Billing and usage

Billing lives under Account > Billing and Usage. Two things are billed separately:

• the platform subscription — the plan you choose, billed monthly or annually through Stripe
• hosted model usage — token consumption for scans that run on ZeroQuarry-managed LLMs, itemized per model and invoiced monthly on top of the subscription

Calls made with your own provider key are billed by that provider, not by ZeroQuarry; they appear in the usage table as "Your provider" but are not invoiced by ZeroQuarry.

The Billing and Usage page carries the plan checkout, payment method, and the current month's usage. Past invoices appear here once hosted model usage has been invoiced.

Choose a plan

Available plans are listed with their monthly and annual prices. Changing plans goes through Stripe Checkout; the change applies to the account as a whole, not to individual members.

The Open Source plan

The Open Source plan is free and permanent, and its contract is narrow: scan an open source repository. That boundary is enforced rather than advisory. Only public Git URLs are accepted, and ZeroQuarry confirms each one with the hosting forge's own unauthenticated API before cloning. Uploaded archives and local paths are refused, so private source cannot slip through the public-repository check. Binary and remote scans are not available, generated patches and the auto-fix bot are off, and reports carry a watermark.

What stays on is the work a maintainer does with the result: findings, exploit proofs, evidence and deployment packages, HackerOne and adversarial review, incoming email triage, disclosure tracking, and filing issues into your own Linear.

The surfaces that only make sense when you are running a security program are off: the triage centre, the Evidence Room, secure shares, attestation engagements, and inviting team members. Linear filing stays available because an issue in the maintainer's own tracker is the deliverable, while reading labeled issues back for verification intake is gated separately.

An Open Source account starts with a Source code project, which is also why those two are separate: the default profile shows the discovery feed but no manual asset library.

Payment method

Payment methods are managed in the Stripe customer portal. Use Manage payment methods to update the card on file or review invoices in Stripe. Invoices and receipts are emailed to the account's billing contacts.

Plan usage: security runs

Plan capacity is metered in security runs. A scan reserves against the monthly allowance at launch — five for a full source, binary, or remote assessment, one for a focused changed-file review or a verification-only retest — and settles when it finishes: one run per pipeline stage that completed (typically four for a full assessment), one for a focused product, and zero for a run that failed or delivered nothing.

The usage card shows the settled charge for the current month plus the full reservation of any scan still in flight. That is why a five-run launch can show the month higher than the runs it has actually cost so far. Reports, decisions, sharing, and pipeline-stage re-runs consume no additional runs, and deleting a finished scan does not return its runs.

See How security runs are counted for the stage breakdown, the settlement rules for failed and cancelled scans, and the per-source allowance on free and trial plans.

Hosted model usage

On top of the plan, the usage table shows the current month's token consumption per model — input, cache-hit, and output tokens — split between ZeroQuarry-hosted models and calls funded by your own provider key. Hosted usage accrues to a monthly invoice per model; if a month's invoice could not be issued at the time (for example, before a payment method was on file), it is caught up automatically once billing is configured.

Security runs and model usage are separate meters. A refunded run still burned tokens, and those tokens still appear in this table.

The billing role

Teammates who need to manage payment details or receive invoices do not need full admin access. Invite them with the billing role under Account > Members; billing-role members can manage the Stripe portal session and billing contacts but cannot create scans or change security settings.

Billing contacts default to the account owner. Invite a billing teammate and have them set the contact to change where invoices are delivered.

What happens if a plan expires

When a plan or trial expires, new scans and artifact generation are blocked, but existing reports, findings, evidence, and exports remain readable. Settle the billing issue in the Stripe portal to resume normal operation.