Team, usage and billing

Manage who can use your Logthread workspace and what it costs to run. This page explains roles, how to invite a teammate, how retention and your plan work, what the Usage page meters, how plan changes are requested, how AI credits for Pari are counted, and what the audit log records.

What can each role do#

Every member has one role per workspace. The Team page also lists these under What each role can do. The full matrix, including how AI agents reach each action through MCP, is on Roles and permissions.

Invite a teammate#

1. Open Team and click Invite member (admins and owners only).
2. Enter the Email address, pick a Role, and click Send invitation.
3. Logthread emails a single-use link. The link is only ever sent by email and expires after 7 days.

Rules:

• You can invite up to your own role, never Owner. An owner can invite admins, members and viewers.
• Your plan limits the number of members, and pending invitations count toward it. See Team members on the Administration → Usage page.
• A workspace can send 50 invitations a day.
• The invited person must sign in or sign up with the same email address the invitation was sent to.

Revoke or resend an invitation#

Pending invitations are listed under Pending invitations with a status and expiry date.

• Revoke: click Revoke, then confirm. The link stops working.
• Resend: there is no resend button. Invite the same email address again. The earlier pending invitation is replaced, its old link stops working, and a new email with a fresh 7-day link is sent.

Change or remove a member#

• Change a role: on Team, use the role dropdown in the member's row and confirm with Change role.
• Remove a member: click Remove, then Remove member. They lose access immediately. Their ingest keys keep working until you revoke them under Keys → Ingest keys.
• Leave a workspace: click Leave on your own row. Anyone can leave except the last owner.

Who can change whom:

• Admins can change or remove only members ranked below them, and can assign only roles below their own.
• Owners can change anyone, including promoting another owner.
• A workspace always needs at least one owner. The last owner cannot be demoted or removed until another owner is added.

How do I sign in#

You can sign in with email and password, or link a Google or Microsoft account. Google and Microsoft appear only when your Logthread server has them configured. Under Settings, Security, Sign-in methods, use Connect Google or Connect Microsoft to link one, and Unlink to remove it. Your account always keeps at least one sign-in method.

Changing your password signs you out everywhere else. Active sessions lists your devices, and Sign out everywhere ends them all.

Two-factor authentication#

Two-factor authentication asks for a six-digit code from an authenticator app (any app that supports time-based one-time passwords, such as 1Password, Authy or Google Authenticator) after your password.

1. Open Settings, Security, Two-factor authentication and select Set up.
2. Scan the QR code with your authenticator app. If you cannot scan it, enter the secret shown under the code instead.
3. Enter the six-digit code your app shows and select Turn on.
4. Save the ten recovery codes that appear. They are shown once, and each works one time if you lose your device. Select I have saved them when you have.

Turning it on signs you out of your other devices. From then on, signing in with your password asks for a code, and so does a password reset. A code works once, so wait for the next one if you need to sign in twice quickly. Signing in with Google, Microsoft or single sign-on is not asked: your identity provider handles it.

To turn it off, select Turn off and enter your password and a code or recovery code. New recovery codes replaces your recovery codes with ten new ones. Wrong codes are limited to 10 per 15 minutes and count toward the account lockout. Each change is recorded in the audit log as mfa.enabled, mfa.disabled, mfa.recovery_used, mfa.recovery_regenerated or mfa.failed, and you get an email about it.

Owners can select Require two-factor for everyone in the same page, once they have turned it on themselves. Members who sign in with a password and have no two-factor yet are taken to set it up before they can open anything else (mfa.policy_changed records the change). The page lists who has not set it up. Members who sign in with Google, Microsoft or single sign-on are not affected. Logthread staff accounts must have two-factor on to use the platform console.

Security keys and passkeys#

You can use a hardware security key (a YubiKey, for example) or your device's own lock (Touch ID, Windows Hello, a phone) as the second step instead of, or as well as, an authenticator app.

1. Open Settings, Security, Security keys and passkeys.
2. Select Add a security key, give it a name you will recognise, enter your password and follow your browser's prompt.
3. The first security key turns two-factor on: save the ten recovery codes that appear. Later keys need no new codes. You can register up to ten keys and passkeys.

