Plans and limits

By the end of this page, you will know which plan opens which feature, what each counter really counts, and which exact response your integration receives the day it hits a limit. You will also know how to read your usage in the console before you get there.

#How SealTrust is sold

We sell every plan on quotation. No plan carries a public price, including the trial account. The console displays "On request" instead of an amount, and the negotiated amount lives in your contract.

You do not subscribe from a screen. Online subscription is closed. You go through a discussion with the team, then we put the subscription into service.

Four plans are offered in the catalog: Essentiel, named Essential in the English console, Prestige, Maison and Inside. A trial account also exists, and it is restricted: no digital passport, no API access, no visual customization. Write to contact@sealtrust.io to obtain one.

#What each plan contains

This table lists the rights read from the plan catalog. The public comparison on sealtrust.io/pricing carries a few more lines. The catalog goes up in tiers: each plan contains the previous one.

Maison and Inside carry no other fixed ceiling: certificates, brands, users and API keys are sized by contract there.

The four plans count pieces the same way, per calendar year. The first 6,000 of the year are included. Beyond them, each piece is priced. Beyond one million pieces in the year, the price is set on quote. No piece is refused for a matter of volume, whatever the plan. A brand opened by a partner under a reseller contract, and that partner itself, follow the same rule. It applies on the Compliance + Identity offer. On the Compliance offer, a brand creates no piece: see Compliance, or Compliance + Identity. Only the trial account keeps a monthly volume, with a refusal beyond it.

Four lines deserve an extra sentence.

The digital product passport is in every paid plan. It has stopped being a high end option. Only the trial account is deprived of it.

Visual customization is in every paid plan. It covers your logo and your two colors on the pages seen by your customers.

White label comes from the Inside offer, or from a reseller contract. It is distinct from visual customization. It removes the "Powered by SealTrust" mention from the passport, from the certificate page and from the certificate PDF, and it serves your consumer pages on your own domain. Only the consumer pages move to your domain. Neither the console nor the API. A brand opened by an Inside partner on its own behalf inherits it: it gets the entitlement from the contract that ties it to that partner, whatever its own plan. The entitlement does not lapse if the partner's plan changes later: your products are sold and your chips encoded, and losing it over a disagreement between two companies would make no sense.

A piece created on the Compliance + Identity offer keeps its identity. If your brand later moves to the Compliance offer, the person who holds the piece can still claim it with its purchase code, finish a claim already started, transfer it, accept or decline a transfer, read its NFC chip, ask for a repair and find it in their space. The right does not lapse if the offer changes later: the piece is sold with its identity, and taking that away from the person who bought it would make no sense. Only what is new stops: creating pieces, ordering chip encoding and issuing new purchase codes.

On the Compliance + Identity offer, NFC chip encoding is open in all four plans. On the Compliance offer, it is open in none: nfc_encoding is false, and the console shows a padlock instead of the encoder. QR alone incurs no encoding cost. The unit price of a chip is set in your quotation and billed by us, outside the console. No screen counts it.

#What the counters really count

Five counters exist. They do not behave the same way, and that is the most frequent source of surprise.

#Pieces, counted per calendar year

The piece counter starts from zero on 1 January, at midnight universal time. It counts the pieces created since that day.

Three clarifications that change the calculation.

The counter does not distinguish QR from the NFC chip. It counts every piece created in the year, whatever its identification method.

A destroyed piece still counts. It was created in the year, and it counts in that year.

A piece created again on the same token is not a new piece. It only counts once.

The trial account is the exception. Its volume is monthly: it counts the products created since the start of your billing period, or failing that since the first day of the month. A destroyed product leaves it, and a batch being processed already counts.

#Certificates, a stock at a given moment

The certificate ceiling covers the valid certificates you hold at that moment. A revoked or expired certificate leaves the count. Revoking a certificate gives its place back: a brand that has issued many and revokes some of them can issue as many new ones.

The ceiling is 1,000 certificates on Essentiel and 10,000 on Prestige. Maison and Inside carry none.

#Users and brands

These two ceilings are absolute, with no reset. You meet the user ceiling when you invite someone to your team: a pending invitation already takes a seat, and cancelling it or letting it expire frees it. The brand ceiling covers all the brands accessible to your account. Opening an additional brand goes through the team.

#API keys

The ceiling only counts usable keys: active and not yet past their expiry date. Revoking a key frees a place immediately, and an expired key no longer takes one, even if nobody has called it since. You can therefore replace a key without changing plan. To replace it without a break, you need one more free place, while both keys coexist.

#What exactly happens when you reach a limit

Nothing is degraded silently. Each limit produces a named error response, which your integration can recognize without reading a message in French.

#Volume exceeded

On the four plans, creating a piece is never refused for a matter of volume. Pieces beyond the included ones are priced. This applies on the Compliance + Identity offer. See Compliance, or Compliance + Identity.

Only the trial account receives this refusal on products. We then refuse the creation with HTTP code 403 and a body that gives the counter, the ceiling and the period.

{
  "detail": {
    "code": "QUOTA_EXCEEDED",
    "resource": "products",
    "current": 8,
    "additional": 5,
    "max": 10,
    "period": "monthly"
  }
}

The additional field only appears on batch creations: it is the number of items you are requesting. We refuse the whole batch. Nothing is partially created. On a single item creation, additional is absent.

The same code serves the absolute ceilings of the other resources: certificates, users and API keys. On those resources, period is absent, because the ceiling never resets.

#Feature absent from your plan

We refuse the call with HTTP code 403 and the name of the missing feature.

