Services & Costs — Platform Overview
Executive Overview — decision-maker summaries · Environment Inventory — all config keys
Audience: Management, finance, compliance, IT.
Last reviewed: August 2026 · Prices are indicative (USD list prices ≈ EUR at current rates; verify in each vendor dashboard).
Monthly cost summary
| Category | Services | Est. fixed/month | Variable |
|---|---|---|---|
| Hosting (production) | Render (frontend, backend, Postgres, docs) | ~€90–127 | — |
| Hosting (staging) | Render staging stack | ~€25–47 | — |
| Storage & CDN | Cloudflare R2 + DNS | ~€0–5 | R2 egress/storage |
| Resend | €0–20 | Volume above free tier | |
| AI inference | Anthropic API and/or OpenRouter | €0–200+ | Token usage |
| Auth | Microsoft Entra ID (Azure AD) | €0* | Included in M365 if licensed |
| Source control | GitHub (MQA-Group) | €0–16 | Team plan if branch protection needed |
| Domains | Hostinger / registrar (mqa.group) | ~€1–3 | Annual fee ÷ 12 |
| Monitoring (recommended) | Better Stack / UptimeRobot + Sentry | €0–20 | Paid tiers optional |
| KYC (optional) | OpenSanctions API | €0–50 | Depends on plan/volume |
Typical production run (no staging, moderate AI): ~€100–160/month fixed + AI/email variable.
Full stack (prod + staging + monitoring + GitHub Team): ~€160–240/month fixed + AI/email variable.
Live vs. blueprint (Aug 2026): Render dashboard shows
mqa-docsstill as free static site. Blueprint/render.yamltargets Starter (~$7/mo) for HTTP Basic Auth viaDOCS_PASSWORD— add ~€7/mo prod (+ ~€7 staging) after that deploy.
Service inventory
Hosting — Render (Frankfurt, EU)
| Service | Plan | Role | Est. cost |
|---|---|---|---|
mqa-frontend | Starter | React SPA | ~$7/mo (~€7) |
mqa-backend | Standard | Node/Docker API | ~$25/mo (~€25) |
mqa-postgres | Pro 4 GB | PostgreSQL 18, HA, PITR | ~$55–85/mo (~€50–80) |
mqa-docs | Starter (blueprint) · Static (live until deploy) | VitePress + Basic Auth (docs.mqa.group) | $0 live · ~$7/mo after Node deploy |
| Production subtotal | ~€90–127 |
| Staging service | Plan | Est. cost |
|---|---|---|
mqa-frontend-staging | Starter | ~€7 |
mqa-backend-staging | Starter | ~€7 |
mqa-postgres-staging | Basic 1 GB | ~€15–20 |
mqa-docs-staging | Starter (blueprint) · Static (live) | Docs preview from develop |
| Staging subtotal |
Details: OPS-ECOSYSTEM · STAGING-STATUS
Storage & DNS — Cloudflare
| Product | Usage | Est. cost |
|---|---|---|
R2 (mqa-media) | Media Hub, backups (planned) | Free tier: 10 GB storage; then ~$0.015/GB-month |
DNS (mqa.group) | Hostinger — CNAMEs for portal, api, docs, staging | Registrar ~€1–3/mo; records on Hostinger |
| Cloudflare DNS zone | mqa.group zone migration to MQA org | Still pending ⚠️ (see migration doc) |
| R2 egress | Public CDN URLs | Often $0 via Cloudflare; check dashboard |
Status: R2 on MQA org account ✅ · DNS zone migration to MQA org still pending ⚠️
Details: CLOUDFLARE-MIGRATION
Email — Resend
| Tier | Limit | Price |
|---|---|---|
| Free | 100 emails/day, 3,000/month | $0 |
| Pro | 50,000 emails/month | $20/mo |
| Scale | Higher volume | Custom |
Production sender: governance@mqa.group (and aliases system@, support@).
Used for: Approvals, auditor invitations, password reset, compliance notifications — see RESEND.
Env: RESEND_API_KEY on mqa-backend (Render secret).
