Self-hosting ar-agents is free and always will be. Running a signed audit log with SLA, AR data residency, key rotation, regulator-ready dashboards, and 24/7 support is another thing. If your AI corporation prefers to consume that as a service, there's a tier for you.

This page answers the question any journalist asks in minute two: “How do you make a living from this if everything is open source?”

Open-core model. The library, the RFCs, and the reference implementation are under MIT + CC-BY-4.0, free forever. What's charged is operation: hosting with SLA, cryptographic key custody, data residency in Argentine territory, legacy-system integrations, and contractual support. It's the model of Vercel over Next.js, Resend over nodemailer, Supabase over Postgres, Linear over their public CLI repo.

Who pays. The party who needs the trust pays, not the party being verified. The employer pays for the background check, not the applicant. Same here: the company gets verified, and the bank, the insurer, or the state pays to trust it. That is why the attestation is credible, the audited party does not pay us. The detail is in pricing. The Auditor is already live.

Self-host

Available

Open source. Forever.

Devs who want to run their own stack

Free · MIT + CC-BY-4.0

36 npm packages under @ar-agents/*
6 CC-BY-4.0 RFCs + test vectors
Complete reference implementation
Deploy to Vercel / Cloudflare / Deno / any Edge
Docs + cookbook + AGENTS.md per package
Issues + discussions on public GitHub
No telemetry · no caps · no lock-in

Start on npm →

Studio

Preview · waitlist open

Managed hosting + audit pipeline.

AI corporations that prefer not to operate infra

The Auditor live, USD 199/mo · full bundle in preview

Persisted audit log with SLA · 99.9% uptime
Regulator-ready forensic dashboard (multi-session)
Automatic Ed25519 key rotation (RFC-005 § 4)
Periodic export to JSON + CSV + ASiC-E containers
Automatic conformance monitoring (RFC-002 + RFC-004)
Forwarded webhooks with HMAC + guaranteed dedup
Email + Slack support, 24h SLO
Encrypted backups, 5-year retention (RFC-004 § 7)

Request invitation →

Government

In design · prelaunch

For the Argentine state.

Public agencies · external auditors · LPDP-regulated entities

Bilateral agreement · per-project pricing

Data residency in Argentine territory (local datacenter)
Signed Law 25.326 DPA + restricted transfer clause
Ed25519 key custody in auditable HSM (CABA model)
SOC 2 Type II audit + ISO/IEC 27001 roadmap
Contractual SLA with penalties + 24/7 support
Multi-tenant isolated by jurisdiction
Internal training for auditors + advisors
Feature roadmap aligned with AAIP, AFIP/ARCA, IGJ
Source code under escrow for continuity

Technical meeting →

Bespoke

Available

Turnkey implementations.

Large companies · businesses in migration

Per-project quote

Guided full-stack implementation (2-8 weeks)
Legacy system integration (SAP, Oracle, AR ERPs)
Custom adapters for proprietary tools
Migration path from existing stacks (Stripe, Twilio, etc.)
Internal tech-team training
Post-launch on-call · 90 days included
Initial RFC-002+004 audit + remediation plan

Quote an implementation →

Why the code stays open-source

Regulatory credibility. A Ministry advisor can't recommend a stack one closed vendor controls. If it's open source, the state can fork it and keep going if the maintainer disappears. That continuity is the reason it's viable to legislate over the infrastructure.
Broad adoption. If it were closed, no AI corporation without a licensing budget could use it. Open, the whole ecosystem adopts it. Payers are those who need SLA, residency, or auditing, not those who can assemble it themselves.
Defensibility against capture. If a large consultancy (Globant, Accenture, BGH) enters, it can offer services over the open code but can't close it. The moat is the maintainer's evolution speed and the closed dashboard, not the license.
Compatibility with cite-by-reference. Argentine law can cite RFC-004 with an immutable GitHub commit hash (see /cite). That requires the document to be CC-BY-4.0 and the reference code to be MIT-verifiable.

How it compares to known open-core stacks

Project	What's OSS	What's paid
Vercel	Next.js, Turborepo, AI SDK	Hosting, AI Gateway, KV, Postgres, support
Supabase	supabase-js, Postgres extensions, CLI	Hosting, auth, storage, dashboard
Resend	react-email primitives	Sending pipeline, dashboard, SLA
Linear	CLI primitives, integrations	Issue tracking SaaS, enterprise SSO
Cal.com	Whole stack open-source	Hosting, white-label, enterprise
ar-agents	36 npm packages, 6 RFCs, reference impl	Studio · Government · Bespoke (this page)

For investors and partners

Today (2026-05-13) the project is pre-revenue: the library is published, the regulatory ecosystem is forming, and the commercial platform is in design. Revenue arrives in sequence:

Studio ships in preview Q3 2026, once there are 5+ AI corporations seeking managed hosting.
Government requires enacted law + ministerial decision to outsource the infrastructure. Expected Q4 2026 - Q1 2027.
Bespoke is available today for early-adopters building their AI corporation in anticipation of the law.

Email naza@naza.ar if you want to see the full deck, financial model, or coordinate advisory equity in early AI corporations.

Pre-revenue honesty

No paying customers yet. Studio + Government are in design. Bespoke received 0 formal quotes to date.
One maintainer. Operational continuity is a real risk mitigated by code escrow, CC-BY-4.0 RFCs, and npm provenance, but not eliminated.
Government tier depends on variables I don't control. The law may not pass, the ministry may outsource to Globant, the regime may mutate. The commercial model respects that uncertainty.

The code is open-source. The platform, not necessarily.