{
  "detail": {
    "code": "FEATURE_NOT_AVAILABLE",
    "feature": "webhooks"
  }
}

The feature names you may come across are api_access, webhooks, dpp, exports, nfc_encoding, custom_branding, erp_connectors and white_label.

One nuance on webhooks. Creating and modifying a subscription requires that your plan include webhooks. If your plan no longer includes notifications, you keep the ability to list your subscriptions and to delete them. So you can always clean up after a change of plan.

In the console, two menu entries lock depending on the plan. The Reports entry depends on exports. The Tools section, which gathers NFC encoding, depends on nfc_encoding. A locked entry stays visible, grayed out, with a padlock and a link to write to us.

You steer your notification subscriptions in two ways: from the console, under Settings then Developers, and through the partner API. Both paths write the same subscriptions. In the console, the subscriptions block grays out under a padlock when your plan does not carry webhooks.

#Identification method not allowed

A plan limited to QR refuses a creation that requests NFC, with HTTP code 403.

{
  "detail": {
    "code": "AUTH_METHOD_NOT_ALLOWED",
    "requested": "nfc",
    "allowed": "qr",
    "upgrade_hint": "Upgrade to Essential or higher for NFC authentication."
  }
}

The requested field returns the method that was evaluated. On a single item creation where you omit the method, it is null. In a batch sent from the console with no method, it is nfc.

On the Compliance + Identity offer, the four catalog plans and the trial account allow both QR and NFC. On the Compliance offer, no piece is created, neither by QR nor by NFC.

#Trial ended or subscription suspended

Two refusals cut off access without being tied to a volume. Both arrive as 403, and their body is a plain string.

These two refusals come from the console. The partner API never returns them. When your plan no longer carries API access, the partner API answers FEATURE_NOT_AVAILABLE on api_access.

An unpaid invoice suspends the plan's rights. Your data stays in place, and the public pages of the products you have already created keep answering.

#The API call limits

Three counters apply and stack: the throughput of your key, the aggregate throughput of all your brand's keys, and the key's daily quota.

#The throughput of your key, per minute

We measure throughput over a fixed 60 second window. The ceiling depends on your plan and is not published as a grid.

You do not have to guess it. The value that applies to your brand appears in the X-RateLimit-* headers of every accepted response.

When no ceiling is set for a brand, the fallback value is 120 calls per 60 second window.

On going over, the response is 429 and additionally carries Retry-After, expressed in seconds remaining in the current window, and never lower than 1.

#The aggregate throughput of your brand

A second counter adds up the calls of all your brand's keys, over the same window and with the same ceiling.

#The key's daily quota

Each API key carries its own daily quota, set when it is created. The console form offers 1,000 per day by default. A key created with no value is unlimited. The counter restarts from zero at the passing of midnight universal time.

This quota is consumed per item. A batch submission of 100 products consumes 100 units, in a single call. A sell-out declaration consumes 1. All the other partner API calls consume none, including the management of notification subscriptions.

On going over, the response is 429 with three headers: X-Quota-Limit, X-Quota-Remaining and X-Quota-Reset.

#When counting is unavailable

The three counters above rely on a counting service. If that service becomes momentarily unavailable, the API answers 503. It is a failure mode, distinct from the three limits. This refusal applies to the eight partner API endpoints, including the deletion of a notification subscription, which then deletes nothing. Try again a few moments later.

#The other fixed bounds

These limits do not depend on your plan. They are the same for everyone.

#The digital passport and your contract

The digital product passport is included in the four catalog plans. No console counter caps it, and no screen bills you for it. The planned volume appears in your contract, and an overage is negotiated with your sales contact.

#Seeing your usage before you get there

Further down the console dashboard, after the Analytics block, a single My plan card spans the full width.

It displays the name of your plan, the days remaining during a trial, then one bar per counter: products, certificates, users and API keys. Each bar shows your counter, your ceiling and a percentage. The bar turns orange at 80 percent and red at 100 percent. A missing ceiling is displayed as "unlimited". It is the only place where you read your certificate stock.

On the four plans, the products bar is titled "Pieces created this year". It compares your pieces of the year with the 6,000 included. It turns orange at 80 percent, to warn you before the priced pieces. It never turns red, because no piece is refused on the Compliance + Identity offer. A single line under the bar says so.

On the Compliance offer, the card counts no piece. One line says how the offer is billed: by the number of passports, that is the products online during the year and the lots created.

On a trial account, a projection appears under the bars when your current pace brings you to the limit in less than 30 days. It indicates the number of days remaining at the observed pace. Below 7 days, it turns red.

The Billing screen, under Settings, shows your current plan. The cycle, the subscription state and the list of invoices only fill in after an online payment. No screen opens that payment today, so those three values stay empty.

#Changing plan

Moving up or down a plan goes through the team. The button on the My plan card opens a pre-filled message to our address.

The Billing screen carries three buttons: terminate the subscription, cancel a termination already requested and open the payment portal. All three refuse the call as long as no online payment has opened your subscription. To terminate or change payment method, write to us.

Two points deserve to be anticipated.

We re-read your rights on every call. They therefore open and close as soon as your plan changes. If you move down a plan and lose webhooks, your existing subscriptions stay readable and deletable.

Revoke the API keys you no longer need in order to find headroom before your next key creation.

#Going further

• Partner API overview for authentication and the list of endpoints.
• Create products for the detail of single item and batch creations.
• Receive events by webhook for what the subscriptions cover.
• Get started with the console for finding the screens mentioned here.