maximelb · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
diff --git a/docs/7-administration/billing/security-products.md b/docs/7-administration/billing/security-products.md
@@ -0,0 +1,51 @@
+# Email Security and Code Security billing
+
+Email Security and Code Security are generally available. **Subscribing to the
+extension is the purchase**. Subscribe to **Email Security** for mailbox
+protection or **Cloud Security** for Code Security, then configure the mail
+connections or repository scanning policies you want to use.
+
+## Pricing
+
+| Product | Monthly rate | Daily billing |
+|---|---|---|
+| Email Security | **$1 per protected mailbox** | That day's protected-mailbox count × **$1/30** |
+| Code Security | **$0.80 per protected repository**, plus the existing **Cloud Security base fee** | That day's protected-repository count × **$0.80/30** for repository usage |
+
+Usage is billed per day using a **30-day divisor**. Each protected mailbox-day
+or repository-day contributes the daily rate, so changes in coverage affect the
+days on which that coverage is protected.
+
+The existing Cloud Security base fee applies separately from daily repository
+usage charges.
+
+## Free-tier trials
+
+An organization is on the LimaCharlie free tier when its **configured sensor
+quota is 2 or less**. These organizations receive a limited **14-day trial**.
+Organizations with a sensor quota above **2** are on a paid plan and usage is
+billed.
+
+| Product | Trial limits | At expiry | Purge grace period |
+|---|---|---|---|
+| Email Security | **25 protected mailboxes per organization**, across all connections | Collection pauses; configuration is kept | **30 days** |
+| Code Security / Cloud Security | **2 provider connections**, **10 repositories per connection**, **5 container images per organization** for hosted scanning | Collection and hosted scanning pause; provider configuration and policies are kept | **7 days** |
+
+Data is removed after the purge grace period unless the organization moves off
+the free tier before the purge. The grace period starts when the cleanup process
+observes trial expiry; deletion runs asynchronously. Normal data-retention
+policies continue to apply during the grace period. Unsubscribing and
+resubscribing does not restart the trial.
+
+## Moving to a paid plan
+
+Raise the organization's configured sensor quota above **2** to move off the
+free tier. With the extension subscription in place, this lifts the trial
+limits, allows collection or scanning to resume, and starts usage billing.
+Upgrading before the purge cancels deletion scheduled because the trial expired.
+
+See [Email Security getting started](../../email-security/getting-started.md),
+[Email Security trial details](../../email-security/policy.md#plans-the-free-trial-and-the-mailbox-cap),
+and [Code Security getting started](../../cloud-security/code-security/getting-started.md)
+for setup instructions. [Billing options](options.md) explains organization and
+unified billing.
diff --git a/docs/cloud-security/code-security/getting-started.md b/docs/cloud-security/code-security/getting-started.md
@@ -13,7 +13,11 @@ nothing until a policy selects repositories.
 
 - The organization is subscribed to Cloud Security (`ext-cloud-security`). Without
   the subscription the Cloud Security pages show an enable screen, and the API
-  answers `403`.
+  answers `403`. **Subscribing is the purchase**: paid usage is **$0.80 per
+  protected repository per month**, billed daily at **$0.80/30 per repository-day**,
+  plus the existing Cloud Security base fee. Free-tier organizations (sensor
+  quota **2 or less**) get a **14-day trial**. See
+  [pricing and trial limits](../../7-administration/billing/security-products.md).
 - You have `cloudsec.get` and `cloudsec.set`. Connecting GitHub with the
   automatic setup below needs a few more permissions, listed in that section.
 - Creating or editing the provider record, including enabling it on that write,

diff --git a/docs/cloud-security/code-security/index.md b/docs/cloud-security/code-security/index.md
@@ -1,5 +1,11 @@
 # Code Security
 
+Code Security is generally available through the **Cloud Security** extension.
+**Subscribing to the extension is the purchase**. Paid Code Security usage costs
+**$0.80 per protected repository per month**, billed daily at **$0.80/30 per
+repository-day** on that day's protected-repository count, plus the existing
+Cloud Security base fee. See [security product billing](../../7-administration/billing/security-products.md).
+
 Code Security scans the source repositories behind your cloud estate and puts
 what it finds into the same risk-ranked worklist as your cloud findings. You
 triage a leaked credential or a vulnerable dependency the same way you triage a
@@ -13,6 +19,20 @@ pull requests that upgrade vulnerable dependencies.
     [Get started](getting-started.md) takes about ten minutes on GitHub: the
     console creates the GitHub App for you and turns scanning on.
 
