Teams, plans & billing#
Everything in Tollan lives inside an organization. This page covers members and roles, plans and limits, usage metering, and how billing works.
Organizations#
An organization (org) is your account: the tenant boundary. It owns your devices, routes, certificates, and billing, and it isolates them from every other org. Your first org is created when you sign up.
You can belong to multiple orgs (e.g. personal and work) and switch the active one in the console. Resources never cross org boundaries.
Username#
Every org has a username, chosen at sign-up. The form checks it as you type and, if it is already taken or reserved, offers free alternatives with a number appended. It is the suffix of every address Tollan gives you: device-<username>.tollan.app for public services and device-<username>-<group>.internal for private ones. That is what keeps two accounts that both call a device plc-gw from colliding.
The username is fixed once the account exists: every address you have published derives from it, so changing it is a support operation rather than a self-service setting. Profile → Account shows it read-only. Ask Tollan support if you need it changed. Internal addresses then follow the new name immediately (agents pick it up on their next sync), while public addresses that already exist keep their current name so nothing you shared breaks.
Members & roles#
Open Members in the console (admins only) to see who can sign in, invite people by email, change roles, or remove someone. Each member has a role:
| Role | Can do |
|---|---|
| Admin | Everything: manage members, billing, devices, routes, and org settings |
| Operator | Manage devices, routes, certificates, and access rules |
| Viewer | Read-only visibility into the org |
Admins send, resend, and revoke invitations. The invitee gets an email with an accept link; the console also shows the link once so you can pass it on yourself if email is not set up. Links are valid for seven days. Someone without a Tollan login sets a name and password on the accept page and is signed in straight away; someone who already has a login just gains the new org in their switcher. The number of seats you can fill (members plus open invitations) is a plan limit.
Removing a member takes them out of this org only; their login stays if they belong to other orgs. The last admin of an org can be neither removed nor demoted.
Plans & limits#
A plan defines what your org may use. Limits typically include:
- Devices — how many you can register.
- Routes — how many exposures you can create.
- Egress — outbound tunnel bytes per month.
- Seats — how many members the org may have.
- Custom domains — how many of your own domains you can attach.
Limits are enforced as quotas when you create resources: registering a device or route past your plan's limit is refused with a clear message until you upgrade. There's a Free plan to start, with paid tiers for larger fleets and features like custom domains.
Usage and quotas#
The relay meters traffic per device and pushes periodic summaries to the control plane, which rolls them up into your org's monthly egress. The console shows current usage against your plan so there are no surprises. Device and route counts are checked live against your quota whenever you add one.
Billing#
Billing runs through Stripe. As an admin you can:
- Start a checkout to subscribe or change plan.
- Open the billing portal to update payment methods and see invoices.
- View your org's transactions/invoices in the console.
Checkout-first purchase#
You can buy a plan before creating an account: pick a plan, check out with just an email, and you'll receive a claim link. Sign up or log in and claim the purchased org to attach it to your account. This lets you pay first and set up later.
How entitlements change#
Your plan and status are only ever updated by a verified billing event from the payment provider — never by a browser redirect. The source of truth for "what plan am I on" is the provider's confirmed events, so a bookmarked success URL can't grant an upgrade.
An org's status is one of active, trialing, past_due, canceled, or suspended.
Past-due & suspension (dunning)#
If a subscription goes past_due, Tollan enters dunning and service for that organization is paused until payment is resolved — at which point it resumes automatically. Nothing is deleted and you don't have to re-provision anything.
Audit log#
Admins can review an audit log of who did what and when — device and route changes, member and billing actions, certificate operations. It's immutable and useful for compliance and incident review.