# The hard limit > You can only ever spend what you have already paid. Here is exactly how the prepaid balance works, what draws it down, what happens when it reaches zero, and what falls outside it. Most platforms let you set a budget and then email you when you pass it. Here the ceiling is money that is already ours to spend on your behalf — you paid it in advance, and nothing can take it below zero. That is the product, not a setting in a screen somewhere. Prepaid: no invoice afterwards, no debt · 14 days of read-only grace at zero ## How a ceiling can exist at all Everything we measure becomes credits, and a thousand credits is one euro. Every minute a job prices what ran in the last minute and draws it off your balance. Before anything expensive starts — a build, a new database, an extra replica — the platform reserves the credits it expects to need and refuses if the reservation does not fit. That is the whole trick, and it is deliberately boring: **the check happens before the spend, not after it.** A budget alarm that fires after the fact can only tell you what already happened. A reservation against money you have already paid simply does not let it happen. There are two ceilings and the lower one wins: your **balance**, which is absolute, and an optional **spend cap** you can set below it to bound a month. Neither can be crossed, and no agent can lift either. ``` scrape kubelet · cadvisor · traefik · minio rollup 15s samples → 60s grains price display-unit formula → credits book credit_ledger + spend_caps.used balance 20 000 credits (€ 20.00 prepaid) reserved 840 credits (build in flight) used 12 403 credits (€ 12.40) remaining 6 757 credits → 34% left ``` ## What happens as the balance runs down ### Step 1 — At 80% and 95%, you hear about it An email, a portal notification, and — if you have connected one — a message in Slack or Discord, in euros rather than in credits. Every MCP response an agent receives also carries the remaining balance, so an agent working on your behalf sees the brake as often as it acts. Auto-top-up, if you switched it on, buys more before this point. ### Step 2 — At zero, the workloads pause Your apps stop serving and visitors get a 503 with a Retry-After header, so crawlers treat it as temporary. Your databases stay readable for 14 days, your storage is mounted read-only, your backups keep running, your domains keep resolving. Nothing is deleted — it is paused, which is a reversible state. ### Step 3 — On a top-up, everything resumes Buy credit and the paused workloads come back within seconds. You can top up any time, and set auto-top-up so it never gets this far. An AI assistant can spend the balance but can never buy more, no matter how the request is phrased. ## What draws down your balance — and what does not Every usage item is here, including the small ones. There is no "and more". | Item | Draws down the balance? | Why | |---|---|---| | Compute and memory | yes | Metered per minute on what you allocate, not on what you happen to use. | | Storage and volumes | yes | On the allocated size, sampled every five minutes. | | Managed databases | yes | Per instance hour while running. Paused instances do not count. | | Backups | yes | Measured after compression, so you pay the smaller number. Restoring is free. | | Build minutes | yes | Only the build itself; queue waiting time does not count. | | Outbound traffic | yes | At € 0.02 per GB — 7.5× cheaper than Vercel and Render, but not free. It draws down credit you already bought, so it can be an expense but never a surprise. | | HTTPS certificates, extra domains on an app, extra team members | no | Included. No per-seat price, no per-domain price. | | Preview environments | yes | At the fraction of the month they are actually awake — they sleep on their own. | | Domain registrations and renewals | no | Deliberately outside the limit. See below. | | VAT | no | Credit is denominated excluding VAT. VAT is added on the invoice you get when you buy the credit, according to your tax status. | A domain registration is a purchase from a registry, not a metered resource: the registry charges us at the moment of purchase and the name is yours for a year. Putting it under the limit would mean a pause could cost you a domain name. It is charged separately on a card, at cost plus a fixed 25% margin, and the renewal price is shown before you confirm. ## What running out actually looks like A small Laravel app with a Postgres database and a handful of preview environments, on a € 20 top-up bought on the 1st. On the 27th the balance reached zero. The apps paused. Visitors got a 503 for four days, the database stayed readable, the backups kept running, and the domain kept resolving. The total paid that month is **the € 20.00 bought on the 1st**. There is no second invoice, no "usage above plan", and no message asking us to make an exception — there is nothing to ask about, because the money moved before the work did. - **Your data is never deleted** because a balance hit zero. Pausing is not termination. - **Topping up takes seconds** and restarts the workloads immediately. - **No invoice ever follows** — there is nothing left to bill. - **No debt is ever created**, so a failed payment is not a collection process. ## Where the competition is right A comparison that only says we win is a sales pitch the first critical reader turns around. So here is the part that is inconvenient for us. ### Railway already has a hard limit And a genuinely capable writing MCP server. They are the most dangerous competitor we have, and pretending otherwise would only make us look uninformed. Their minimum is $10 and hitting it takes workloads offline, which they themselves call a possibly destructive action. ### Cloudflare is cheaper at volume At fifteen million requests a month with short CPU times, Workers comes out around $8 and charges no egress at all. We will not reach that with a VM-based model. Our answer is not "we are cheaper" but "we run what you wrote, without you rewriting it into isolates". ### Netlify effectively caps too Their prepaid credit model bounds spend as long as auto-recharge is off, and it is easier for a layperson to understand than usage billing. It is not positioned as a limit, but it behaves like one. ## The ones people actually ask ### Can I ask you to let it run over just this once? There is nothing to ask for. Running over would mean us delivering something you have not paid for, which is the exact arrangement this model removes. Top up instead — that takes seconds and it is entirely in your hands. ### What if a bug in my code burns through the balance in a day? Then it pauses on that day and you are out one day of uptime instead of a four-figure invoice. That is the trade we are making on your behalf, and it is the one nearly everyone would choose in advance and nobody gets offered afterwards. The cost diagnosis tools will tell you which endpoint did it. ### What if an agent deploys in a loop? Every agent has a daily action budget and a daily deploy budget on top of your limit, and we detect anomalous patterns such as repeated identical deploys. You can revoke all agent access with one button, and revocation takes effect within five seconds. ### Does the balance apply per project or per organisation? The balance is per organisation. On top of it you can set a spend cap per project, so no client site can consume another client's room. Both bind; the lower one wins. ### Is there any way to end up with a charge I did not expect? Two, and both are things you buy rather than things you consume: domain registrations and renewals, charged on a card at the moment you confirm them, and auto-top-up if you switched it on — which charges your saved method when the balance falls below a threshold you set. Both are opt-in and both show the amount before they happen. Everything metered comes out of credit you already bought. ### What happens to my traffic while paused? Visitors get a 503 with a Retry-After header served by the edge, not a blank connection failure, so search engines treat it as temporary rather than gone. Your DNS keeps resolving and your certificates keep renewing, so nothing has to be rebuilt when it starts again. ## Two weeks on us, then only what you buy. Ten euros of credit, fourteen days, and no way for it to turn into an invoice afterwards. - [Start with € 10 of free credit](https://app.cmdz.com/signup) - [See the price book](/pricing)