+## Free-tier trial
+
+Organizations with a configured sensor quota of **2 or less** receive the
+Cloud Security **14-day trial**, with up to **2 provider connections**,
+**10 repositories per connection**, and **5 container images per organization**.
+The repository and image limits apply to hosted scans.
+
+At expiry, collection and hosted scanning pause. Provider configuration and
+policies are kept. Collected data becomes eligible for deletion after a
+**7-day purge grace period**, starting when expiry is observed. Raising the
+sensor quota above **2** moves the organization to a paid plan, lifts the trial
+limits and allows collection and scanning to resume. Upgrading before the purge
+cancels trial-expiry deletion; usage is then billed.
+
 ## What it finds
 
 | Engine | What it looks at | Finding class |

diff --git a/docs/email-security/ai-triage.md b/docs/email-security/ai-triage.md
@@ -1,6 +1,6 @@
 # AI Triage
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Email Security produces an explainable verdict for every message. AI triage is the
 optional second pass: an agent that reads a message the way an analyst would, pivots on

diff --git a/docs/email-security/api-reference.md b/docs/email-security/api-reference.md
@@ -1,6 +1,6 @@
 # API Reference
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 All Email Security routes live under
 `https://api.limacharlie.io/v1/mailsec/{oid}/…` and appear in the public OpenAPI

diff --git a/docs/email-security/automation.md b/docs/email-security/automation.md
@@ -1,6 +1,6 @@
 # Events & Automation
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Email Security is not a side-car product with its own event bus. Everything it
 sees becomes ordinary LimaCharlie telemetry, in the same lake as your endpoint,

diff --git a/docs/email-security/campaigns.md b/docs/email-security/campaigns.md
@@ -1,6 +1,6 @@
 # Campaigns
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 An attack that reached forty mailboxes is one thing that happened, not forty. A
 campaign is the cluster of messages the engine attributed to one attack, so it is

diff --git a/docs/email-security/cli.md b/docs/email-security/cli.md
@@ -1,6 +1,6 @@
 # Command Line Interface
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 The `limacharlie mailsec` command group covers the Email Security API surface:
 the coverage screen, the message index and drawer, the audited raw-EML download,

diff --git a/docs/email-security/custom-rules.md b/docs/email-security/custom-rules.md
@@ -1,6 +1,6 @@
 # Mail Rules
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Every mail detection rule lives in your organization's **`dr-mail` Hive**, one rule
 per record. **Email Security → Rules** shows the complete set: search and filter,

diff --git a/docs/email-security/data-residency.md b/docs/email-security/data-residency.md
@@ -1,6 +1,6 @@
 # Data Residency, Encryption and Data Flows
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 This page answers the questions a security or privacy review asks about Email
 Security: where your mail is stored, how it is protected, how long it is kept, and

diff --git a/docs/email-security/detections.md b/docs/email-security/detections.md
@@ -1,6 +1,6 @@
 # Detections & Verdicts
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Every message gets exactly one verdict, and the verdict always carries its
 reasons. This page explains how the reasons are produced, what the rules can see,

diff --git a/docs/email-security/getting-started.md b/docs/email-security/getting-started.md
@@ -1,6 +1,6 @@
 # Getting Started with Email Security
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Connect your organization's Microsoft 365 or Google Workspace mail to analyze
 messages for threats. You do not need to change mail routing or install software
@@ -13,7 +13,7 @@ an analyzed message**. You can configure automated responses later.
 
 ## Before you start
 
-Have these ready before enabling the trial:
+Have these ready before subscribing:
 
 | What you need | Where to get it |
 |---|---|
@@ -30,17 +30,20 @@ A **credential** is the key the product uses to access your mail provider. A
     Free-tier organizations can try Email Security for **14 days**, with up to
     **25 mailboxes**. The clock starts when you subscribe, and resubscribing does
     not restart it. Prepare your administrator access first. At expiry ingestion
-    pauses; data is removed 30 days later unless the organization moves off the
-    free tier. See [trial details](policy.md#plans-the-free-trial-and-the-mailbox-cap).
+    pauses; data is removed after a **30-day purge grace period** unless the
+    organization moves off the free tier before the purge. See
+    [trial details](policy.md#plans-the-free-trial-and-the-mailbox-cap).
 
-    During private beta, limits may be reported before enforcement is enabled.
-    Check the Overview trial/coverage information (or `coverage.entitlement`
-    from the API) for the standing actually in force in your organization.
+    The free tier means a configured sensor quota of **2 or less**. Raising it
+    above **2** moves the organization to a paid plan and lifts the trial limits.
+    See [pricing and billing](../7-administration/billing/security-products.md).
 