AI — Anthropic, OpenRouter, Claude subscription
| Provider | Purpose | Billing |
|---|---|---|
| Anthropic API | Direct Claude inference in production | Pay-per-token (pricing) |
| OpenRouter | Optional unified API; model switching | Pay-per-token + small markup (pricing) |
| Claude Pro / Team | Developer chat at claude.ai | ~$20–30/user/mo — not the app API bill |
The portal uses ANTHROPIC_API_KEY or OPENROUTER_API_KEY (OpenRouter wins if both set). Typical models: Claude Sonnet 4 / 4.5.
Rough AI spend: Low internal use ~€5–20/mo; active AI editing across teams ~€50–200+/mo — set budget alerts in Anthropic/OpenRouter dashboard.
Details: AI-SERVICES · AI Content Editing Architecture
Authentication — Microsoft Entra ID (Azure AD)
| Item | Cost |
|---|---|
| OAuth / SSO for portal | Usually included in Microsoft 365 / Entra ID P1 licenses already held by MQA |
| App registration | No extra fee |
Env: OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_TENANT_ID, OAUTH_REDIRECT_URI
Optional fallback email via Microsoft Graph (MICROSOFT_SENDER_EMAIL) — no separate vendor if M365 licensed.
Source control — GitHub
| Plan | Cost | Notes |
|---|---|---|
| Free (private repo) | $0 | Current — CI via Actions (2,000 min/mo free) |
| Team | ~$4/user/mo | Recommended for enforced branch protection on main / develop |
Details: GITHUB-FLOW
Domains — Hostinger / registrar
| Domain | Purpose | Est. cost |
|---|---|---|
mqa.group | Production + staging subdomains | ~€10–40/year (~€1–3/mo) |
DNS records: portal, api, docs, staging.* — see OPS-ECOSYSTEM.
Monitoring & errors (recommended, not fully live)
| Service | Free tier | Paid (indicative) | Status |
|---|---|---|---|
| Better Stack / UptimeRobot | 1–50 monitors | ~$7–20/mo | TODO |
| Sentry | 5k errors/mo | ~$26/mo Team | TODO |
| Render built-in | Metrics, deploy emails | Included | ✅ Active |
Details: MONITORING
Compliance & integrations (optional)
| Service | Env key | Est. cost | Status |
|---|---|---|---|
| OpenSanctions | OPENSANCTIONS_API_KEY | Free tier / paid API | ⚪ Optional KYC |
| Anthropic usage caps | App config | — | ✅ Configurable in portal |
Recommended stack for optimal operations
| Priority | Service | Why | Est. add-on cost |
|---|---|---|---|
| P1 | Staging (Render) | Safe releases before production | ~€25–40/mo (deployed ✅) |
| P1 | Automated monthly DB backup → R2 | Disaster recovery | ~€1–5/mo storage |
| P1 | DNS on MQA Cloudflare org | Ownership, offboarding | $0 |
| P2 | Uptime monitoring (Better Stack) | Outage alerts to IT | €0–20/mo |
| P2 | Sentry | Error tracking before users report | €0–26/mo |
| P2 | GitHub Team | Enforced PR + CI on main | ~€4/user/mo |
| P2 | Resend Pro | If email volume exceeds free tier | $20/mo |
| P3 | Separate staging AI key | Limit prod AI spend | Usage-capped key |
| P3 | OpenRouter | Model flexibility, single billing | Variable |
Open items: OPS-ROADMAP
Environment variable quick map
| Service | Key(s) | Where set |
|---|---|---|
| Render Postgres | DATABASE_URL | Auto from Render |
| Anthropic | ANTHROPIC_API_KEY | Render secret |
| OpenRouter | OPENROUTER_API_KEY, AI_MODEL | Render secret |
| Resend | RESEND_API_KEY | Render secret |
| Cloudflare R2 | R2_* | Render secret |
| Microsoft OAuth | OAUTH_* | Render secret |
| Sentry (future) | SENTRY_DSN, VITE_SENTRY_DSN | Render |
Full list: ENV-INVENTORY
Related documents
| Document | Content |
|---|---|
| RESEND | Email setup, domains, templates |
| AI-SERVICES | Anthropic vs OpenRouter vs Claude subscription |
| OPS-ECOSYSTEM | Architecture diagram |
| EXECUTIVE-OVERVIEW | Per-topic summaries for approvers |
| MONITORING | Uptime & Sentry setup |
Update this page when adding a vendor, changing Render plans, or renewing annual contracts.