What Free keeps, forever

kubelatch has a Free edition with no sign-up and no expiry date: it isn't a trial or a stripped-down version, though its audit only reaches back 24 hours. Below I go through exactly what it includes, why I wrote it into the license, and what Pro is for.

The promise

Free is the whole product with some limits. Without a license key, each kubelatch instance gets:

• 2 clusters. Any registered cluster counts, whatever its status; deleting one frees its place.
• 5 people. Every enabled person counts, administrators and break-glass accounts included. Disabling someone frees their place.
• Bots, CI trust rules, AI agents, permissions and credentials, with no limit. Bots, pipelines and agents never count as people.
• The six system roles: viewer, developer, debugger, secrets-reader, admin and cluster-admin.
• Audit of the last 24 hours.
• Community support on GitHub Discussions.

It's the same proxy, the same impersonation and the same per-request audit as in Pro. What changes is how many, and how far back the audit goes. The full table is in Editions and license and on Pricing.

A limit only stops a new registration. Inviting a sixth person, or registering a third cluster, is refused with a message that says why. Nothing that already exists is cut: the proxy, permissions, credentials, clusters and people keep working.

Free is also where Pro lands if it ever ends. A paid key carries on for 30 days of grace after its expiry date, time to install the new one; a trial has no grace. After that, the Free limits apply to new registrations only. Custom roles you already made keep working and can only be deleted, and audit older than 24 hours is kept, not served, until a key is installed again. A key that doesn't verify leaves kubelatch in Free with a warning; it never stops it.

The limit worth knowing before you rely on Free is the audit: 24 hours. That's enough to see what happened this morning, not to answer an auditor's question about last quarter. And in an instance that never had a key, records older than 24 hours aren't only hidden: they're deleted.

Why it is written down

A free tier that shrinks later is a trap. You build on it: habits, pipelines, the way a team works. Then the limits tighten, and you pay or move on someone else's schedule. Promising on a pricing page that this won't happen is easy. A promise is worth more where it binds.

So I put it in the license. Section 4 of the End User License Agreement (the text kubelatch ships as LICENSE in its container image, its Helm chart and its public repository) commits to it in plain words: what is in the Free edition stays in the Free edition, and its limits will only ever be loosened, never tightened. The same section says that a limit only stops a new registration, and that nothing that exists is cut.

The docs repeat these commitments at the end of Editions and license. Written down doesn't mean frozen, though. If the limits change, they change in one direction: they get looser.

What Pro is for

Pro is for when a team outgrows those numbers, or needs its audit for longer. It's the same product with a license key, and it adds:

• Unlimited clusters.
• As many people as seats.
• Audit kept as long as you configure: 90 days by default, or forever.
• Custom roles, on top of the six system roles.
• E-mail support in business hours, and guided upgrades.

It costs $15 per person per month, billed yearly, with a minimum of 5 people. Pro can't be bought yet; when it goes on sale, it starts with 30 days free: you give a card, and it's charged when the trial ends unless you cancel first from the subscription portal. Bots, pipelines and agents don't take seats in Pro either.

What Pro never does is take something from Free. No feature of Free moves to Pro: if it's in Free today, it stays there. Pro lifts limits and adds custom roles; it doesn't hold back parts of the product.

No call home

kubelatch doesn't call home to check its license. A Pro key is a signed token that kubelatch verifies against public keys built into its binary, at startup and every hour, without calling any service and without sending anything out of your instance. That's why it works in air-gapped installations, and why Free and Pro behave the same on a network with no way out.

There's no telemetry, as Pricing and Privacy state. kubelatch collects nothing for Picaporte Labs: the identities, permissions and audit records it handles live in your database, in your infrastructure, and I have no access to them.

One request does leave, and you should know about it. Once a day, kubelatch reads a small public file on docs.kubelatch.com that names the latest version, so it can tell administrators when there's a new one. The request carries no identifier, no version and nothing about your instance; like any request, the docs server sees the public IP it comes from. KUBELATCH_UPDATE_CHECK=false turns it off, and in an air-gapped installation you can point it at an internal mirror (see Know when a new version is out).

Try it

Free is what you get the moment you install kubelatch, with no key. The local tutorial is the quickest way to see it: a disposable kind cluster on your machine, local passwords, about fifteen minutes plus the first downloads. Beside the name at the top of the sidebar you'll see “Free”; it opens “Edition”, which says where your instance stands against these limits.

When Free stops being enough, Pricing has the numbers and the Pro waiting list. kubelatch is made by one person, in Spain: if something here doesn't match what you see when you try it, write to me.