AirMemoThe Marginalia · FAQ · 2026-09-23
The questions that keep coming back on calls, written in the margins of the memos that answer them. Every quote below is on the page it cites, verbatim.
Eight questions · every answer already on the site · every quote cited to its page and section
SSO is enterprise-triggered, and that is deliberate. It is deferred until the enterprise tier, and the pricing page says so in plain words:
“SSO is enterprise-triggered (deferred per the security posture; not yet claimed at Business).”
The security posture names the same deferral, alongside self-hosting:
“SSO and self-host (enterprise-triggered)”
If SSO is the gating item, the honest answer is that it lands with the enterprise tier.
There is not one yet, and the security page does not hide it:
“SOC 2 (deal-funded)”
The DPA says when it will exist:
“A SOC 2 report will be made available when the audit is obtained; it is not currently available.”
Until the audit exists, the compliance evidence is the append-only audit trail, the receipts, and the status page, all available on request under the DPA.
Roughly 1.5 to 2 times list price. Same codebase, one image, deployed where your fleet lives:
“Self-hosting runs 1.5–2× list. The same codebase, one image, deployed where your fleet lives.”
The mechanism page repeats the same number:
“Self-host runs 1.5–2× list.”
Enterprise tier is custom pricing on top: self-hosted on-prem with the DPA, compliance, and support.
Yes. Free, $0, up to 5 agents, with the basic push and the audit trail included:
“up to 5 agents … Basic push, 7-day audit trail: seed a fleet, see the receipts”
The pilot table on the mechanism page carries the same numbers:
“$0 (up to 5 agents) … 7-day audit trail”
Quota enforcement is technical and automated: exceeding a tier's limits suspends or rate-limits the service until you upgrade.
Today the cloud is split across two US regions, and the privacy policy does not dress it up:
“processing is split between US East (us-east-1, Postgres) and US West (us-west2, compute); it is not co-located, and selecting an eu region claim in the console records a contractual commitment to migrate, not a current storage fact”
The security whitepaper restates it with the same honesty:
“Cloud processing is split today: Neon Postgres runs in US East (us-east-1), Railway compute in us-west2. The two are not co-located”
Setting region: eu records a commitment to migrate. It does not move a byte today.
Cited: Privacy Policy, §5· Security & Trust Whitepaper, §4.1
Yes. It is a printed receipt of the service's state, rewritten every two minutes from the public status file:
“A printed receipt of the service's state, rewritten every two minutes. The stamp tells you when this page was written.”
When the service cannot answer, the page keeps serving the last written copy, and the DPA treats the page as compliance evidence:
“append-only audit trail, receipts, and status page are the compliance evidence”
Cited: Status, the ledger· DPA, §10
Not yet, and the mechanism page is explicit about it:
“The installer is held until the v0.1.0 public release (in the works), and there is nothing to download yet. No private links, no preview pipes.”
When it ships, the install command comes from the public release on GitHub, one static binary per platform, and the enroll step wires it into your agent.
Cited: Mechanism, Install
The hooks are. The security whitepaper draws the line:
“Hooks are MIT-licensed open source; the closed value is the governance control plane.”
The control plane is the product. The hooks are the MIT-licensed clients that ride your agents' lifecycle events.
A question that is not in the margins yet? It is answered on the pages this document cites, or it is not answered anywhere, and we will tell you which. Write to [email protected].