Enterprise pipeline

Overview

Bigger accounts don't buy through the per-seat storefront. /buy/enterprise captures an enterprise order (company, authorized signer, seats, term, and annual contract value or ACV), renders a real order-form contract, and gives the buyer a private signing link. When they sign, the server provisions their workspace and sends a welcome email.

This is the "sales-assisted" path alongside the self-serve pricing page. Same entitlement model underneath; the enterprise flow just adds a contract, a signature, and ACV invoicing on top.

The contract lifecycle

Every deal moves through a tracked lifecycle so nothing stalls silently:

• Sent. The order form is captured and the signing link is issued. A 30-day signing deadline is set at this point.
• Viewed. The buyer opened the signing link. Stamped the first time the contract is loaded.
• Signed → provisioned. The buyer confirmed. The workspace (user + team) is created, the deal is linked to it, and the welcome email goes out.
• Expired. The deadline passed without a signature. Automatically flipped by the daily reminder cron.

Unsigned contracts get automatic nudge emails at 3 days and 7 days, each sent once. If the deadline lapses first, the deal is marked expired and no further reminders fire.

Tracking deals (admin)

The admin dashboard has an Enterprise contracts table: every deal with its live status, buyer, ACV, seat count, and sent / viewed / signed dates, plus the age of each open deal. A summary line shows how many contracts are open and the total ACV awaiting signature. A deal past its deadline shows as Expired immediately, even before the cron flips it in the database.

How the buyer signs

1. Fill in the order form at /buy/enterprise (company, signer, seats, term, ACV, billing details).
2. The signing link is emailed to the work email entered on the form; it is never shown directly in the browser after submitting. This proves the requester controls that inbox before any workspace or invoice is created against it.
3. Open the emailed link (the rendered order form with the full terms).
4. Confirm to sign. The workspace provisions automatically and a welcome email with the login link follows immediately.
5. Sign in with the signer's email and invite the team from Team admin.

Annual contract value and seat count are capped at self-serve-sane ceilings ($2M ACV / 100,000 seats); larger deals should go through a sales-assisted process instead of this form.

Operator setup

Reminder emails and provisioning work with no extra configuration; email is an honest no-op (printed to logs) until RESEND_API_KEY is set. The optional integrations are documented in the operator runbook:

• Reminders. Need RESEND_API_KEY + MAIL_FROM on a verified domain, and CRON_SECRET for the daily cron.
• Real e-sign (Dropbox Sign). Optional embedded signing. Set DROPBOX_SIGN_API_KEY + DROPBOX_SIGN_CLIENT_ID and add the event callback; the buyer signs a real envelope in-page and the completion webhook provisions the workspace. Unconfigured, the page falls back to the built-in click-to-sign.
• ACV invoicing. On signature, a Stripe invoice for the annual contract value is raised automatically (Stripe Invoicing, net-30 wire/ACH, not a card subscription). Reuses your existing STRIPE_SECRET_KEY; when Stripe isn't configured the deal is marked Manual, bill by hand in the admin table. One invoice per deal (idempotent).

Who is leaving

The operator dashboard carries two sections about churn, added 2026-09-07.

• Leaving. Accounts that have cancelled and are still inside their paid period, ordered by when their access ends rather than by when they cancelled. That order is the point: a cancellation from three weeks ago with two days left needs you before one from this morning with eleven months left. Each row links to that account's audit history.
• Already gone. Subscriptions that ended and charges fully refunded in the last 30 days, with what the ending actually revoked. Nothing to do about these; they are here so a pattern is visible. The address is blank when the Stripe payload did not carry one, rather than guessed.

The billing webhook also raises an alert when a subscription ends or a charge is fully refunded. A goodwill partial refund does not alert, because that is a decision somebody already made and alerting on it would train you to ignore the channel.

Those alerts go nowhere until MONITORING_WEBHOOK_URL is set. The two sections above are the record either way. Said plainly because an alert nobody receives is worse than no alert: it is one somebody thinks they have.

Related

• Pricing, the self-serve per-seat storefront.
• Team Activity, what a provisioned team's skills do on a schedule.