Plans, billing, and managed hours

Chalupa charges for the hosted control plane, not for cloud infrastructure. Droplets and volumes remain in the customer's DigitalOcean account and appear on the customer's provider invoice. Any provider cost shown in Chalupa is an estimate; it is not a Chalupa charge or a Stripe line item.

Plans

Community is the complete offline-first CLI and TUI. Solo and Crew add the hosted console, durable history, operational signals, managed-hour balance, and CI evidence.

What one credit represents

One credit represents one managed environment-hour: an hour during which the control plane receives signed activity from an environment. Compute that has been torn down does not consume credits.

Included credits:

• are granted only after Stripe confirms a paid invoice;
• expire at the end of their billing period;
• do not represent money and cannot pay a DigitalOcean invoice;
• never gate teardown, security signals, or cost-prevention operations.

Consumption starts in observation mode. Chalupa will show estimated usage and alerts before enforcement is introduced. Prepaid packs and overages remain disabled until real per-organization storage, egress, database, and support costs have been measured.

Stripe lifecycle

Checkout and the Customer Portal are hosted by Stripe. Chalupa accepts only a server-side allowlist of plan keys; the browser cannot choose an organization, price id, amount, or credit quantity. A Stripe Customer belongs to one Chalupa organization, never to an individual user.

Any member can inspect the plan. Only an organization owner can create a Checkout Session or open the Customer Portal. The internal platform organization is never billable.

The webhook endpoint verifies Stripe's signature against the raw request body. Event receipts contain only event metadata, not full payment payloads. Paid invoice credit grants and their event receipts are written atomically and are idempotent.

Owner and automation boundaries

The only human with global operations access is the verified user whose email matches CHALUPA_OPERATOR_EMAIL and who owns the fixed platform organization. CLOUD_ADMIN_TOKEN remains a bearer credential for bounded automation and compatibility; it does not grant human access to the global operations pages.

Unit economics

Because compute is customer-owned, the primary variable costs are Stripe, Vercel functions, Postgres writes/storage, email, artifact storage/egress, and support.

gross_margin =
  (revenue - Stripe - Vercel - Postgres - email - artifacts - support)
  / revenue

Initial COGS ceilings for an approximately 80% gross-margin target are $2 per Solo organization-month and $7 per Crew organization-month, before payment fees. Measure heartbeat and telemetry writes, artifact GB-days and egress, email volume, and support time before enabling overages.

The customer's provider-side savings can be estimated independently:

compute_avoided = environments × hourly_rate × (730 - active_hours)
net_savings = compute_avoided - chalupa_plan - incremental_storage

Persistent storage is subtracted only when it is incremental; if the baseline also required that data volume, the customer's effective savings are higher.

Illustrative savings scenarios

These examples use 730 hours per month and representative DigitalOcean Basic Droplet rates of $0.01786/hour for 2 GiB and $0.03571/hour for 4 GiB. They are planning examples, not a provider quote; check the current DigitalOcean pricing before making a purchasing decision.

The commercial promise should be measured against each customer's real baseline: how many environments would otherwise remain online, their size, their actual active hours, and whether persistent storage is incremental.