Editions & Plans

This page documents edition and plan differences for product usage. It is not a pricing page. Private deployments are arranged with rstream and are not a public downloadable SKU.

The public self-hosted engine is Community Edition. Hosted rstream and private deployments arranged with rstream can run additional runtime modules for project-backed authentication, advanced listeners, managed policies, and persisted operational integrations.

Community Edition

Community Edition runs the core engine with the TLS listener, HTTP and TLS tunnel support, static certificate configuration, JWT authentication, and Prometheus metrics.

Use hosted rstream or contact rstream for a private deployment when the runtime must enforce managed project controls, certificate-backed authentication, browser-based access flows, network access policies, persisted operational history, additional listener families, package distribution, or automatic certificate management.

Hosted and private runtimes

Hosted rstream and private deployments can enable additional runtime capabilities such as QUIC and DTLS listeners, plain HTTP CONNECT, HTTP/3 Extended CONNECT protocols, mTLS authentication, ECH policy, identity provider integration, project-backed authorization, location or IP policies, package distribution, automatic certificate management, persisted events, and additional metrics sinks.

Plan gates are enforced by the runtime. In the hosted project matrix, fine-grained resources.tunnels boundaries are available on Basic, Pro, and Enterprise projects. Agent mTLS authentication is available on Basic, Pro, and Enterprise projects when the runtime enables certificate-backed agent authentication. The Engine HTTP API is token-authenticated. Published Tunnel mTLS is available on Pro and Enterprise projects when the runtime enables published mTLS enforcement. Plain CONNECT follows the HTTP tunnel support available in the runtime. Pro and Enterprise projects can use private tunnels, datagram tunnels, published QUIC tunnels, DTLS tunnels, HTTP/3 upstream, WebTransport, CONNECT-UDP, CONNECT-IP, GeoIP policies, trusted IP policies, custom ALPNs, custom TLS ciphers, rstream Auth, and challenge mode. Basic projects have HTTP/3 downstream support and can use QUIC for the engine control channel when the QUIC listener is enabled, but the other advanced tunnel and policy features remain gated.

Some private-runtime integrations are documented as part of the deployment package when they apply.

For the public self-hosted path, use Self-Hosted, which documents the CE runtime and its configuration contract.