The hard limit
Most platforms let you set a budget and then email you when you pass it. Here the ceiling is money that is already ours to spend on your behalf — you paid it in advance, and nothing can take it below zero. That is the product, not a setting in a screen somewhere.
The mechanism
Everything we measure becomes credits, and a thousand credits is one euro. Every minute a job prices what ran in the last minute and draws it off your balance. Before anything expensive starts — a build, a new database, an extra replica — the platform reserves the credits it expects to need and refuses if the reservation does not fit.
That is the whole trick, and it is deliberately boring: the check happens before the spend, not after it. A budget alarm that fires after the fact can only tell you what already happened. A reservation against money you have already paid simply does not let it happen.
There are two ceilings and the lower one wins: your balance, which is absolute, and an optional spend cap you can set below it to bound a month. Neither can be crossed, and no agent can lift either.
scrape kubelet · cadvisor · traefik · minio
rollup 15s samples → 60s grains
price display-unit formula → credits
book credit_ledger + spend_caps.used
balance 20 000 credits (€ 20.00 prepaid)
reserved 840 credits (build in flight)
used 12 403 credits (€ 12.40)
remaining 6 757 credits → 34% leftReaching it
An email, a portal notification, and — if you have connected one — a message in Slack or Discord, in euros rather than in credits. Every MCP response an agent receives also carries the remaining balance, so an agent working on your behalf sees the brake as often as it acts. Auto-top-up, if you switched it on, buys more before this point.
Your apps stop serving and visitors get a 503 with a Retry-After header, so crawlers treat it as temporary. Your databases stay readable for 14 days, your storage is mounted read-only, your backups keep running, your domains keep resolving. Nothing is deleted — it is paused, which is a reversible state.
Buy credit and the paused workloads come back within seconds. You can top up any time, and set auto-top-up so it never gets this far. An AI assistant can spend the balance but can never buy more, no matter how the request is phrased.
The edges
Every usage item is here, including the small ones. There is no "and more".
| Item | Draws down the balance? | Why |
|---|---|---|
| Compute and memory | Yes | Metered per minute on what you allocate, not on what you happen to use. |
| Storage and volumes | Yes | On the allocated size, sampled every five minutes. |
| Managed databases | Yes | Per instance hour while running. Paused instances do not count. |
| Backups | Yes | Measured after compression, so you pay the smaller number. Restoring is free. |
| Build minutes | Yes | Only the build itself; queue waiting time does not count. |
| Outbound traffic | Yes | At € 0.02 per GB — 7.5× cheaper than Vercel and Render, but not free. It draws down credit you already bought, so it can be an expense but never a surprise. |
| HTTPS certificates, extra domains on an app, extra team members | No | Included. No per-seat price, no per-domain price. |
| Preview environments | Yes | At the fraction of the month they are actually awake — they sleep on their own. |
| Domain registrations and renewals | No | Deliberately outside the limit. See below. |
| VAT | No | Credit is denominated excluding VAT. VAT is added on the invoice you get when you buy the credit, according to your tax status. |
A domain registration is a purchase from a registry, not a metered resource: the registry charges us at the moment of purchase and the name is yours for a year. Putting it under the limit would mean a pause could cost you a domain name. It is charged separately on a card, at cost plus a fixed 25% margin, and the renewal price is shown before you confirm.
A worked example
A small Laravel app with a Postgres database and a handful of preview environments, on a € 20 top-up bought on the 1st.
On the 27th the balance reached zero. The apps paused. Visitors got a 503 for four days, the database stayed readable, the backups kept running, and the domain kept resolving.
The total paid that month is the € 20.00 bought on the 1st. There is no second invoice, no "usage above plan", and no message asking us to make an exception — there is nothing to ask about, because the money moved before the work did.
Compute € 6.14 · memory € 5.02 · database € 1.46 · storage € 4.88 · backups € 0.34 · builds € 0.72 · € 20.00 of € 20.00 prepaid credit used. The 1 640 credits consumed in the latency window before the chain caught up were written off at our expense, not billed.
Honestly
A comparison that only says we win is a sales pitch the first critical reader turns around. So here is the part that is inconvenient for us.
And a genuinely capable writing MCP server. They are the most dangerous competitor we have, and pretending otherwise would only make us look uninformed. Their minimum is $10 and hitting it takes workloads offline, which they themselves call a possibly destructive action.
At fifteen million requests a month with short CPU times, Workers comes out around $8 and charges no egress at all. We will not reach that with a VM-based model. Our answer is not "we are cheaper" but "we run what you wrote, without you rewriting it into isolates".
Their prepaid credit model bounds spend as long as auto-recharge is off, and it is easier for a layperson to understand than usage billing. It is not positioned as a limit, but it behaves like one.
The awkward questions
There is nothing to ask for. Running over would mean us delivering something you have not paid for, which is the exact arrangement this model removes. Top up instead — that takes seconds and it is entirely in your hands.
Then it pauses on that day and you are out one day of uptime instead of a four-figure invoice. That is the trade we are making on your behalf, and it is the one nearly everyone would choose in advance and nobody gets offered afterwards. The cost diagnosis tools will tell you which endpoint did it.
Every agent has a daily action budget and a daily deploy budget on top of your limit, and we detect anomalous patterns such as repeated identical deploys. You can revoke all agent access with one button, and revocation takes effect within five seconds.
The balance is per organisation. On top of it you can set a spend cap per project, so no client site can consume another client's room. Both bind; the lower one wins.
Two, and both are things you buy rather than things you consume: domain registrations and renewals, charged on a card at the moment you confirm them, and auto-top-up if you switched it on — which charges your saved method when the balance falls below a threshold you set. Both are opt-in and both show the amount before they happen. Everything metered comes out of credit you already bought.
Visitors get a 503 with a Retry-After header served by the edge, not a blank connection failure, so search engines treat it as temporary rather than gone. Your DNS keeps resolving and your certificates keep renewing, so nothing has to be rebuilt when it starts again.
Ten euros of credit, fourteen days, and no way for it to turn into an invoice afterwards.
€ 0.00 surprises