Editions and prices¶
Tinfirm comes in three editions: Community, Pro and Enterprise. They are one product in one container image. Without a licence key, an instance runs as Community. A key unlocks Pro or Enterprise at once, with no reinstall and no downtime. An instance admin enters it: Enter and renew a licence key says how.
No edition limits what your agents do. Sandboxes, agents, triggers and runs are unlimited in all three, and every run is still yours to pay for at your model provider. Pro limits only the number of seats.
What each edition includes¶
Everything is recorded in the audit log in every edition. Proving it to an auditor, with filters, an export and the chain's verification, is paid.
| Community | Pro | Enterprise | |
|---|---|---|---|
| Agents, runtimes, skills, memory, conversations, steering, inbox, questions, approvals, outputs, retries | |||
| Every system and trigger: Jira Data Center and Cloud, GitHub, GitLab, git hosts, MCP servers, Slack, Teams, webhooks, schedules | |||
| The MCP endpoint for people's AI clients, personal access tokens | |||
| The Outlook add-in | – | ||
| tinfirm-lore | – | ||
| Model access: LiteLLM, per-person budgets, spend views and alerts, the company's key, the model port | |||
| Safety: sandboxes, the outbound guard, kill switches, suspension | |||
| Groups, service accounts, credentials lent to them | |||
| Local sign-in, OIDC | |||
| SAML and SCIM (both planned) | – | – | |
| The audit recorded, hash-chained | |||
| The audit shown in the app | the last 90 days | all | all |
| The audit's filters, export, chain verification and daily checks | – | ||
| The audit streamed to a SIEM (planned) | – | – | |
| Erasure of a person's content | |||
| Retention | everything kept | the Owner's periods | the Owner's periods |
| Legal holds | – | – | |
| Several companies in one instance | – | – | |
| High availability (planned) | – | – | |
| Air-gapped installation: an offline bundle of every image and update, with the runner images prebuilt (planned) | – | – | |
| Seats | unlimited | 5 to 150, as licensed | as the contract says |
Erasure stays free, so that no company pays to meet the GDPR. Budgets and kill switches stay free, because nobody should pay to stop an agent.
Each paid feature is checked by the server. When an edition does not include a feature, the app hides it, and the API answers 403 EDITION_REQUIRED.
Prices¶
| Edition | Price |
|---|---|
| Community | Free |
| Pro | €15 a seat a month, billed yearly: €180 a seat a year. From 5 to 150 seats, in euros only. |
| Enterprise | No published price. Contact us: the contract is negotiated, seats and all. |
Seats you add during the year are priced for the rest of the year, on the invoice. They come as a new licence key with the new total of seats and the same end date, which replaces the key in force. For example, 10 more seats with 4 months left cost 10 × €15 × 4 = €600.
A small regulated firm that needs legal holds talks to us about Enterprise too.
See the licence¶
Owners and Admins see the company's licence in the company's Settings, under Licence: the edition, the seats used of those licensed, and the end date. It is read-only there. Where a feature needs a paid edition, the app shows a Pro or Enterprise badge beside it, such as the Outlook add-in in Settings, General, or legal holds on Retention. One licence covers the whole instance, so an instance admin enters and changes it, never a company.
When the licence ends¶
When a Pro or Enterprise licence ends, the paid features go. Work in progress, your data and your compliance stay.
| When | What happens |
|---|---|
| From 30 days before the end | A banner above every company page tells Owners, Admins and instance admins The licence ends in so many days, with the end date. Owners and Admins also get an inbox notice marked Licence, which links to the licence in Settings and can be dismissed. |
| For 30 days after the end, the grace | Everything keeps working. The banner reads The licence has ended: everything keeps working until the last day of the grace. |
| After the grace | The instance runs as Community, with the exceptions below. The banner reads The licence has run out: the instance runs as Community, and lists what Stopped and what is Kept. |
| When a new key is entered | Everything comes back at once. Nothing was removed. |
After the grace, these stay as they were, so that the end of a licence never deletes data or breaks a compliance promise:
- the audit's export keeps working for 90 days more;
- the retention periods in force keep running, and cannot be changed: the Retention page shows them read-only, with a Pro badge. Stopping them would keep data past the periods your company agreed to;
- open legal holds stay in force, and can be lifted, but no new one can be set: Setting a hold shows an Enterprise badge;
- SAML sign-in keeps working, and SCIM stops (both planned);
- the companies beyond the first keep working;
- every role stays as it is, and no seat is counted.
Retention in Community¶
On an instance that has never held a licence, retention keeps everything: conversations, transcripts, files and run events are never purged. Community has no retention periods of its own and no legal holds, so a company could not stop a purge it did not want; Tinfirm does not delete a company's data by default.
On an instance that has never held a licence, the Retention page shows the periods read-only, with a Pro badge, and says that nothing is removed by retention. After a licence has run out, it is different: the periods that were in force keep running and keep removing content, as When the licence ends says, and the page says they cannot be changed until a new key. Under a Pro or Enterprise key, the Owner sets the retention periods there. They start at run events 90 days, chat and webhook content 30 days, and other content and files 365 days.
Some tidying runs in every edition: Tinfirm removes chat events, webhook bodies, revoked relay tokens and other operational records it no longer needs, and memory notes keep their own period. To remove a person's content in Community, erase it.
The database of a Community instance grows for as long as it runs. Plan its disk for that, or erase what you no longer need.
The licence of Tinfirm¶
Tinfirm's code is public. Everything outside the enterprise part of the code is under the MIT licence. The enterprise part, which holds the paid features, is under a commercial licence: using it in production needs a valid subscription for the right number of seats. This documentation is under the MIT licence too. Documenting a paid feature here grants no right to use it.