Accounts, plans, and data

Identity and recovery

• Password accounts must verify email before login. Verification links expire after 24 hours and can be reissued.
• Password-reset links expire after one hour, store only a digest in the database, and can be used once.
• OAuth linking requires the provider to prove the email address; an unverified provider email cannot take over a password account.
• Suspended and cancelled accounts are rejected by account-scoped APIs using the current database state, not only an older browser token.

Plans and feature locks

• Basic includes three saved projects, five messages per day, one analysis per day, and file uploads.
• Plus includes 50 projects, unlimited messages, five analyses per day, ten file extractions per day, report exports, simulations, Voice Agent, and company memory.
• Pro removes project, message, analysis, and extraction limits and adds Exergy Vault.
• A paid action is checked before its execution allowance is reserved. Asking a conceptual question about simulations or reports remains available; requesting the paid execution is what triggers the lock.

Billing management

Square hosted checkout is the billing authority for new subscriptions. Use Account Settings → Billing to inspect authoritative plan and usage state or schedule cancellation at the end of the current billing period.

Plan access changes only after a signed Square webhook reports a serviceable subscription. A checkout redirect by itself never grants a paid tier.

Stored data and deletion boundaries

• Production projects, uploads, runs, events, and conversation snapshots are durable and account-scoped in Postgres.
• Company and Vault free text is encrypted by the application before storage.
• A project diagnostic export includes project-scoped reconstruction data; it intentionally excludes process-global logs that could contain another customer’s activity.
• Individual projects can be deleted from the project list. Account Settings can cancel an active Square subscription, remove account-owned workspace data, and de-identify the account; minimal billing records remain where transaction integrity or legal obligations require them.