Standard, Pro and MSP. This page is the technical matrix - what each one allows and what happens when you reach a limit. Prices and the commercial comparison are on the pricing page.
Capacity
| Free | Standard | Pro | MSP | |
|---|---|---|---|---|
| Certificates | 1 | 150 | 1,500 | 150 |
| Agents | 1 | 75 | 1,000 | 75 |
| Domains | 1 | 5 | 25 | 5 |
| Customer workspaces | - | - | - | 5 included, more on demand |
MSP's own numbers are Standard's. They govern the MSP organization's own workspace; each customer workspace runs on the tier of the slot assigned to it and gets that tier's numbers.
Capabilities
| Free | Standard | Pro | MSP | |
|---|---|---|---|---|
| Certificate authorities | Let's Encrypt only | Any, including your own internal or private CA | Any | Any |
| Deploy targets | Windows Certificate Store, Linux NGINX / Apache / Custom | All | All | All |
| IIS bindings | No | Yes | Yes | Yes |
| Exportable private keys | No | Yes | Yes | Yes |
| Agent groups | No | Yes | Yes | Yes |
| Certificate policies | No | Yes | Yes | Yes |
| Key types | EC-256 only | EC-256, EC-384, RSA-2048, RSA-4096 | All | All |
| DNS providers | All 186 | All 186 | All 186 | All 186 |
| Roles, MFA, passkeys, SSO | All plans |
Timing and retention
| Free | Standard | Pro | MSP | |
|---|---|---|---|---|
| Idle check-in interval | 30 min, fixed | 30-60 min, configurable | 1-60 min, configurable | 30-60 min, configurable |
| Event log retention | 7 days | 30 days | 90 days | 90 days |
| Agent local log retention | 7 days, fixed | Up to 30 days | Up to 90 days | Up to 30 days |
The idle interval is only the idle one. Whenever a job or an update is queued, the control plane shortens any agent's next check-in to roughly 10 seconds regardless of plan, so issuance is never held up by the cadence.
What happens at a limit
Limits are enforced by the server, not just by the interface, so a request that would exceed one is refused whatever sent it.
| Limit reached | What happens |
|---|---|
| Certificate, agent or domain count | Creating the next one is refused with a message naming the limit. Existing objects are untouched and keep renewing. |
| A capability you do not have | The control is visible but disabled, with an upgrade hint. Plan-restricted controls are never hidden, so you can always see what a plan would add. |
| A check-in interval outside your range | Rejected on save, with the allowed range in the message. |
| A log retention value above your cap | Rejected on save. A stored value that exceeds a newly lowered cap is clamped at read time instead, so a downgrade takes effect immediately without editing anything. |
Changing plan
Upgrading applies immediately to your existing organization. Agents, domains and certificates carry over; nothing is re-created, and no agent needs reinstalling.
Downgrading does not delete anything. What exceeds the new plan's limits keeps working and keeps renewing; you simply cannot create more until you are back under. The capability restrictions, though, do apply from the moment the plan changes:
- A deploy target the lower plan does not allow will fail validation on the next edit or reissue of the certificate that uses it.
- Configurable values above the new cap are clamped rather than rejected - see log retention above.
The one thing to plan for is Free, which allows only Let's Encrypt and EC-256. A certificate on another authority or key type will not reissue on Free.
Reading the limits in the product
Two places show them:
- Settings > Organization > Billing shows your current plan and usage against each limit.
- Each form disables what your plan does not allow, with the reason.