Billing & Subscription
Purpose: view and manage your plan, payment method, and invoices.
For what CMDash records about money and how to get it into an accounting system, see Billing & Accounting Export — this page covers the Settings UI only, and does not repeat that content.
Viewing and managing your plan — /settings/billing
Accessible to Owner or Admin, not Owner-only. The page's own source comment states billing is "admin-only (OWNER / ADMIN)."
Shows current tier, seat/integration usage, next renewal, and payment method. Manage Subscription opens a Stripe-hosted Billing Portal session — invoices and payment-method changes happen inside Stripe's portal, not a CMDash-rendered invoice list.
Choosing a plan from measured usage — /settings/billing/choose
Owner or Admin, same gate as the page above. Where /settings/billing
shows all four tiers and no opinion, this page leads with one recommendation
and puts the rest below it.
The recommendation is measured, not estimated. CMDash counts your members, your connected integrations and the frameworks you have controls assessed against, then looks at which paid capabilities actually produced work in the last 14 days — risks written to the register, AI narratives generated, POA&M items, crosswalk corrections, approval requests, playbook runs and so on. It then names the cheapest plan whose limits hold those numbers and whose feature bundle includes everything on that list. Nothing is inferred from your industry, your company size, or what a comparable customer bought.
Two things follow from measuring rather than guessing, and both are worth knowing:
- It can under-recommend. A capability you read every day but never write to leaves no record, so it does not appear. The recommendation errs toward the cheaper plan; every other tier is listed below it and can be bought in one click if you know about growth the last 14 days cannot see.
- "What you lose without a plan" is measured against the tier you fall back to, which for a lapsing trial is the Free plan — not against the plan being recommended. That panel is empty when there is genuinely nothing at risk, which is the normal state for an organization already on a paid Command plan.
Annual billing is pre-selected because it saves 15%, and the saving is shown in dollars next to the toggle rather than discovered after you commit. Switch to monthly before continuing and that choice carries into Stripe Checkout.
The DAY_27 ("3 days left") and trial-ended emails both link here, as does the trial countdown chip in the top bar — which from seven days out also carries the count of capabilities you would lose.
The customer portal's Billing page — cmdash.com/portal/billing
Separate from /settings/billing above, and reachable from the profile menu
("Customer portal"). It shows the same subscription and the same plan table,
and its Manage in Stripe button opens the same Stripe-hosted portal
session. Owner and Admin only; a Viewer sees the plan table with no actions.
Two states surprise people:
- "No Stripe subscription on this organization" does not mean the workspace has no plan. A tier can be set directly by CMDash without a Stripe subscription ever existing, which is the case for every workspace today. Your entitlements come from the tier, not from Stripe.
- A test-mode notice. When the deployment is configured with a Stripe test key, the page says so, and neither Checkout nor the billing portal can take a real payment.
What things cost
List prices, generated from the enforced configuration — see
the pricing and entitlement matrix,
which is regenerated from TIER_CONFIGS and APPROVED_PRICE_TABLE and
drift-checked in CI, and the public
pricing page.
| Item | List price |
|---|---|
| Starter / Essentials / Command, billed annually | $149 / $499 / $1,499 per month ($1,788 / $5,988 / $17,988 a year) |
| Starter / Essentials / Command, billed monthly | $175 / $587 / $1,764 per month |
| The Skeptic add-on | $299 per month |
| Trust Center add-on | $199 per month |
| AI run overage | $0.10 per run beyond the included allotment |
| Monitored vendor overage | $29 per vendor per month beyond the allotment |
| Managed (vCISO client) workspaces | $49 / $39 / $29 / $19 per workspace per month, banded by total count |
Enterprise is custom-priced. API calls are counted for your usage dashboards and are not billed.
Add-ons and usage overage are billed only when usage billing is switched on for your account; it is off by default, and the metering runs in a reconcile-only shadow mode until it is enabled.
Free trials and usage overage
Starter, Essentials and Command can each start with a 30-day free trial through Stripe Checkout. A card is required, and the trial converts to the plan and billing cadence you chose unless you cancel before it ends; a cancelled trial, or one whose first charge fails, moves the workspace to the Free plan. We e-mail the owners 7 days before the first charge.
No usage overage is billed during a trial: AI runs stop at the plan's included allowance, and nothing is written to the billing ledger while the subscription is trialing. Note the one edge: monitored-vendor and managed-workspace overage is a monthly snapshot taken once per calendar month. If the trial converts part-way through a month, the first snapshot after conversion counts that whole calendar month — trial days included — at the count on the day it is taken.
