Pricing · governed action boundary, not tokens

Start free. Pay when KIFF governs production traffic.

KIFF Cloud monetizes the governed action boundary: proposals evaluated, decisions issued, risky actions blocked, approvals required and resolved, signed receipts, audit timelines. Not tokens. Not seats. Not model calls.

Pick a plan that maps to your stage. Free is enough to feel the first governed action. Builder covers one production workflow. Agency / Team covers multiple client or product workflows. The paid pilot is for serious teams that want one risky workflow running in production this month with the founder on call.

Free / Dev

$0

Prove the first governed action.

1 workspace, 1 active domain, a small number of API keys.
Up to ~1,000 governed proposals per month.
Short receipt retention.
Signed receipts on every executed decision.
No verifiable trail; the verifiable-trail layer and stronger trust-evidence features are gated to paid tiers.
No card required. Self-service signup.

Best fit: solo evaluation, prototypes, MCP/agent experimentation. The free tier is enough to wire one risky tool through KIFF and see decisions land in your audit timeline.

Start free

Builder

$49–99 / mo per workspace

One production governed workflow.

Higher governed proposal volume (mid five-figures per month).
Multiple domains and environments (staging, prod, additional workflows).
Approval flows working end-to-end with a basic queue.
Longer signed-receipt retention.
Verifiable-trail layer when enabled on the tenant.
Email support, founder-reachable for a same-day sanity check.

Best fit: an indie hacker or solo team putting one risky AI workflow into production — refunds, outbound email, DB writes, deploys, PR merges. The exact monthly number lands by usage shape; we'll write it on the activation email.

Request paid activation

Until automated checkout lands, activation is founder-led on a one-business-day cadence in EU/US time zones.

Agency / Team

$199–499 / mo per workspace

Multiple client or product workflows.

Multiple workspaces or client projects, each with its own audit timeline.
More API keys and per-key role separation.
Multiple domains and longer signed-receipt retention.
Approval inbox with reviewer attribution.
Exportable audit trail for client deliverables.
Founder-reachable for setup and one onboarding session per workspace.

Best fit: agencies, AI consultants, and small SaaS teams running one product or workflow per client. You pay per real production surface, not per seat.

Request paid activation

Until automated checkout lands, activation is founder-led on a one-business-day cadence in EU/US time zones.

Prices below are launch ranges, not a committed rate card. They land toward the lower end for solo builders and the upper end for teams running real production traffic; the conversation tells us where you fit.

Paid pilot · founder-led

$1,500–5,000 one-time

One risky AI workflow governed in production this month, with the founder on Slack or email through onboarding. The deliverable is a running governed workflow in your production environment, not a deck or a report.

What's included

Founder-led setup of one risky AI workflow on KIFF Cloud: domain definition, executor mapping, API key management, approval routing.
Slack or email channel with the founder for the pilot duration (typically 2–4 weeks).
One onboarding session, one mid-pilot review, one wrap-up.
One quarter of free Builder or Team plan time after the pilot, depending on shape.

Price band by complexity

$1,500 — one workflow, simple state machine, you already have the executor logic.
$3,000 — one workflow, moderate complexity, some integration work on the executor side.
$5,000 — one workflow with non-standard requirements (custom retention window, verifiable-trail enabled, multiple environments).

Not a consulting engagement. Not a path to enterprise procurement, SSO, SAML, SCIM, or long-form security review — those are different conversations on a different timeline.

Request a paid pilot

What you're paying for

KIFF Cloud is the runtime that decides what your AI system is allowed to do, before it does it. The paid value is concrete:

Governed proposals evaluated.
Decisions issued — allowed, approval required, blocked.
Risky actions blocked before they touched a real system.
Approvals required and resolved through a documented path.
Signed receipts on every executed decision.
Retained audit timelines that an external reviewer can read.
Multiple governed workflows running in production over time.
Production runtime trust — the cloud is the named third party behind every signed record.

Read the paid offer for the full deliverable, timeline, and success signal.

What KIFF is not

Not a model gateway. We don't proxy LLM calls or sit on the model layer.
Not an agent runtime. Agno, LangGraph, Claude Code, Codex, Cursor, MCP runtimes — KIFF sits next to them, doesn't replace them.
Not a generic dashboard SaaS. The dashboard is thin and exists to drive the integration loop.
Not enterprise-compliance-first software. SSO, SAML, SCIM, full SOC 2 process exist eventually, but they are not how the product is sold today.
Not a sidecar or proxy. We don't intercept your tools. Your system stays the executor.
Not consulting. The paid pilot delivers a running governed workflow in your production, not a deck.

Common questions

How are governed proposals counted?

Every call your code makes to POST /v1/proposals/decide counts as one governed proposal across the four core outcomes (allowed, approval_required, blocked, invalid). The exception is limit_exceeded — once you cross the plan ceiling, the gate short-circuits before the counter increments, so the rejected call doesn't count against the next period either. A retry against the same logical proposal id should stamp the same id so the audit and counter paths dedupe; today this is a contract, not strict enforcement.

What happens when I cross the free/dev limit?

The proposal gate returns HTTP 429 with outcome: "limit_exceeded" and reason plan_limit_reached. Your code can branch on the outcome, queue the proposal, or surface the upgrade prompt. The audit trail still records the attempt.

Is there a refund or re-shape if the pilot doesn't fit?

Yes. If a pilot integrates and immediately reveals you wanted a model gateway or an agent runtime instead — or the risky workflow doesn't fit the pre-execution proposal contract — we offer a refund or a re-shape within the first week.

Do you store card data?

No. Payment goes through a hosted checkout (Stripe Payment Link or Lemon Squeezy) once the day-one checkout lands; until then, paid activation is founder-led with a direct invoice. KIFF never holds card data.

Why no token or seat pricing?

Tokens are LLM-vendor pricing; seats are SaaS pricing. KIFF Cloud is the runtime around governed actions, which is a different unit. We charge for the boundary, not the model traffic that feeds it.

How do I move between tiers?

For now, plan changes go through the founder. Email hello@kiff.dev with your tenant slug and the plan you want; activation lands within one business day in EU/US time zones. Self-service plan management arrives with the day-one checkout (#156) and the manual paid activation path (#143).