When you sign in with your password, the next step offers Use a security key (and your authenticator app, if you have one). A recovery code works for both. To rename a key or passkey, select the pencil next to its name, type 1 to 60 characters and press Enter; this needs no password. Wrong attempts are limited to 10 per 15 minutes and count toward the account lockout. To remove a key, select Remove and enter your password. Removing your last second factor turns two-factor off, so it also asks for a recovery code, and it is not allowed while a workspace you belong to requires two-factor: add another key or an authenticator app first. If a key's signature counter ever goes backwards, which can mean the key was cloned, the sign-in is refused and webauthn.clone_suspected is recorded.

Passkeys sign you in without a password. Select Add a passkey on the same page (confirm with your password, or an existing passkey), then choose Sign in with a passkey on the sign-in page; there is no email to type, and the browser may offer your passkey in the email field. A passkey checks you on the device (fingerprint, face or PIN), so it is not asked for a second factor. It is held to the same rules as a password: the account lockout applies, and a workspace that enforces single sign-on still blocks members who sign in with a passkey (owners can still get in as break-glass). A passkey does not count as the second factor a workspace may require. Accounts that have no password (Google, Microsoft or single sign-on only) must have two-factor on before they can add one. Changes are recorded as webauthn.registered, webauthn.renamed and webauthn.removed, and adding or removing one sends you an email.

Use passkeys only. A passkey is already a full sign-in, not a second factor. To stop the password working as a way in, open Settings, Security, Primary sign-in and select Use passkeys only, then confirm with a passkey. Your password stays stored, so you can turn it back on, but it no longer signs you in: a stolen or phished password, an authenticator code and the emailed reset link cannot start a session. Other devices are signed out. Google, Microsoft and SSO sign-in stay as they are.

Save the recovery codes it shows if you have none. If you lose every passkey, sign in with your password: the next step takes a recovery code, and each code works once. From there, add a new passkey. Keep a second passkey or a synced one so this is rarely needed. Logthread refuses to remove your last passkey while password sign-in is off.

An account that signs in with Google or Microsoft has no password, and adds its first passkey with no password at all: do it within ten minutes of signing in.

Workspace name#

Owners and admins rename the workspace in Settings, under Workspace details: select the pencil next to the name, type 1 to 80 characters and select Save. The new name shows everywhere at once and the change is recorded in the audit log as workspace.renamed.

Time zone#

Each workspace has a time zone, UTC by default. Admins and owners change it in Settings, under Time zone, by picking an IANA name such as Asia/Kolkata. The change is recorded in the audit log.

Times in tables, drawers, chart axes and tooltips, and the time range picker use the workspace zone. Alert notifications and emails show times in it with the offset, for example 2026-10-28 10:05 IST (UTC+05:30).

Anyone can switch their own view from the clock menu in the top bar: Workspace (the default), Local (your browser's zone) or UTC. The choice is remembered per browser. Ingested data and API timestamps stay in UTC.

Change data retention#

Retention is how long logs, traces and metrics are kept. Owners set it under Settings, Data, Data retention.

• Pick a Retention period and click Save. Choices go up to what your plan allows. If you need longer retention than your plan allows, contact Logthread and we can arrange it for your workspace.
• Lengthening applies to new data and to existing data that is still stored.
• Shortening permanently deletes data older than the new period. Logthread asks you to type the workspace name to confirm.
• Other roles see the current value but cannot change it.

What does the Usage page show#

Open Administration → Usage to see metered use for a month. Use the month picker to go back, and Export CSV to download the daily numbers. Custom range shows totals and a daily table for any span of up to 92 days (UTC days), across months.

• Plan: what is included each month, the daily ingest cap, retention, team members and ingest rate.
• Month-end projection: your estimated total for the month, based on month to date plus the recent rate. It is marked Estimate until the month is final.
• Ingested: data received by Logthread, split into logs, traces and metrics, with a daily chart and a table.
• Forwarded to storage, Stored, Scanned by queries, Queries: what was written, kept and read.
• Rejected records: records storage refused. Under it, Rejected by storage lists them by reason once storage reports them: Older than your retention, Not valid, Too large and Not stored. Counts are for the month and also show how many requests were affected.
• AI credits: your Pari balance (see below).

Before a billing period is finalised, Logthread checks each day: the bytes it sent to storage against the bytes storage counted as received, in total and for logs, traces and metrics, once storage has finished counting the day (shortly after midnight UTC). A day that differs by more than 5% is reviewed by Logthread staff before the statement is issued; you do not need to do anything. Record counts are compared too, for information only.

