A plan is the contract that controls what your organisation and your tenants can do. It carries three kinds of caps:
Quotas — counted resources: how many tenants, how many users per tenant, how many MFA enrollments.
Feature flags — capabilities switched on or off: SAML federation, custom domains, webhook delivery, organisation SSO.
Rate limits — requests per minute on the public-facing API surface.
You start on the Free plan when you sign up. Upgrade tiers unlock more of each axis; downgrades are constrained by your current usage (you can't downgrade to a tier whose user quota is lower than your current user count).
Where plans apply
Plans apply at two levels:
Organisation plan. Caps everything across the organisation: total tenants, aggregate users, aggregate request rate.
Tenant plan override. Optional per-tenant plan that overrides the org's default for that one tenant. Available on certain tiers (Pro and above).
A tenant without an explicit override inherits the organisation's plan. Most teams don't use per-tenant overrides — they're a feature for platforms whose tenants need different cap profiles.
Where to see plan state
Three surfaces:
Dashboard KPIs show current usage vs. quotas (when the data is wired).
Tenant detail page shows the per-tenant plan (either inherited or override).
Settings → Billing (when Billing is live for your plan) shows the org plan, current period usage, and upgrade options.
What changes when you upgrade
A plan upgrade affects three things instantly:
Quotas widen. You can immediately create more tenants, enroll more users, etc.
Feature flags flip on. Features that were locked become available across the org (SAML federation, custom domains, etc.).
Rate limits raise. Your API requests-per-minute ceiling goes up.
Billing is prorated from the upgrade timestamp.
What changes when you downgrade
Three things to know:
Quotas tighten at the next billing cycle, not immediately. If you're over the new cap, you'll see a warning banner until you trim.
Features stay accessible until the next billing cycle, then turn off. Any data you wrote using a now-locked feature stays (you don't lose users when SAML turns off, you just can't add more federations).
Rate limits drop immediately.
Where to go next
Deep-dive topics on plan tiers (the cap profile per tier) and rate limits (per-endpoint requests-per-minute) will land in a follow-up batch. For now, your current plan is visible from Settings, and per-tenant overrides show on each tenant's detail page.