The two bills
- Your model provider. Site review and Test drive call the model whose key you configured. That is billed by them, at their price, with no markup. The call never passes through us.
- nth Labs. The local install is free. See pricing for what a hosted, shared console costs.
What is free forever
Speed & errors, Re-checks, Report, Assistant readiness, Round trips and Environment diff
(the six deterministic checks) plus
coverage, map, doctor, scope,
calibration, changes and memory. None of them call a
model, so there is nothing to meter.
This is not a trial. There is no run limit on them and no card required to use them.
Local versus hosted
| What differs | Local | Hosted |
|---|---|---|
| Cost | Free | Per seat |
| Where findings live | Files on your machine | The console you host |
| Who can see them | You | Everyone you invite |
| Account needed | No | Yes |
| Model key | Yours, on your machine | Yours, on the box |
Workspaces, seats and roles
A workspace is the unit people share: it holds the projects, the findings and the keys, and a seat is one person in it. A personal workspace is the default and needs none of this: “just you” is a real setting, not a starter tier.
There are four roles. What each may do is an explicit table in the code rather than a rule scattered across routes, because a permission model you cannot read in one place is one nobody can audit.
| Role | May | May not |
|---|---|---|
| Owner | Everything below, plus billing, renaming, deleting the workspace and transferring it. | Nothing |
| Admin | Run checks, rule on findings, edit the product setup, invite and remove people, set roles, rename the workspace. | Billing. Delete the workspace. Hand it to someone else. |
| Member | Run checks, read findings, edit the product setup, rule on visual changes. | Manage anybody, including a viewer. |
| Viewer | Read findings and reports. | Start testing: a run spends real money on somebody’s key, and a seat that can spend it is not a viewer seat. Write config, erase a ledger, or touch a key. |
A member outranks a viewer and may still manage nobody, because a member holds no management capability at all. Both halves are asked at every call site: hold the capability, and outrank the person you are pointing it at. Two admins cannot manage each other.
The viewer restrictions are enforced at the route rather than in the interface, so a read-only seat cannot reach a write by finding a different URL. That is tested, not a convention.