 ## 1. Enable Email Security
 
 In your LimaCharlie organization, open **Extensions**, find **Email Security**,
-and subscribe. Then open **Email Security → Settings**.
+and subscribe. **Subscribing is the purchase**: paid usage is **$1 per protected
+mailbox per month**, billed daily at **$1/30 per mailbox-day** on that day's
+protected-mailbox count. Then open **Email Security → Settings**.
 
 If an action is unavailable, ask your organization administrator for access.
 Connection management uses `mailsec_provider.get` and `mailsec_provider.set`;

diff --git a/docs/email-security/groups.md b/docs/email-security/groups.md
@@ -1,6 +1,6 @@
 # Message Groups & Cases
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A message group represents one email delivered to several recipients, including
 per-recipient personalization. Open

diff --git a/docs/email-security/index.md b/docs/email-security/index.md
@@ -1,6 +1,6 @@
 # Email Security
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 LimaCharlie Email Security protects Microsoft 365 and Google Workspace mailboxes
 from inside the same tenant, permission model, telemetry lake and automation

diff --git a/docs/email-security/internal-domains.md b/docs/email-security/internal-domains.md
@@ -1,6 +1,6 @@
 # Internal Domains and Message Direction
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Every message Email Security processes gets a `direction`:
 

diff --git a/docs/email-security/ioc-feeds.md b/docs/email-security/ioc-feeds.md
@@ -1,6 +1,6 @@
 # IOC & Reputation Feeds
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 The managed rule pack carries its own link and sender reputation signals. This
 page is about the other lane: mirroring a threat feed **you** have chosen, and

diff --git a/docs/email-security/mcp.md b/docs/email-security/mcp.md
@@ -1,6 +1,6 @@
 # MailSec with an AI assistant (MCP)
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 The [LimaCharlie MCP server](https://github.com/refractionPOINT/lc-mcp-server)
 lets an AI assistant review MailSec coverage, messages, campaigns and action
@@ -49,7 +49,7 @@ responses. Profiles select tools; each API still checks its own permissions.
 
 First subscribe to `ext-email-security` through the console, CLI or administration
 profile's `subscribe_to_extension`. Every MailSec endpoint, including onboarding
-instructions, requires the subscription and beta access.
+instructions, requires the extension subscription.
 
 Then use `mailsec_get_onboarding` with `provider: "m365"` or `"gworkspace"` to read
 current setup requirements. Workspace parameters `project_id`, `sa_email`,

diff --git a/docs/email-security/messages.md b/docs/email-security/messages.md
@@ -1,6 +1,6 @@
 # Messages & Triage
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 **Email Security → Messages** is the shared queue for individual messages and
 [message groups](groups.md). Choose **Messages** or **Groups** with the switch

diff --git a/docs/email-security/pipeline.md b/docs/email-security/pipeline.md
@@ -1,6 +1,6 @@
 # How a Message Is Processed
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 This is the page to read first if you are evaluating the product. It follows one
 message from the moment your provider says it exists to the moment somebody

diff --git a/docs/email-security/policy.md b/docs/email-security/policy.md
@@ -1,6 +1,6 @@
 # Policy Reference
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 Email Security is configured through Hive records. Anything the console can
 configure, `limacharlie hive set` can configure — so tenant onboarding and
@@ -517,8 +517,8 @@ Two consequences worth knowing:
 - A changed retention window first receives a report-only sweep. Deletion on
   subsequent sweeps requires the deployment's retention mode to be `enforce`;
   `report` reports candidates without deleting, and `off` disables the sweeper.
-  During private beta, ask the MailSec team to confirm deletion is enabled and
-  check sweep completion. Large backlogs drain over several sweeps.
+  Check sweep completion before treating cleanup as complete. Large backlogs
+  drain over several sweeps.
 - The horizons are independent. A flagged message's evidence can outlive its
   index entry (the usual case: 400 against 35), and if you set `flagged_days`
   *below* `message_days` the reverse happens — the index entry remains without a
@@ -603,7 +603,10 @@ server from your verified claims rather than taken from the request.
 |---|---|---|
 | The organization unsubscribes from Email Security | **30 days** later | Resubscribing at any point inside those 30 days |
 | The organization's free trial ends and it stays on the free tier | **30 days** later | Moving the organization off the free tier at any point inside those 30 days |
-| The organization itself is deleted | Immediately | Nothing — the organization no longer exists |
+| The organization itself is deleted | After a **7-day** grace period | The organization is found to exist again before the purge |
+
+Grace periods start when the cleanup process observes the condition. Deletion
+runs asynchronously after the grace period; normal retention policies still apply.
 
 None of them needs anyone to ask. The 30-day delay exists so that unsubscribing
 by mistake, letting a trial lapse over a holiday, or moving billing around is
@@ -633,26 +636,23 @@ re-sent for the new date.
 
