Plans, query credits & accounts

Cash Runway sells query capacity plus app access, not feature tiers. Every paid plan unlocks the whole app with the same features — plans differ only by how many AI/agent queries you can run. Point your own AI agent at your data on the free plan, then upgrade when you want the in-app experience or more query headroom.

One-line model. A user holds a plan (a query allowance). A seat is that user on a billing account. Solo users can be Free; team seats start at Pocket (the entry paid plan). The LLM is bring your own — your agent calls our read-only API for data; we run no inference, which is what keeps the query caps generous and cheap.

Overview

The plan ladder

All paid plans unlock the full app and the same features. They differ only by the number of queries allowed in each rolling 5-hour window.

Plan	For	Queries / 5h	Per seat / month	Annual (−20%)	Card?	Team seat?
Free	Solo, API-only	10	$0	—	No	No
Pocket	Entry paid	50	$9	$84/yr ($7/mo)	Yes	Yes (minimum)
Wallet	5×	250	$24	$228/yr ($19/mo)	Yes	Yes
Vault	20×	1,000	$49	$468/yr ($39/mo)	Yes	Yes
Reserve	100× power	5,000	$249	$2,388/yr ($199/mo)	Yes	Yes

• Free is solo-only — it can never be a team seat, and needs no credit card. In the app a Free user reaches only API keys / usage, Settings, and Partners; every analysis page redirects to the in-app Upgrade screen. Free is the agentic-API path: grab a key, point your agent, and read your data through the MCP server or CLI.
• Any paid plan (Pocket and up) unlocks the full app. Paid plans are feature-identical — the app is the paid unlock, not individual features.
• Annual billing is 20% off the monthly rate, billed yearly, with the effective monthly figure rounded down to whole dollars.

A 14-day Wallet trial gives new accounts full app access with no card up-front. At trial end a Personal account drops to Free; a Team account needs a card to keep its paid seats. See Sign up.

Query metering — the rolling 5-hour window

A query is one agent/AI API call (the same call the per-seat quota counts). Non-AI in-app browsing is never metered.

• Metered per (user, account), combined across that account's orgs. A query against an org counts against your seat plan on the account that owns that org — not per-org. So five Xero companies in one Personal account share one allowance (no free-credit farming via extra orgs). Across accounts the allowances are separate: your Personal Free pool and a Team Wallet seat are distinct, so you get Wallet capacity while working in the Team's orgs.
• Rolling, not a daily reset. At any instant your trailing-5-hour usage can't exceed the cap. Credits free up incrementally — each call ages out exactly 5 hours after it was made, so capacity recovers continuously rather than at a fixed midnight.
• Shown as a percentage in the in-app topbar chip, with the same numbers on the agent API. The usage response reports nextCreditInMinutes (when your next ≥1 credit frees up — the actionable "wait this long" when you're capped), fullResetInMinutes (when all credits return), and windowResetAt (the absolute ISO instant). An agent that hits the cap therefore knows exactly how long to back off. See the Agent API and the usage block in the reference.

Plan changes. Upgrades apply immediately — both the higher cap and the prorated Stripe charge. Downgrades use a one-window (5-hour) grace: you keep the old (higher) cap and keep being billed the old plan for 5 hours, then both drop together. Because a rolling 5-hour window fully rolls off every pre-downgrade query within 5 hours, the lower cap applies with zero retroactive cutoff — nobody is cut off mid-session for queries they already ran under the old plan.

Cushion — paid overflow

Cushion lets a seat keep going after its rolling window is exhausted. It is off by default, opt-in per seat, and requires a saved card.

• A fixed $50 pack buys 5,000 query credits at a pinned $0.01/query. The rate is deliberately punitive (≈8× the Pocket per-query rate) so topping up is never cheaper than upgrading — Cushion is a fallback, not a plan.
• Credits are banked — they don't expire each window; they draw down across windows until used or the calendar month rolls.
• You set a monthly cap (max packs / dollars of auto-top-up per month). When your window runs dry Cushion auto-buys one pack, then stops at your cap.

Accounts — Personal vs Team

Billing lives on a billing account that sits above your Xero companies (organisations). In code this model is BillingAccount; in the product it's simply your Account.

• Personal account — auto-created on signup, one seat (you). May be Free. You can connect multiple Xero companies to it.
• Team account — multiple seats (all ≥ Pocket, all billed to one card on the account), multiple companies. An admin assigns each member which companies they see, plus the existing per-account scope within a company.

Two switchers keep these layers clear:

• The Account switcher (in the avatar dropdown) flips your active account — Personal ↔ Team A ↔ Team B.
• The Company switcher (top-left, unchanged) picks the Xero company within the active account.

User-facing flow

A solo user on Free. Sign up (no card) → land on the agentic path: open Settings → API keys, mint a key, and wire it into your agent with the MCP server or CLI. Your 10 queries / 5h refill continuously. Want the in-app dashboard, forecast, AR and budget pages? Hit any of them and you're routed to Upgrade — pick Pocket or above and the whole app unlocks at checkout.

Upgrading. Choose a plan on /upgrade (or the public pricing page), add a card via Stripe Checkout, and your seat flips to paid the moment payment succeeds — your cap rises immediately and the app opens. Subsequent plan changes upgrade instantly or downgrade after the 5-hour grace.

