Limits
Per-organization operational quotas — the defaults, what they do, and how they differ from rate limits and billing blocks.
Beyond billing, Norcube runs a small set of operational quotas per organization — guardrails on concurrency and job size that keep one tenant's burst from affecting everyone else. They're managed centrally, and every one of them is adjustable per organization — talk to us if a default is in your way.
The quota catalogue and defaults
| Product | Quota | Default |
|---|---|---|
| DomainRadar | Concurrent domain checks | 20 |
| DomainRadar | Max domains per bulk check | 100,000 |
| LangSync | Concurrent translation jobs | 20 |
| Backup | Concurrent backup jobs | 5 |
| Backup | Max datasources | Set by your plan: 1 on Free, 5 on Starter, 20 on Pro, 50 on Business |
Two temperaments, worth knowing when you design around them:
- Concurrency quotas queue — submitting more work than the cap doesn't error; it processes at the capped rate. DomainRadar's fair scheduling is this quota in action: your bulk work drains through the per-org cap while single checks jump the queue.
- Size/count quotas reject oversized submissions at creation time, so you find out immediately, not mid-job.
Enforcement is wired product by product — DomainRadar enforces its
quotas today, and Backup enforces its datasource cap (a new data source
over the cap returns 403 QUOTA_EXCEEDED); the others are being rolled
onto the same system. The
catalogue and defaults above are what any raise request is measured
against.
What limits are not
Three other mechanisms get confused with quotas:
| Mechanism | Trigger | Where documented |
|---|---|---|
| Rate limits | Requests per hour on cost-driving endpoints (AI calls, checks) — returns 429. | Each product's Limits and errors page: LangSync, DomainRadar. |
| Free-tier quotas | Monthly billable allowances — exceeding them costs money, never blocks. | Billing → Free Tier. |
| Billing blocks | Unpaid invoice past grace, or your own budget hard cap — paid operations return 402. | Dunning. |
A 429 means slow down, a limit rejection means make it smaller (or
ask for a higher quota), and a 402 means the problem is money, not
volume.
Sign-in and token endpoints
Norcube Auth also rate limits the endpoints you call before you have an
access token: signing in and up, password reset, token refresh, CLI
sign-in and sign-out, the CI token exchange and
device sign-in. Limits count per network address (IPv6 per /64) and,
for signing in and password reset, per email address as well, so one
account can't be guessed from many addresses. They're generous for
normal use; an office or a CI fleet behind one address won't reach them.
A limited request gets 429 Too Many Requests with a Retry-After
header (seconds to wait). Every response from a limited endpoint also
carries the standard RateLimit-Policy and RateLimit headers, for
example:
RateLimit-Policy: "sign-in-ip";q=60;w=600
RateLimit: "sign-in-ip";r=12;t=40q is the burst the policy allows, w its window in seconds, r how
many requests are left right now and t the seconds until the full
budget is back. When the Norcube CLI retries a
request, it waits as long as Retry-After asks.
Seeing where you stand
There's no self-service quota dashboard yet. Concurrency limits are observable indirectly (queued jobs waiting), and the money-side equivalents live in Billing → Free Tier. If you're planning a workload that will strain a default — a 100k-domain sweep on a schedule, dozens of parallel backups — reach out first and we'll raise the quota for your organization.