Permission, priced for how you work.

Questions

Is the local gateway really free?

Yes. The gateway runs on your machine with the same policy engine, approvals and signed audit log as every paid plan, free forever. Paid plans add a managed tunnel, hosted gateways and more workspaces.

How does the free trial work?

Your first subscription, monthly or annual, starts with a 7-day free trial. A card is required up front but nothing is charged until day 7. Cancel during the trial and you keep access until it ends, then drop to Free, and you pay nothing. A hosted gateway you started in the trial is paused for at least 7 days after it ends, then kept for 96 hours so you can export its vault, and then deleted unless you subscribe first. You get one free trial: if you have had one before, on any account or organization, a new monthly subscription is billed the same day.

Do annual plans have a trial?

Yes. Your first subscription, monthly or annual, starts with a 7-day free trial. A card is required, nothing is charged until day 7, and canceling before then costs nothing. Where Paddle sold your subscription, you can email support for a full refund within 30 days of your first charge. Purchases in the iPhone app are refunded by Apple.

What's the SPECIAL OFFER?

For a limited time, Pro and Team are $19 a month instead of the regular $29, or $190 a year instead of $290 (per seat on Team). Get in early and you keep that rate for life, for as long as your subscription renews, monthly or annual. Once the offer closes, new subscriptions bill at the regular $29 a month or $290 a year. If your subscription lapses and you subscribe again after the offer has closed, you pay the regular price. On Team, seats added while the offer is open keep the offer rate for as long as the subscription continues; seats added after it closes bill at the regular rate. The offer is for subscriptions bought on the web: plans bought in the iPhone app are priced by the App Store.

Do prices include tax?

In the US, Canada, Australia and the other countries where we bill you directly, the price shown is the price you pay, with no tax added. Everywhere else our reseller Paddle sells the subscription and adds VAT, GST or sales tax at checkout where it applies, so you see the full amount before you pay. A business that enters a valid VAT or GST number is not charged VAT where the reverse charge applies.

Why is Team a 2-seat minimum?

Team exists for shared governance: policies, approvals, and audit across people. It's priced per seat with a 2-seat minimum; add or remove seats any time from the console.

Can I switch between monthly and annual billing?

Monthly to annual is self-serve from the console, and annual billing starts immediately. When the person who pays for the plan switches an active plan, the unused part of the current month, pro rata by the days left, is deducted from the yearly charge, so the first year costs less. It is never refunded, and later years renew at the full yearly price. Before any plan or seat change you see what it charges today, any credit already taken off that charge, the new price and when it takes effect, and nothing changes until you confirm. Annual to monthly is handled by support.

When do my secrets leave my machine?

Your secrets are stored on your machine unless you choose hosted execution, which is an opt-in upgrade; local-only is the default and the foundation of the product. Your agents' calls never pass through permaura.com. With a managed permaura.app tunnel, though, the traffic for that address runs through Permaura's Cloudflare account and Cloudflare terminates TLS for it, so Permaura and Cloudflare can see it; your own tunnel or domain keeps it off Permaura's Cloudflare account and sends it only through the providers you choose. With remote access on, the console and the app reach your gateway through permaura.com, which relays their requests in memory without logging them, including a credential you type there. To keep a credential off permaura.com entirely, set it through the gateway's local API on its own machine.

Can I bring my own keys (BYOK)?

On Enterprise, this is on the roadmap. Holding the key-encryption key in your own KMS, running execution workers in your VPC, and exporting audit events to your SIEM are planned Enterprise capabilities; talk to us about timelines for your rollout. Separately, a gateway you run yourself can keep its secrets in your own Infisical instead of its local vault, on any plan including Free, set through the gateway's environment. Hosted gateways cannot use it.