Awaiting counsel review.
This document is not legal advice and has not yet been reviewed by a qualified lawyer. Anything shown as "to be supplied" is a value the operating company has yet to provide, and is left visible rather than guessed. Statements about how the product behaves are drawn from the implementation and are accurate.
The principle
Treica is priced per workspace rather than per record or per request, because counting those would make normal compliance work stressful. This policy exists so that a small number of extreme users cannot degrade the service for everyone else. It is not a mechanism for charging you more without warning.
If your use is unusual because your business is unusual - a large group with many entities, a genuinely enormous register - talk to us. That is a pricing conversation, not an enforcement one.
What normal use looks like
These are the limits actually enforced, not aspirations. Where a limit is not enforced, this section says so.
| Area | Limit | Enforced? |
|---|---|---|
| Public API requests | 120 requests per minute, per API key | Enforced. Exceeding it returns 429 with a Retry-After header telling you exactly how long to wait. |
| Treica Assist actions | 6,000 actions per subscription year, and 60 per hour, per workspace; contract documents up to 20 MB | Enforced, with a hard stop rather than automatic overage billing. Warnings at 70%, 85% and 95%; an owner may buy a prepaid top-up, which is never charged automatically. Nothing on the compliance path uses AI, so reaching either limit never blocks filing work. |
| Sign-in link requests | 5 per 15 minutes, per email address | Enforced. This exists to stop the service being used to send unwanted mail to a third party. |
| Bulk import | Up to 6 MB per import - roughly tens of thousands of rows | Enforced, and checked in your browser before anything is uploaded. Comma, semicolon and tab separated files all work; a European Excel export needs no conversion. |
| Evidence documents | Up to 25 MB per document; PDF, Word, Excel, CSV, text, PNG, JPEG and email formats | Enforced. The store holds documents an auditor can open, so working files and executables are refused. No total storage quota is enforced. |
| Reporting entities | 1 on Register, 3 on Governance, 10 on Group, plus any additional entities on your order form | Enforced. This is what separates the plans; adding an entity beyond your plan is refused with a message naming the plan and the number. |
| Users | 10 people on Register, 30 on Governance, unlimited on Group | Enforced. Deactivating someone who has left frees a place. |
| External reviewers | 2 with access at one time on Register, 10 on Governance, unlimited on Group | Enforced, and counted as active rather than as permanent seats: reviewer access is time-boxed, so revoking one that has finished frees a place immediately, and an access period that has already expired occupies none. |
What counts as one Treica Assist action
One action is one explicit run of one Assist feature over one contract, record, response set or finding. Re-running the same document is another action, because it is another model call.
A bulk operation costs one action per item, and the count is shown before the run starts - a run over twenty contracts says so, and uses twenty. Nothing is charged for a run that failed.
The allowance is annual rather than monthly on purpose. DORA work is not evenly spread: a firm may process two hundred contracts in one month and almost nothing for the next four, then need a burst of explanations in the week before a filing. A monthly cap would stop them precisely when it hurts.
How the limits behave
Counting uses a fixed window rather than a rolling one, which means a caller pacing requests across a window boundary can briefly exceed the stated rate. That is a deliberate trade for a counter that is atomic and cheap, and it is stated here rather than glossed over.
If the counter itself fails, the request is allowed through. A limiter that takes the service down when it has a bad day has caused a worse outage than the one it was preventing. Authentication and authorisation are separate from this and always fail closed.
If usage makes tighter quotas necessary we will publish the numbers here and give notice before they take effect, so nobody discovers a limit by hitting it mid-filing.
What is not fair use
- Automated polling of the API at a rate far above what your data changes, instead of using a sensible schedule.
- Using the AI features to process material unrelated to your ICT third-party governance - for example bulk document processing for another purpose.
- Sharing one workspace across separate legal groups that should each hold their own register, in order to avoid separate subscriptions.
- Sharing API keys or user accounts between people, which also defeats the audit trail you are relying on.
- Load testing, scanning or penetration testing without our prior written authorisation.
How we respond
Our first step is always to contact the workspace owner and explain what we are seeing. Where use is simply growing, we will discuss a plan that fits.
Where use threatens service stability we may apply rate limiting to the affected key or workspace, and will say so. We reserve suspension for cases that are abusive or that endanger the security or availability of the service for others, and we will state the reason.
We will not silently degrade your service or delete your data under this policy.
Security testing
We welcome responsible disclosure. If you believe you have found a vulnerability, contact security@treica.com before testing further, and do not access data belonging to any other customer. We acknowledge a report within two working days and tell you what we intend to do about it.