Every bundle and module, one surface.
27 modules compose six bundles on the same audited base, priced $49 to $299 each. Filter, compare, and build a stack in one place — take a single module for exactly the capability you need, a bundle for a whole domain, or the Everything bundle for the entire catalog. Own the source — no forced renewal.
Two different things are for sale here.
Modules, bundles, and the Everything bundle: pay once, own a perpetual license, ship it closed. The price never recurs, and it includes 12 months of updates from your purchase date — renewable per entitlement after that, at 40% of list per year. The two plans on this tab: pay yearly for the things that only make sense as a subscription — frameworks that change under you, credits that reset, a registry that keeps publishing. Stopping a plan stops new updates and credits. It does not revoke code you already have.
The math behind the number.
Two questions come up before checkout: how do you justify this internally, and why does the number look low for what it replaces. Here's the honest answer to both.
Fail-closed RLS, WORM evidence storage, an append-only audit chain, and a licensed billing/credits stack are weeks of senior-engineer time before your product ships its first feature. A bundle replaces that build with one price, paid once. Translating it for finance: the number buys the multi-week engineering build you’d otherwise staff, not a per-seat SaaS line item.
$1,649for the Compliance bundle reads too cheap to some buyers used to six-figure procurement. It isn’t a mispricing: it’s per organization, not per seat — no headcount to negotiate. It’s one time, not annual — no recurring multiplier. It’s sum-of-parts math — the same modules priced à la carte total $2,319. And the base substrate is Apache-2.0 — read it before you buy, instead of taking the price on faith.
What happens after 12 months?
The honest answer, up front: the source is yours forever, and only new updates are optional after the first year. Nothing you already own expires, breaks, or gets held hostage to a renewal.
A one-time license is perpetual. The code you bought does not expire, stop working, or phone home — license checks verify offline, for good. Non-payment can never brick what you already own, and neither can Caisson shutting down: the continuity terms grant you self-maintenance rights on top of the perpetual license.
The worry is abandonware — a bundle that goes stale after year one. The Developer plan ($499/yr) is the answer: security patches and updates keep flowing while it is active. It is continuity insurance, not a gate on code you own.
After the 12 months of included updates, renew a single entitlement for another year at a flat 40% of list — the Compliance bundle ($1,649) renews at $659. Skip it and you keep every version already delivered. Higher than a classic 15–20% maintenance contract because it buys a different thing: not a support retainer, but the product itself — every release your entitlement shipped that year.
Renewal buys releases. Support is separate, and it's already included.
Renewing a single entitlement keeps its updates window open — new releases, security patches, and for Compliance, refreshed framework mappings and evidence-pack regeneration. It doesn’t touch code you already have. Skip a renewal and every version already delivered keeps working, forever.
Support is a different thing entirely, and it’s included with every license from day one — email and Discord, a real person, business-days response. It’s not gated behind a subscription, and it doesn’t lapse if you skip a renewal.
Own the code once. Subscribe only for what moves.
The plans below don’t gate code you already own — they deliver the parts that keep changing after you buy it: updated framework mappings, regenerated evidence packs, and developer credits.Compliance Updates is not the Compliance bundle. The bundle ($1,649, one-time) is the code; Compliance Updates ($1,499/yr) is the subscription that keeps its framework mappings current.
For the team that has to pass the audit again next year.
- Auto-updating control mappings — SOC 2, HIPAA, EU AI Act
- Evidence-pack regeneration on every framework revision
- New-framework slots as regulations land
- Compliance support — email and Discord, business-days response
For the team building on the base every week.
- Annual codegen + AI-feature credit allotment
- Package updates while your subscription is active
- Private-registry pulls, entitlement-scoped
- Developer support — email and Discord, business-days response
Custom procurement, SSO, and support SLAs for regulated teams at scale.
What's open, what you're paying for.
The base substrate — kernel, auth, tenancy-rls, ui, billing, jobs, email, ai-config, mcp-server, registry-schema, observability, rate-limit, ds-manifest, and the generator tooling (cli, migrate, license-verify) — is Apache-2.0, free to use. What you buy above is the six bundles, the commercial modules (field-crypto, audit-worm, and the rest of the catalog), the registry service, and Compliance Updates — under the Commercial License.
What the license lets you do, and how support works.
Your license is for internal use in the products you build and sell — unlimited. Your customers use your product; they do not receive the Caisson source. You may not redistribute, resell, or republish the source as a kit, boilerplate, or competing library.
Support is email and Discord with a business-days response, included with every license — no separate SLA tier to buy today. Every purchase carries a 14-day money-back guarantee through Paddle, our merchant of record.
Subscriptions, briefly.
Do I need a subscription to use a bundle or module?
How many developers can use one license?
What happens to my code if I cancel Compliance Updates?
Is Compliance Updates the same as the Compliance bundle?
What do Developer plan credits cover?
What happens after 12 months?
How responsive is support, and is there an SLA?
Start building on the audited substrate.
The base is built and tested. Pick a module or a bundle, scaffold a project, and own the source from day one.
$ bunx @caisson-sh/cli@latest ✓ Caisson base substrate initialized ✓ Fail-closed RLS (FORCE) + cross-tenant isolation tests ✓ Append-only audit chain — SHA-256 verified ✓ Field encryption — per-tenant DEK (HKDF-SHA256) ✓ Standards gate — lint · test · golden-file