Pricing and licensing
Elpis is licensed software. Annual plans are defined by capability, not by transaction volume; evaluation on testnet is free and fully unlocked.
Software, not a service
You install Elpis on your own Cloudflare account, with your own Arc RPC, database, keys and users. We run nothing for you, hold no money or keys, and take no share of any payment.
Revenue is an annual software licence, plus paid support and add-ons. There is no per-transaction fee collected by us. The only hosted thing we run is this public demo and documentation site on Arc Testnet.
Evaluation is never gated
On Arc Testnet, a local chain or the public playground, every capability is unlocked and no licence is required. A licence gates real money on Arc mainnet; it does not gate the ability to find out whether the product is right for you.
The grants
| Capability | Starter | Team | Enterprise |
|---|---|---|---|
| Control, verify, settle, recover | yes | yes | yes |
| REST API, MCP, webhooks | yes | yes | yes |
| Organizations | one | several | several |
| Team members and roles | — | yes | yes |
| Approval workflows | — | yes | yes |
| Policy templates | — | yes | yes |
| Structured audit export | — | yes | yes |
| SSO (OIDC / SAML) | — | — | yes |
| KMS / HSM signers | — | — | yes |
| SIEM / log export | — | — | yes |
| Retention and RBAC | — | — | yes |
| Compliance report pack | — | — | yes |
Operator-partner is a separate grant for consultancies that host Elpis for their own clients: everything in Enterprise, plus unlimited organizations, white-label branding and their own support contact. The partner carries the operator role and the legal responsibility for those deployments.
The plan and its named entitlements are inside the licence's Ed25519 signature, so a customer cannot edit their own grant.
Caps are not fees
A licence may sign two limits: maxOrgs (organizations on one deployment,0 meaning unlimited) and maxSettledPerMonth (settled actions per calendar month, 0 meaning unlimited).
- Both are counted from the deployment's own local ledger.
- Nothing is transmitted to the licensor.
- We never see or collect a percentage of a settlement.
- When a cap is reached, new payment proposals are refused with a message naming the limit and the contact. Everything that returns money keeps working.
Renewal
The application keeps running after expiresAt. A current licence buys delivery: new releases, security patches and the audited contract fingerprint untilupdatesUntil. Delivery is by private repository access or a signed release archive, recorded against the licence fingerprint in the licensor's local ledger.
Independent audit, penetration testing and legal advice are not included. Those are the customer's to commission; the audit package is shared so an auditor can start.
Price discovery
Prices are deliberately not published yet. We are running a design-partner programme: a free or discounted licence for a fixed term in exchange for structured feedback and, where agreed, a public reference.
The questions are what the protected payment prevents, what the team already pays for that control, and which tier capability it would actually use. The renewal signal is the one that sets a price. Until then, every figure quoted is a hypothesis, not a price.