Warnings appear at 80% and at 100% of the daily cap or the included monthly amount. If your plan changed during the month, the included monthly amount is the sum of each day's plan allowance, and the warning emails use the same figure as the Usage page. If your workspace is billed under a contract, the emails point to the contract estimate on the Usage page instead of plan prices. Reaching the daily cap refuses new data until 00:00 UTC. Day boundaries are UTC and sizes use base 1000 (1 GB = 1,000,000,000 bytes). Numbers update about every five minutes.

Which services use the most data#

The By service card on the Usage page shows, for the selected month, how many records (logs), spans (traces) or points (metrics) each service.name sent and how many bytes, with each service's share. Switch between Logs, Traces and Metrics. It lists the top 50 services by size and folds the rest into "Other services". Members, admins and owners can see it.

The sizes are measured as data arrives, the same way as the metered totals above, so the services add up to what you are billed for. Records without a service.name are listed as "(no service name)", and Prometheus remote write as one row. The split by service starts on 4 November 2026; earlier days count in the totals only.

For each service, Open in Explore searches service:<name> and Drop or sample with a pipeline opens the pipeline library, where you can add a route for that service to drop or sample noisy records.

How does my workspace change plan#

Payments are not enabled in the app, so there is no checkout and nothing is charged by clicking a button. A plan change is a request that Logthread staff review.

1. Open Administration → Usage, then Change plan on the Plan card. Owners and admins can submit; others are asked to contact one.
2. Choose a plan, optionally add a Note for Logthread, and click Send request.
3. The card shows Request pending. You can Update request or Withdraw request while it is pending. There is one open request per workspace.
4. When Logthread applies or declines it, the workspace owners get an email. A declined request shows the reason on the card.

When a plan is applied, the workspace's limits change. Compare plans under Compare plans on the Usage page. Prices shown there are for planning only, so check the page for current figures. If a plan has a lower retention limit, retention is shortened to match it.

What does the Billing page show#

Billing is visible to owners and admins. If your workspace is linked to a contract, it shows:

• Contract: who is billed, the billing email, the effective dates, the billing period and the rate per meter.
• This period: an estimated total so far, marked Estimate.
• Usage against your contract: each meter with quantity, included amount, billable amount, rate and estimated cost.
• Statements: final statements for closed periods, each with a CSV download.
• Extended retention: keep logs longer than your plan, on paid plans (see below). This card shows for every workspace, with or without a contract.

Amounts are computed from Logthread's usage meters. There is no card on file and nothing is charged automatically. If no contract is linked, the page says No contract on this workspace and the workspace is billed by its plan.

Several workspaces on one contract. A contract can cover several workspaces. The estimated total, the per-meter quantities and amounts, and the statement totals are for the whole billing account, so an owner or admin of any one of its workspaces sees those account-wide totals. Usage and names of workspaces they are not a member of are never shown: those lines read Other workspace. When a contract is linked, the Usage page shows the contract estimate (to owners and admins) instead of plan prices.

Moving a workspace to another contract. Each statement bills a workspace only for the days it belonged to that billing account. If Logthread moves a workspace to another account in the middle of a period, the period is split by day (UTC): days before the move stay on the old account and the move day onwards goes to the new one. Seats are billed by the account that has the workspace at the end of the period. A seat is a member of the workspace at the last moment of the period, so removing or adding a member later never changes a period that has ended. Periods already closed are never moved.

Extended retention#

Each plan keeps logs for a set number of days. Extended retention is an add-on for paid plans (Starter, Growth and Enterprise) that keeps them for 180 or 365 days instead. It is not available on the Free plan.

Price. $0.05 per GB-month of data stored beyond your plan's retention. Data inside your plan's own retention is not charged for this. On Growth (30 days), a 365-day add-on charges for the data that is between 30 and 365 days old.

How to request it. Only the workspace owner can. Open Billing, find Extended retention, choose 180 or 365 days and read the estimate, then confirm. You can add a note for Logthread, and you can withdraw the request while it is waiting.

Logthread reviews the request. When it is approved, your retention ceiling is raised to the add-on days, your retention is set to that number of days right away, and the owners get an email. You can choose a shorter retention in Settings → Data: from that day the add-on is billed only for the data actually kept, which is nothing once your retention is at or below your plan's days. It is billed until it is removed.

The charge starts near zero and grows. On the day you add it, only data younger than your plan's retention exists, and older data was already deleted. Each day, data that ages past your plan's days is kept instead of deleted, so the extra data grows until it reaches the add-on's days. The Billing card shows the level it reaches at your current ingest. For example, 2 GB a day on Growth (30 days) with 365 days reaches 2 × (365 − 30) = 670 GB, about $33.50 a month, after about 12 months. After one month it is about 2 × 30 = 60 GB.