Running dry. When your rolling window is empty you see your usage chip at 0% and agent calls return a "out of credits — resets in ~N minutes" signal. Your options: wait for credits to age back in, upgrade a plan, or — if you've enabled Cushion — let it auto-buy a $50 pack of banked credits and keep going up to your monthly cap.

On a Team. A team owner creates a Team account, invites members (each on a paid seat ≥ Pocket), and assigns each member the companies they should see. Members switch into the Team via the avatar dropdown; their queries there are billed to and metered against the Team's seats.

Admin actions

The account owner manages everything billing-related on one page — Settings → Account → Billing (see the Account billing guide). Admins can manage seats and invites, but only the owner sees and changes billing.

• Read the bill — the seat-bill breakdown lists every seat, its plan, and per-seat price, totalled into the monthly bill. Each seat bills at its effective plan, so a downgrade in grace still shows the old (higher) price until the window closes — the total always matches Stripe.
• Invoices & card — review recent Stripe invoices and open the Stripe customer portal to update the card or cancel.
• Manage seats (Team) — invite members, set or change each member's seat plan (which reconciles the account's Stripe subscription), assign which companies each member can see, and manage account roles. See Team management below.

Cushion settings

From the billing page the owner can enable Cushion (requires a saved card) and set an optional monthly cap on overflow spend. Banked credits already purchased are always drawn down first, regardless of the toggle. Leave the cap blank for no auto-top-up ceiling.

Team management

On a Team account the owner/admin surface lets you:

• Create the team and invite members — invitees join on a paid seat (minimum Pocket); the invite collects their account role.
• Manage per-member seat plans — assign or change a member's plan; the change reconciles the Stripe subscription (upgrade now with proration, downgrade at grace end).
• Assign companies per member — choose which of the account's Xero companies each member can see, alongside the existing per-account scope within a company.

Entitlement & the first paid seat

A seat stays Free until payment clears. The Stripe webhook is the only place a seat flips Free → paid: on first subscription activation it sets the buyer's seat to the subscribed plan (derived from the Stripe price). First checkout seeds the subscription with the chosen plan's price but never touches the seat — so app access is granted strictly after payment, never before.

Technical surface

The query-credit model spans schema, the metering engine, billing, and the public surfaces. The canonical design (12 locked decisions) lives in docs/superpowers/specs/2026-05-31-query-credits-billing-model.md.

• Billing entity — BillingAccount (tables billing_accounts / billing_account_memberships); the model is named BillingAccount because NextAuth owns Account. A BillingAccountMembership carries the member's seat plan and account role; the deferred-demotion columns (pendingSeatPlanFromTier / pendingSeatPlanUntil) live here. Subscription and stripeCustomerId moved from Organization onto the account.
• Plan config — the SeatPlan enum is FREE / POCKET / WALLET / VAULT / RESERVE; SeatPlanConfig seeds the caps and prices and holds the monthly + annual stripePriceIds. The parallel, deliberately distinct advisor ladder is PartnerPlan (FREE / SOLO / PRACTICE / FIRM / NETWORK) in PartnerPlanConfig.
• Metering — a per-(user, account) sliding-5h ledger of call timestamps backs quota.ts, which resolves the account of the target org → resolveEffectivePlan → window cap, then checks and increments against the trailing 5 hours. resolveEffectivePlan returns the old tier while a pending downgrade's pendingUntil > now, giving the 5-hour grace for both cap and bill.
• Cushion — a banked-credit ledger (grantCushionPackUnderMonthlyCap, cap-safe under concurrency); the chokepoint consults Cushion before returning 429. Stripe sees a metered price whose unit is one $50 pack (meter cashrunway_cushion_pack); each auto-top-up reports +1 pack out of band, and a cushion_usage_reports table (grantEntryId UNIQUE) guarantees exactly one billed unit per grant.
• App-access gate — the capability canUseApp (true for any non-Free effective plan, and during the trial) gates the (dashboard) route group; Free/lapsed users are redirected to /upgrade, while Settings / API-keys / Partners stay reachable.
• Quantity billing — computeSeatLineItems → reconcileAccountSeatSubscription drives the account's Stripe subscription; first paid seat opens Checkout; the webhook reconciles subscription status and performs the first-paid entitlement flip.
• Agent surface — the usage endpoint returns the usage block (used / limit / remaining / nextCreditInMinutes / fullResetInMinutes / windowResetAt) plus the X-CashRunway-Reset-Minutes header. The MCP server and CLI carry the paired Zod schema for these fields and surface remaining credits + reset estimate, handling 429 gracefully. Advisory partner keys (crun_…) reach every linked client org via cashrunway.list_orgs, and usage is metered to each client's owning account.

Related features

• Account billing — the owner's billing page (seat breakdown, invoices, Stripe portal, Cushion settings).
• API keys — minting scoped keys for agents, rotation, audit.
• Agent API — the read-only endpoint surface and the usage block.
• MCP server and CLI — the agentic clients, including the advisory partner connect flow.
• Sign up — the 14-day Wallet trial and what happens at trial end.