Which permission tier each plan includes

Solo, Team and Enterprise cryptography, and which plan grants which.

Written By Dustin

Last updated About 6 hours ago

TOVIO's permission model has three tiers, and the plan you are on decides which one your hosted repositories may use. This is stated in the catalog as a per-plan entitlement, not as a marketing distinction.

PlanTierWhat that means
Free, Personal	Solo (Tier 0)	Per-recipient public-key encryption with no Key Authority. Grants and revocations are expressed directly against recipients. Everything works fully offline.
Business	Team (Tier 1)	A hybrid envelope — a content key per object, wrapped for each recipient — with a Key Authority acting as the authorization oracle for grant, revoke and rotate. This is the tier that makes a team's access decisions centrally answerable.
Enterprise	Enterprise (Tier 2)	Attribute-based read control: access is expressed as an expression over attributes rather than as a list of recipients, so a policy survives people joining and leaving.

Why this is the difference that usually decides the plan

Storage and CI-minutes are the numbers people compare first, and they are almost never the reason to move up. The tier is. If you need one place that answers may this person read this path for the whole team — and an audit trail of every time that answer changed — you need the Team tier, which is Business. If you need access to follow attributes rather than named recipients, that is Enterprise.

What the tier does not do

No tier puts the hosted service in the decryption path. Even at the Enterprise tier, the service does not hold a key for your protected content. A Key Authority authorizes; it does not decrypt on your behalf, and no plan changes that.

Changing plan is not the same as migrating a repository

Upgrading your plan grants the entitlement. It does not rewrite an existing repository's permission tier for you — moving a repository from Solo to Team is a repository operation you run deliberately, and the permissions collection covers it. Plan first, then migrate.

Self-hosted repositories are not tiered by a plan

A repository you serve yourself carries no catalog entitlement at all. The tiers are a property of the permission model, not of the hosted service; what a plan sells is the hosted operation of one.