Every AI platform has a billing model. Most keep it vague enough that you only discover its edges when something goes wrong — an unexpected charge, a feature that silently degrades, an invoice you cannot reconcile. ToRun approaches this differently: the money model is explicit by design, and its rules are the same whether you are on the free tier or an enterprise plan.

This post walks through the full picture: where money comes from, where it goes, and how you can verify every cent independently.

Three funding sources, one priority chain

When you send a message or generate an image, ToRun resolves funding in a fixed order.

Free session budget is the first source. The free tier gives a recurring budget that refills throughout the day in increments. It is not a monthly ceiling you hit once and then wait — it is a rolling window designed to let you use the platform steadily without a wallet balance. When the current window is empty, the next refill interval restores it. The exact amounts and refill cadence live at /pricing.

Subscription allowance is a period-bound included budget that comes with paid plans. It is not "unlimited" in any real sense — it is a defined amount of AI spend included in your plan price, reset each billing period. When a call draws from the allowance, it reduces the remaining balance for that period.

Wallet balance is a prepaid pool you top up explicitly. Calls draw from it when the free budget is exhausted and no subscription allowance is available (or when allowance runs out mid-period). There is no silent auto-charge: the wallet only spends what you have deposited.

These three sources form a priority chain. The platform works through them in order — free budget first, then subscription allowance, then wallet — and the funding source that pays for each call is recorded on the billing record. If all three are empty, the call does not silently go through and bill you later; it is blocked with a clear message.

One billing record per call, always

The core invariant of ToRun's billing system: every single AI call writes exactly one billing record. Not one per session. Not one per day. One per call, at call time, with a frozen snapshot of the price that applied at that moment.

That snapshot includes the pricing row that was active when the call ran, the per-unit rate used, the currency and exchange rate captured at execution time, the fund source, and — for BYOK users — which billing tier applied. The snapshot also carries a per-modality cost breakdown: if a single call consumed text input, a cached prefix, and a vision attachment, the record shows the cost of each separately.

The practical consequence: if a provider changes its rates six months from now, your historical records are still fully verifiable. You can take any billing record, look up the rate it captured, and recompute the charge offline. The invoice does not depend on current pricing to be correct.

Billing records are append-only and cannot be edited in place. If a call partially fails, the original record stands and a sibling record documents the failure state. This is not a technical constraint — it is a deliberate audit design.

Funding-based feature gates, not tier flags

A common pattern in AI platforms: premium features are locked behind tier flags. You check whether the user is on a paid plan, and if not, you disable the feature entirely. This produces a hard cliff — one plan above the threshold gets everything, one plan below gets nothing.

ToRun does not use this pattern. Premium features — higher context windows, reasoning modes, access to higher-capability models — gate on whether you have funding available, not on which tier you are nominally on. Concretely: if you have wallet balance or an active subscription allowance with remaining budget, you can access these features. They draw from your available funds at the appropriate rate. If you have no funds, the feature is unavailable until you either top up the wallet or your allowance refreshes.

This means the free tier is not a deliberately crippled product. It is the same product with a smaller recurring budget. When that budget is present, you get the same routing and the same features. When it is gone, you get the same clear state: no funds, feature unavailable.

BYOK: routing through your own provider account

If you have negotiated enterprise contracts directly with OpenAI, Anthropic, Google, or another provider, BYOK (bring your own key) lets you paste your API credentials into an encrypted vault. ToRun resolves the right key per call without exposing it to application code; every read of the vault is audited.

BYOK operates under three billing tiers that trade platform fees against the degree to which calls route through your own account. The fee structure is documented at /pricing. Billing records for BYOK calls still capture the full snapshot — which key tier applied, what the provider returned as token counts, and what the net platform fee was — so the ledger remains complete even when the underlying cost is flowing through your own account.

Reading your usage

The usage dashboard shows your spend across all calls for any date range, broken down by mode (Chat, Image, Workflow, and others), by model, and by fund source. Each row in the ledger is a single billing record — you can expand it to see the full snapshot, including the pricing unit, the rate, and the cost per modality.

The export is a flat JSON or CSV of billing records with all snapshot fields intact. If you want to verify a charge, the data you need is in the record itself — no external reference required. The goal is that you never need to contact support to understand why a number is what it is.

That auditability is not a premium feature. It applies to every account, every call, from day one.