Carina Cloud
Hosted vs self-hosted surfaces and billing boundaries: Capability inventory.
Carina Cloud is the hosted SaaS at app.carinaai.uk. Sign up, add your LLM API key, optionally enable a domain pack, and chat in the browser. The agent runs the same MIT kernel as self-host; Cloud adds managed hosting, sessions, and the workspace UI.
Carina Cloud is not the same product as Labyrinth Scout. Scout adds the controls that a workspace alone does not provide.
For team features (BYOK vault, workbench, audit, deployments), upgrade to Carina Ops plans on the same app host.
White-label operators can brand the cloud workspace, bind custom domains, and provision client workspaces. Customer guide: white-label getting started.
Quick start (one click)
- Open app.carinaai.uk/hosted-register and create an account.
- Your org and agent workspace are provisioned automatically (empty skill packs, welcome checklist).
- Add at least one LLM provider key in Settings (BYOK required for chat).
- Optionally enable a domain pack from the packs UI or Hub.
- Send your first chat message.
When Carina Ops is enabled, new accounts redirect to the onboarding wizard at /ops/onboarding. Otherwise you land on chat with a welcome banner.
Plans
For current Carina Cloud and Ops packaging, see carinaai.uk/pricing.
New orgs receive a 14-day Team trial on registration. Full feature matrix: Carina Ops plans.
Scout Monitor and Scout Govern are sold separately at labyrinthscout.com. Use Scout when the work needs stronger controls.
Marketing summary: carinaai.uk/cloud.
Self-host vs Carina Cloud
Self-host carina-agent | Carina Cloud | |
|---|---|---|
| Install | npm install -g carina-agent, Docker, or bare metal | None (browser) |
| Infrastructure | Your servers | VERLOX managed Postgres |
| Inference keys | Your .env or BYOK config | BYOK in Settings |
| Skill packs | carina pack install, .env, or operator store | Same packs; tenant installed_packs table |
| Scout | Optional; separate subscription | Optional; adds security controls |
| Ops console | N/A unless you run hosted mode yourself | /ops/* on paid plans |
You can use both: Cloud for daily work, self-hosted for local files and tools, with the same Scout key if you subscribe to Scout Govern.
Export and migrate
Roadmap: one-click export of org config, installed packs, and vault metadata to a self-host .env + YAML bundle. This is not fully automated yet.
Today you can:
- Copy BYOK keys from Settings into your local
.env - Reinstall packs with
carina pack installon self-host - Export audit and usage CSV on Ops Team (see Carina Ops plans)
Document any production migration with your operator before moving off Cloud.
White-label custom domains
Partners and workspace owners can map a verified customer hostname to Carina Cloud. See White-label custom domains for DNS verification, nginx TLS, and email sender identity.
Hosted guardrails
| Limit | Value |
|---|---|
| Daily chat messages | 100 (configurable via CARINA_CLOUD_FREE_DAILY_MESSAGES) |
| Scout bundled | No |
| Ops console | No (trial elevates to Team features for 14 days) |
| Members | 1 |
When the quota is exceeded, chat returns HTTP 429 with an upgrade link.
Bring your own keys (BYOK)
Inference cost is yours. Carina Cloud stores encrypted provider keys per tenant.
Supported providers match the configuration guide: OpenAI, Anthropic, DeepSeek, Gemini, Groq, OpenRouter, and others in the provider registry.
Keys are encrypted at rest (TENANT_KEY_ENCRYPTION_KEY on the server) and scoped to your tenant only.
Labyrinth Scout (optional, paid)
Scout watches agents for prompt injection, runaway tools, secret leakage, and anomalies. It is added separately when the workspace needs production controls.
If you subscribe to Scout separately:
| Page | Purpose |
|---|---|
/security | Subscription status, pairing key, monitored instances |
/dashboard | Tenant-scoped security dashboard |
Cloud chat can report to Scout when a Scout license is active on your account. See Labyrinth Scout for pairing self-hosted Carina with the same Scout account.
Billing
| Action | Where |
|---|---|
| Upgrade to Ops Starter or Team | /ops/billing |
| Scout subscription | /billing or labyrinthscout.com |
| Manage payment method | Stripe Customer Portal from Billing |
Data isolation
Each hosted user gets:
- Row in
hosted_users(email, tier, quota counters) - Dedicated Postgres schema for memories and tenant data
- External session id
hosted:{userId} - Separate BYOK rows in
tenant_provider_keys
Other tenants cannot read your data or keys.
Operators: enable Carina Cloud
# core.carinaai.uk/.env
HOSTED_MODE=true
CARINA_CLOUD_ENABLED=true
JWT_SECRET=<random>
TENANT_KEY_ENCRYPTION_KEY=<32-byte-hex>
CARINA_HOSTED_APP_HOST=app.carinaai.uk
CARINA_OPS_PRODUCT_ENABLED=true # optional; enables /ops onboarding wizard
CARINA_CLOUD_FREE_DAILY_MESSAGES=100
STRIPE_SECRET_KEY=sk_...
STRIPE_WEBHOOK_SECRET=whsec_...
STRIPE_PRICE_CARINA_OPS_STARTER=price_...
STRIPE_PRICE_CARINA_OPS_TEAM=price_...
Never commit real secrets. See .env.example in the repository.
Troubleshooting
| Symptom | Check |
|---|---|
| Chat says no provider | Add BYOK key in Settings |
| 429 daily limit | Wait for quota rollover or upgrade at /ops/billing |
| Scout not active | Scout is a separate product; confirm Scout subscription |
| Empty onboarding wizard | CARINA_OPS_PRODUCT_ENABLED=true and Stripe configured |