 ## Plans, the free trial, and the mailbox cap
 
-Email Security is in private beta and must be available to your organization
-before you subscribe. For an enabled organization, what differs between a
-**trial** organization and a **paid** one is how long it runs and how many
-mailboxes it protects.
+Email Security is generally available. **Subscribing to the Email Security
+extension is the purchase**. Paid usage costs **$1 per protected mailbox per
+month**, billed daily at **$1/30 per mailbox-day** on that day's protected-mailbox
+count. See [security product billing](../7-administration/billing/security-products.md).
 
-An organization is on the trial when it is on the LimaCharlie free tier — the
-same line the rest of the platform draws, so an organization evaluating Email
-Security and Cloud Security at once gets one answer about what it is paying for.
+An organization gets the trial when it is on the LimaCharlie free tier: its
+configured sensor quota is **2 or less**. Raising the quota above **2** moves the
+organization to a paid plan, lifts the trial limits, and starts usage billing.
 
 | | Trial | Paid |
 |---|---|---|
 | Duration | **14 days** from the day Email Security was enabled | No trial duration limit |
 | Protected mailboxes | **25** | No plan-imposed mailbox cap |
 | Everything else — detections, remediation, retention, API, telemetry | Identical | Identical |
 
-These are the trial terms. During beta, a deployment can report limits before
-enforcing them. Read `coverage.entitlement` for your actual standing and
-enforcement; a reported limit alone does not prove ingestion has paused. Contact
-LimaCharlie to confirm trial or scheduled-deletion enforcement in your data
-region. Policy records and a CLI installation cannot enable server enforcement.
+Read `coverage.entitlement` for the trial countdown, mailbox coverage and any
+scheduled deletion.
 
 ### The 14-day clock
 
@@ -668,27 +668,27 @@ Read the remaining time from the `entitlement` block of
 
 ### What happens when the trial ends
 
-The same thing that happens when an organization unsubscribes, and for the same
-reason — the product stops, nothing is deleted yet:
+If the organization stays on the free tier at expiry, collection pauses and
+configuration is kept:
 
 - **Ingestion pauses.** No new mail is analyzed, and the mail connections are
   not renewed, so the provider's own watches expire on their own schedule.
 - **Nothing is deleted, and nothing is changed.** The connections, the policy
   records and every message already analyzed are intact and follow their normal
   [retention](#data-retention-and-deletion).
-- **Reading and acting still work.** An analyst can still search the queue, read
-  a message and remediate mail that was already ingested.
-- **The 30-day deletion clock starts**, with the notices described above.
+- **A 30-day purge grace period starts when expiry is observed**, with the
+  notices described above. Data is removed after that grace period unless the
+  organization upgrades.
 
-Moving the organization off the free tier resumes ingestion within about five
-minutes, and cancels the scheduled deletion. Mail delivered while ingestion was
-paused is not analyzed retroactively.
+Raising the configured sensor quota above **2** lifts the trial limits, allows
+collection to resume, and cancels trial-expiry deletion if the upgrade happens
+before the purge. Usage is then billed.
 
 ### The 25-mailbox cap
 
 A trial organization protects up to 25 mailboxes. The cap applies to the whole
-organization, across every connected mail tenant, and it works on **activation**
-only:
+organization, across every connected mail tenant, and limits **new mailbox
+protection** only:
 
 - Discovery still finds every mailbox in the tenant — the ones past the cap are
   reported as `discovered` rather than `protected`, so you can see exactly how

diff --git a/docs/email-security/provider-quarantine.md b/docs/email-security/provider-quarantine.md
@@ -1,6 +1,6 @@
 # Microsoft Provider Quarantine
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 **Provider quarantine** shows Microsoft delivery observations and hosted-quarantine
 release activity. Messages blocked before reaching a mailbox may never enter

diff --git a/docs/email-security/provider-setup/google-workspace.md b/docs/email-security/provider-setup/google-workspace.md
@@ -1,6 +1,6 @@
 # Google Workspace
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A Google Workspace connection reads and remediates Gmail through the Gmail API,
 using a **service account with domain-wide delegation**. There is no mail

diff --git a/docs/email-security/provider-setup/microsoft-365.md b/docs/email-security/provider-setup/microsoft-365.md
@@ -1,6 +1,6 @@
 # Microsoft 365
 
---8<-- "includes/email-security-beta.md"
+--8<-- "includes/email-security-availability.md"
 
 A Microsoft 365 connection reads and remediates Exchange Online mail over
 Microsoft Graph, using an **application-only** credential. There is no mail