What it is
Roles on a Vendors collection
Viewer reads. Editor creates and changes. Admin runs the estate. Every password change is attributed and the previous secret is retained.
sst_citadel
The vault on a box you already own.
Vendor passwords do not belong in a shared spreadsheet or one admin’s browser. Citadel is the first host we will stand for a Founding Operator.
What it needs
Your box. Our walk-out.
Linux or Windows you already run. Cloudflare Tunnel if there is no public IP. Entra ID on Watch and Command. A Charter grant bound to that instance.
Plans
List prices for an annual grant. Install is a separate white-glove fee. Keep is free and still receives a Charter code.
| Plan | List | Includes |
|---|---|---|
| Keep | $0 / user | Self-host after we install. Viewer / Editor / Admin. Versions and audit. |
| Watch | $3 / user / month | Keep + Microsoft 365 sign-in + Cloudflare Tunnel ops. |
| Command | $5 / user / month | Watch + HA UI + shared PostgreSQL + Hermes profile. |
Limit we will write in the quote. Two-node HA shares a database. That database is the remaining single point of failure until the architecture changes.