AI runs included in your plan
Every AI feature draws on one monthly allowance of AI runs: policy drafting, remediation suggestions, policy gap analysis, executive summaries and the weekly executive briefing, the board and posture narratives, Ask your posture, questionnaire AI, AI mapping of evidence and detection rules, and Trust Center Q&A. One run is one AI call. It is counted the moment the model answers, even when that answer then cannot be used (a draft cut off at its length limit, a reply that fails a check), so an action that fails can still use a run. A call that fails before the model answers does not use a run, and a prepaid credit that was covering it is returned.
A few actions use several runs: generating remediation suggestions makes one call per risk (5 by default, at most 20), a policy gap analysis one call per 40 controls (at most 5), and Ask your posture, Trust Center Q&A and the board narrative regenerate an answer once when the first one fails its check, so one answer can use two runs. When the allowance runs out partway through, the action stops there and keeps what it has already produced. The allowance comes from your plan and is enforced:
| Plan | AI runs per month |
|---|---|
| Free | 0 (AI features are not included) |
| Starter | 25 |
| Essentials | 75 |
| Command | 300 |
| Enterprise | 1,000 |
- The month is the UTC calendar month; the count resets at 00:00 UTC on the 1st.
- A 30-day trial gets Starter's allowance once, for the whole trial, not once per calendar month: a trial that spans two months still has 25 runs in total, and the refusal says when the trial ends. If you choose a plan during the trial, your plan's monthly allowance applies from then on, and the runs the trial used earlier in that calendar month count toward it.
- Once the month's runs are used up, AI calls are refused until the reset, and the refusal names the plan that includes more runs. For the AI you start yourself (drafting, suggestions, gap analysis, summaries and briefings, questionnaire AI, a narrative refresh), prepaid AI credits can cover further runs, or, with The Skeptic add-on and usage billing switched on, they are billed as overage. Ask your posture, Trust Center Q&A and automatic AI never use credits or overage; they wait for the reset.
- Automatic AI (work nobody started) counts too, and it runs only while less than half of the month's allowance is used, so it cannot spend the runs your people need. It is the daily AI narrative (Command and above, one run a day), the daily AI audit-readiness review (The Skeptic or the AI governance pack, one run per framework that has policies linked to its controls), AI mapping of new evidence to controls (The Skeptic, one run per new evidence item) and detection mapping during an integration sync (Command and above, one run per new unmapped detection rule, at most 250 a sync). Past half the allowance these wait for the next month; a detection rule still gets a keyword-based proposal for you to review.
- Public Trust Center Q&A (answers to visitors of your Trust Center) may use at most a fifth of the allowance. Past that, a visitor's question goes to your team as a questionnaire request, and your own staff keep the rest.
- If the service cannot count AI use for a moment, AI calls are paused and refused with "try again shortly" rather than run uncounted.
- AI credit top-ups are offered on this page only where AI can be used: not on a plan without AI, and not until AI features are switched on for the service. They are sold on paid plans: during a trial the trial's own AI runs apply, and top-ups become available once you choose a plan.
- On a self-hosted install the allowance is not metered: AI calls use your own model provider key.
Support tiers and the SLA
Every plan includes support; the channel and the commitment scale with the tier — Starter and Essentials get email support (2 business days / 1 business day first response), Command gets a priority queue (8 business hours), and Enterprise gets a named CSM with a 4-hour first response and a 99.9% uptime SLA carrying service credits. These are enforced the same way every other limit in this guide is — see the pricing and entitlement matrix for the generated table and the public Service Level Agreement for the full definitions (business hours, first response vs. resolution, how uptime is measured, and the service-credit schedule).
Enterprise contract billing — /enterprise-billing
New, separate from the page above: a dedicated Enterprise-tier page for annual contract billing — create a contract with an annual value, start/end dates, payment terms (e.g. NET_30), and a billing contact, then track its invoices from the same page. This did not exist as a described feature in the earlier version of this guide.
Referrals
/settings/referrals (OWNER/ADMIN) gives your organization one referral code
and the link that carries it: https://<your-app-host>/register?ref=CODE.
When an organization signs up through that link and pays its first
invoice, one month of their plan at list price is credited to both
Stripe customer balances — yours and theirs — reducing each account's next
invoice. Nothing is credited at signup: a trial that never converts costs
neither side anything, and a referral sits as PENDING on the page until the
payment happens.
The reward is one month of the referred organization's tier, not yours, so referring a Command customer earns a Command month even from a Starter account. A referring organization can earn at most 12 credited referrals in a rolling 12 months; the page shows where you stand against that cap.
Three rules are checked when the signup happens and are recorded on the
referral as a REJECTED row with a reason, rather than being hidden: you
cannot refer yourself, you cannot refer an account whose owner uses your own
email domain, and a reward cannot be applied once your own subscription has
ended (there is no account left to credit). None of these is ever an error
for the person signing up — a wrong, mistyped or ineligible code never blocks
a registration; it simply carries no referral.
The list deliberately does not name the organizations you referred. That is their data; the rows tell you what happened to each reward, which is the part that is yours.