Spending

Your tenants spend only what was admitted (their quotas and allowances, at your prices), and nothing running is ever stopped for money. Your own costs are your servers, on your Hetzner bill: a new server or a bigger type is added only with a person's approval.

What is billed

Prices are yours, per unit, in USD: your price book. The operator sets each (PUT /v1/prices/units/<unit>, on the operator's API); GET /v1/prices lists each with its version and since when. A new price applies from then on. Your prices are what you charge, never derived from what your servers cost: your platform alerts when one is below its cost (PriceBelowCost).

The ledger charges your tenants, never your product: your own services, Postgres instances, databases and bucket are the platform's, your own cost (the servers they run on), held against the fleet's room (below) and within their allowances. Every hour, the ledger adds a row per tenant and resource with its quantity, the unit's price and that price's version, and the amount, never rewritten (corrections are new rows); the month's spending is the sum of its tenants' rows (GET /v1/ledger; rows charged to your own environments and instances before 2026-11-02 stay there, env: and postgres:, and count as no spending).

Billed as reserved, by the hour, whether used or not:

• your tenants' databases' and buckets' sizes (their database and bucket limits): what is billed is provisioned;
• your tenants' own domains, at your custom_domain_month price a month each, 1/730 of it each hour while a tenant has one (Tenants); the names under your tenant domain are free.

Your own services' memory (each service's boxes at its max_replicas: a range within them holds no more), your Postgres instances and your databases' and bucket's sizes ([postgres.main] size = "5Gi", [bucket] size = "10Gi"; 1Gi and 5Gi by default; your Postgres instance's disk sized to hold every environment's databases) aren't billed: they are held against the fleet's room, and each is a hard cap.

Billed as used, within each tenant's month: your tenants' compute, their apps' memory time (a GB of a box's memory cap awake for an hour, compute_memory_gb_hour) and CPU time (a vCPU for an hour, compute_cpu_hour), charged each hour once its usage is in (resource compute). Invocations aren't priced apart: they are paid through the memory and CPU they use. A unit is charged once you set its price (GET /v1/prices); until then it is shown, not charged. Your tenants' other units (rows, KV units, messages, logs, emails, peak connections, egress: their traffic is billed as traffic, below) are recorded every minute and shown in the month's spending (unpriced_usage of GET /v1/spending), not charged (Tenants); each tenant's month is held to its own limits.

Billed as used, within a monthly allowance: a tenant's traffic answered (its egress limit, 100 GB by default), throttled at it.

Your own, not billed, within a monthly allowance: measured every hour beside the ledger, each held by its edge, so a runaway service or backup can't grow the platform's bill unseen:

Bucket requests aren't billed, but have an allowance too: 1,000,000 a month per environment (a tenant's is its class_a and class_b limits). Past it, the bucket answers 5 requests a second until the next month (503 SlowDown); S3 clients retry the rest.

Admission: refused before it exists

Anything that would grow what the fleet holds (a deploy with a higher max_replicas or more memory, a preview, a new tenant or a bigger tenant limit) is admitted only if the fleet has room for it: resident memory 1:1, sleepable memory (previews, tenants' boxes) up to twice what is left. Otherwise the API refuses it with 503 until a person adds a server. Changes that don't grow it always pass. A tenant's month (its allowances, its own domains) is held by its own limits, each with its edge.

Edges, not stops

Nothing running is stopped, slept or deleted for money. Every reservation is a hard cap (memory limits; a database or bucket at its size turns read-only) and every allowance has an edge, so spending can't grow past what was admitted. You are alerted when your tenants brought less this month than the platform cost in the same hours.

Seeing it

The API has the month (GET /v1/spending: what your tenants were charged, the projection to the month's end, the hourly rate now and what they hold, allowances with what they used; own, your own environments' and instances' allowances with what each used) and the ledger's rows (GET /v1/ledger).