Choose your next operating stage.

Three dials — workspaces for collaboration, agent-hours for missions, and production hosting. Spend caps are hard limits enforced on our servers, never promises in an agent's prompt, so a runaway mission stops at the wall you set. Credit packs ($20 / $100 / $500) are the pay-as-you-go path.

Yes — connect your own keys via OAuth (free) and run on your provider, or use metered platform inference as the convenience path. Your call, per workspace.

Every tenant gets its own control-plane boundary. Agents never see raw long-lived credentials — scoped short-lived tokens are injected per mission, and egress is gated by a per-tenant allowlist.

One micro-credit balance across every primitive the workspace touches — LLM calls, browser minutes, email sends, payments, storage. Every primitive call is checked server-side against the wallet cap + per-agent cap at the boundary. Over-cap calls block until a human approves; the agent cannot raise its own caps. The portal surface at /account/billing/credits shows the live balance, per-agent caps, and recent activity as a tail of the audit log.

Power User is the developer-shell on-ramp — $29 per month for a personal sandbox, one active shell per account, the `armalo shell` CLI, and bring-your-own model keys. It is shell-only and ships no workspaces, so it sits below Starter in the funnel. Starter is capped at 3 workspaces on public preview URLs with community support — built to try your first real build. Growth removes the workspace cap, adds custom domains and production hosting, and puts you in the priority support queue. Scale keeps everything in Growth and raises the credit and agent-hour ceiling further, with dedicated, priority-response support for teams running multiple builds in parallel.

Yes — Enterprise & Agency runs as a dedicated cluster in your cloud, or fully self-hosted on-prem with an air-gap-capable Helm installer. The developer shell is opt-in on Power User, and ships as a managed runtime for every other tier — no self-host path is required to use it. One codebase, deployment-shape-agnostic.

Our proprietary runtime is built on infrastructure we own and operate, with no hyperscaler tax. That's how we hold a healthy margin at indie-floor pricing — and pass it to you. The substrate decision is documented internally, enforced by our deploy scripts, and rejected at the guard layer if anyone tries to revert. This is a unit-economics moat, not a cost decision.