The whole value, in one shape
Your bill scales with work, not with topology
On the usual cloud, residency and resilience mean more regions and more instances, and the bill rises with every one, so the safest architecture is also the most expensive, and the budget quietly argues against doing the right thing.
Here, cells, nodes and service groups are free and unlimited. Split into twenty cells across five regions and the topology costs nothing; only the work is metered. The architecture decision stops being a budget decision.
| Bill | What it does |
|---|---|
| The usual cloud bill | Residency and resilience mean more regions and more instances, and the bill rises with the topology, so the safest architecture is also the most expensive. |
| System9 | Cells, nodes and service groups are free and unlimited. Split into twenty cells across five regions and the topology costs nothing. |
| What is metered | Only the work: compute-unit time, storage and active users, each booked to a hash-chained record you can verify. Overage is billed, never blocked. |
| The consequence | The architecture decision stops being a budget decision. |
Access is by invitation
There is no free tier, no self-serve sign-up and no trial you can start with a card. Customers, consultants and partners are invited, and an invitation creates an account for managing licences, deployments and usage.
We would rather say that plainly than run a sign-up flow that ends in a sales call. If you are evaluating System9, the first conversation is with a person who can answer architecture questions, not a form.
Four decisions that shape the bill
Each of these is a property of how licensing and metering are built, not a commercial policy we could quietly reverse next quarter.
Infrastructure is free and unlimited
Cells, nodes and service groups cost nothing. Residency and resilience are architecture decisions rather than budget decisions, because adding a cell in another jurisdiction does not add a line to your invoice.
Overage is billed, never blocked
Exceeding a resource limit produces a charge, not an outage. Feature flags are hard gates; resource limits are soft; concurrent kernels queue rather than reject. The platform will not take your workload down to enforce a commercial term.
Licensing verifies entirely offline
Licence keys are Ed25519-signed and verified with no network call. The signing key never leaves a hardware module, and a monotonic entitlement ratchet defeats clock rollback. There is no phone-home on the enforcement path, an air-gapped estate licenses itself.
Every line is verifiable
Metering records land in a hash-chained audit chain with gap detection, and a disconnected estate emits signed metering bundles. Every line on your invoice has a record behind it that you can verify yourself, rather than a number you have to accept.
What is metered, and what is not
| Dimension | How it is measured | At the limit |
|---|---|---|
| Compute units | Kernel execution time multiplied by kernel class. | Overage billed, never blocked |
| Storage | Gigabyte-months, with peak measured hourly. | Overage billed, never blocked |
| Active users | Distinct users in a calendar month. | Overage billed, never blocked |
| Cells, nodes, service groups | The shape of your deployment. | Free and unlimited |
Edge devices are observed and governed, and are never billed as core consumption. A fleet of ten thousand devices does not change the shape of your invoice, and inference that runs on the device itself is off-meter by policy, reasoning at the edge is not charged as core work.
Metered by default, or prepaid by the block
Metering into a verifiable record is the default, and for most organizations it is the whole model. Some want a fixed, known cost instead, or run disconnected and want entitlement decided in advance rather than reconciled later. For them, a node can hold a prepaid capacity block.
Metered, post-paid
The organization pays for the work it does, booked into a hash-chained record it can verify line by line. Overage is billed, never blocked. This is the default, and nothing below changes how work is governed, metered or audited.
Prepaid capacity, per node
A node holds a prepaid block of capacity, chosen from a ladder of block sizes and matched to expected work by a capacity sizer. It can be lifted to the next size while the node keeps running, and (like the rest of licensing) it is graded entirely offline, so an air-gapped node knows what it is entitled to with no call home.
Every billed line has a record behind it
An invoice is usually a number you are asked to trust. Here it is the tail of a chain you can walk. Only work is metered; each unit of work books a Compute-Unit record into a hash-chained ledger where a missing entry is a first-class gap event; a disconnected cell emits signed bundles an operator carries out; and the control plane reconciles those into invoice lines that each resolve back to the record that produced them.
So a charge you dispute is a record you can check, not a figure you have to accept.
| Stage | What happens |
|---|---|
| Free, never metered | Cells, nodes and service groups cost nothing. The shape of a deployment is free and unlimited, so residency and resilience are architecture decisions rather than budget ones. |
| Work runs | Only work is metered, kernel execution time multiplied by kernel class, storage in gigabyte-months, and distinct active users in a month. |
| Compute-Unit record | Each unit of work books one measured record, denominated in Compute Units and write-ahead logged before it is flushed, so a crash cannot lose a line silently. |
| Hash-chained | Records land in a hash-chained audit chain where each entry links the previous one and a missing entry is counted as a first-class gap event rather than passing unnoticed. |
| Offline bundle | A disconnected cell emits signed metering bundles for an operator to carry out. Metering does not require a live link; the record is made locally and reconciled later. |
| Invoice line | The control plane reconciles those records into invoice lines, and every line resolves back to the hash-chained record behind it, a charge you can verify yourself rather than a number you have to accept. |
| Ceilings | The ledger accrues in Compute Units; no real money moves on this path. Licensing verifies entirely offline, nothing on the enforcement path phones home, and overage is billed rather than blocked. |
Two boundaries travel with this: the ledger accrues in Compute Units, no real money moves on this path, and licensing verifies entirely offline, so nothing on the enforcement path phones home. Overage is billed, never blocked.
What happens when an entitlement lapses
A platform that runs in facilities with no link cannot treat a missed renewal as an outage. Expiry degrades over sixty days, in named stages, and never destroys access to your own data.
- 01
Active
Full access.
- 02
Grace, 30 days
Full access, with warnings. Nothing goes dark on day one.
- 03
Read-only, 30 days
Reads continue. Writes stop.
- 04
Suspended
Administrator access and data export only. Your data remains yours and remains reachable.
Packages and licence tiers are different axes
This trips people up often enough to be worth stating outright, because conflating them produces a pricing conversation that neither side can win.
A package is what a deployment turns on
9 shipped packages compose a cell profile, an AI capability profile and a feature-group selection, from a minimal single-node configuration through data platform, security, sovereign, edge and mission configurations. A fresh install boots into the standard package with AI, detection, agents and the defense capabilities off until an operator turns them on.
A package is a configuration. It is not a price plan.
A licence tier is what you are entitled to
Entitlement is enforced in code and carried in a signed licence payload alongside your organization identity, deployment posture and limits, so setup never re-asks for something you gave at registration. Defense capability tiers activate independently, which means an enterprise buyer is not forced to take mission features to get advanced detection.
Which tier fits is a conversation, not a checkbox.