How it is billed. The add-on appears on your billing statement as its own line, Extended retention (365 days), with a quantity in GB-months. For each day of the billing period while the add-on is on, Logthread counts the ingest that is older than your plan's days, newer than the days actually kept, and was not already deleted. The days kept are the add-on's days, or your retention when you set it shorter. For a billing period:

kept      = min(add-on days, your retention)
extra(d)  = ingest in [max(d − kept, floor), d − plan days)
GB-months = sum of extra(d) over the days of the period ÷ days in the period ÷ 1,000,000,000
amount    = GB-months × $0.05

floor is the oldest data still kept: the day the add-on began minus your plan's days. A change while the add-on is on (180 to 365 days, a new plan, or a different retention) starts a new stretch from that day. Data that was kept at the change is still counted, so moving from 180 to 365 days bills the data the 180 days had kept. After a plan change, "older than your plan's days" uses the new plan's days.

Once the add-on is older than its days, this equals your average daily ingest times (add-on days − plan days). The statement line shows the add-on days, the plan days and the totals it was computed from. Removing the add-on stops the charge from the day it ends, and the days before it are still billed. Contracts billed in other currencies carry their own rate for this line, and Logthread adds it before turning the add-on on for a workspace on such a contract. Payments are not enabled yet, so nothing is charged automatically.

How to remove it. The owner can request removal from the same card, or ask Logthread support. Removing it puts your retention ceiling back to your plan's. If your retention is currently longer than your plan allows, Logthread confirms with you first, because logs older than the plan's days are then permanently deleted. If you already set a shorter retention, it stays. Moving the workspace to the Free plan also ends the add-on.

How many AI credits do I get#

Pari, the assistant, uses one credit per message (1 Pari message = 1 credit). See the Pari page for what she does.

• Each workspace gets a one-time included grant: 100 credits on a paid plan, 10 on the Free plan.
• Moving from Free to a paid plan tops the grant up to 100. A downgrade never takes credits back.
• Platform admins at Logthread can grant extra credits to a workspace. The grant is added right away and recorded with a reason.
• The AI credits card on Administration → Usage shows Included, Granted, Used, Remaining and Billable this period.
• When credits run out, Pari stops, unless the workspace's billing contract has a rate for AI credits. With one, further messages are billed to the contract, and Billable this period counts them for the contract's current billing period.
• Messages that fail on the provider side, or return an unusable answer, are not charged.

Data protection#

• Where data is stored. In India, in the Mumbai region. Logthread runs in this one region today; EU and US regions are on the roadmap. See Data residency for what is stored where.
• In transit.
• Every endpoint uses TLS: the app, the API, and OTLP over HTTP and gRPC, syslog and Fluent Forward.
• The web app sends HSTS, so browsers always use HTTPS.
• Keys.
• Ingest keys can only send, and API keys can only do what their scopes allow.
• Both are shown once; Logthread keeps only a digest, so a lost key cannot be recovered, only revoked.
• Secrets you give Logthread, such as alert channel webhooks and SSO settings, are stored encrypted.
• Access. Roles decide who can see and change what. Enterprise single sign-on and SCIM are available. The audit log records every change to keys, members, retention and settings.
• What you send.
• Pipelines can mask or drop fields before storage.
• Redact secrets in every route masks keys, tokens, card numbers and similar values in every record.
• Ingest keys inside syslog messages are never stored.
• How long it is kept.
• Data is kept for your workspace's retention period, then deleted.
• Shortening retention deletes older data at once.
• Deleting a workspace has a 7-day grace period, during which owners can cancel. After it, the workspace's data is deleted.
• Pari, the AI assistant. Runs on Logthread's AI service in Mumbai, and owners can turn it off. See Pari.

What does the audit log record#

Owners and admins can open Audit log to see who did what in the workspace, newest first. Filter by Action, a date range (From and To, both days included, in the workspace time zone), Actor (an account email) and Search (a part of the target or the action); the filters are in the page address, so you can share the view. Export CSV downloads the newest 100,000 events with the same filters. Each row shows When, Action, Actor, Target and IP.

It records sign-ins and sign-in method changes, ingest keys, invitations, role changes and removals, plan requests and changes, retention changes, workspace deletion requests, alert rules and channels, dashboards, pipelines, SQL console queries, exports, and turning Pari on or off.

Next: connect your identity provider with single sign-on.