You connect your own provider credentials in settings — add, test, save. A key that passes its test is set active, and the runtime uses active keys only; there is no fallback to a credential you did not provide. Which model serves which seat is your call, per seat, on the models page — and so is the cost that follows from it.
The provider bills you directly at the provider’s prices. We meter every call to the cent and attribute it on the ledger. We never touch the money, which is what makes "we keep $0 of your usage" structural rather than a promise.
Everything is metered, including your company’s own metabolism — planning turns, memory consolidation, heartbeats, oversight sampling. Those run whether or not work happened, they cost real cents, and they appear on your ledger under their own labels. Hiding system overhead inside the flat fee would be the one opaque line on an otherwise glass invoice.
When a key stops working, the company stands down. Runs halt, the failure lands on the ledger as a stand-down with its reason, and we email you. Nothing improvises on a dead credential and nothing bills. The failure mode is stillness.