Plans and billing | Cefense docs

Cefense bills per organization. One plan covers one organization: the repositories connected to it, the people in it, and the allowance every scan it runs spends.

One plan, one organization

The organization is the tenant, the payer, and the meter, the same way Vercel bills per team and GitHub bills per organization. A plan never grants anything to a sibling organization, so an account can hold a paid organization and a free one at the same time and each is metered on its own. That is the model working rather than something to report.

The four plans

Plan	A month	A year	Shared AI allowance	Seats	Repositories	Max depth
Free	$0	$0	5,000,000 model tokens once	2	2	Not included
Plus	$100	$1,080	12,000,000 model tokens per month	5	10	Not included
Pro	$200	$2,160	28,000,000 model tokens per month	10	Unlimited	Unlimited
Max	$400	$4,320	65,000,000 model tokens per month	25	Unlimited	Unlimited

Yearly billing is 10 percent off the monthly rate and changes nothing else: the same allowance, the same seats, the same repositories. The allowance still arrives every month on a yearly plan rather than as one pool for the whole year.

The allowance is what a scan spends, and in practice it is the limit that binds first. Usage and limits is that half of the picture.

What each plan turns on

Capability	Free	Plus	Pro	Max
Scan when you ask	Yes	Yes	Yes	Yes
Scan on every push to the default branch	No	Yes	Yes	Yes
Scan on a schedule	No	Yes	Yes	Yes
Shortest scan interval	n/a	`24h`	`6h`	`1h`
Max scan depth	No	No	Unlimited	Unlimited
Container image scanning	No	No	Yes	Yes
Immunity Watch	No	No	No	Yes
Hyper immunity tests in the sandbox	No	No	No	Yes

Findings, research, patches, proofs, pull requests, the commit history, the audit log, SBOM export, the CLI, and the agent interface are on every plan including Free. What the paid plans buy is scale and automation: more repositories, more scanning, scans you did not have to ask for, and the images you ship as well as the source they were built from. See Scan triggers, Scan depth, and Container images.

Free is a tier, not a trial

Because the grant is one-time, a free organization's meter is measured across the whole life of the organization rather than per month, which is why it does not reset when a new month starts. Creating an organization costs nothing and asks for no card.

Seats

Every plan includes seats: 2 on Free, 5 on Plus, 10 on Pro, 25 on Max. Beyond those, a paid organization can buy seats at $10 a month or $108 a year each, and every extra seat adds capacity to the organization's shared pool. Seats add to the pool rather than carving it up, so nobody has a personal budget to run out of.

Starting or changing a plan

1
Open Plan and usage
In the workspace it is in the account menu. From the terminal it is cf plan, which any role can read.
```
cf plan
```
2
Choose a plan and an interval
An organization that has never subscribed starts one through checkout, from the workspace or with cf plan upgrade.
3
Complete the payment
A person has to open the checkout page and pay. Nothing about the plan changes until that payment clears.
```
cf plan upgrade pro --yearly --seats 3
```

--seats counts seats beyond the ones the plan already includes, so --seats 0 is the plan on its own. Neither cf plan upgrade nor cf plan portal buys anything: each prints a URL for a person to open, which is also why neither is something a coding agent can finish on its own. Run cf plan afterwards to confirm the plan changed rather than assuming it did.

Invoices, payment method, and cancelling

The billing portalbash

cf plan portal

Invoices, the payment method, seat changes, and cancellation all live in the billing portal. An organization that has never subscribed has no billing account to open and says so with no_subscription.

A subscription the card is failing on is not cut off immediately. It keeps the plan while the payment is retried, because losing a customer's scanning over a card that expired is worse than the invoice is worth.

What cancelling does

A cancelled subscription drops the organization to the free tier's limits at the end of the period it has already paid for. Nothing is deleted: the repositories, findings, patches, and history stay where they are. What stops is scanning, because the free grant is one-time and an organization that has been paying spent it long ago.

Who can change what

Action	`owner`	`admin`	`member`
Read the plan, the allowance, and what is left of it	Yes	Yes	Yes
Start a checkout, or change the plan	Yes	Yes	No
Add or remove seats	Yes	Yes	No
Open the billing portal	Yes	Yes	No

A member who tries one of the last three gets billing_forbidden. Reading is open to everyone on purpose: a spent allowance stops everyone's scans, so everyone should be able to see it coming.

What is never billed

There is no overage. Nothing is charged past the plan and its seats, and there is no way to pay to scan beyond the allowance.
A refused scan costs nothing. Once the allowance is spent, scans stop rather than running and billing.
Free never asks for a card. Creating an organization and spending its grant do not need one.

Usage and limitsThe allowance, the repository limit, and what happens at each one.Organizations and rolesWho a plan covers, and who is allowed to change it.Scan depthWhich plans include max depth, and what it is for.

Have a correction or need help?

Email the docs team