I almost shipped the wrong pricing model.
A couple of years into building document tooling as a solo founder, I landed my first real procurement conversation with a financial institution — a compliance team sitting on two million documents scattered across shared drives, email attachments, and systems run by outside vendors. They wanted something deceptively simple: let staff ask questions in plain language and get answers that point back to a source document someone can open and verify.
Three things stopped them cold. The data could not leave the internal network. The documents were a mess, with scans and PDFs making up most of the pile. And the deepest fear: a model that sounds certain while being wrong, where every sentence has to be traceable.
That conversation reshaped how I think about pricing, positioning, and where the real engineering work lives. Here is what I wish I had understood earlier.
The buyer isn't paying for features, they're paying for sleep
Before that call I priced like an indie app developer, because that is what I was. A low monthly subscription felt natural. It was also almost irrelevant to this buyer.
A compliance officer at a regional bank does not lose sleep over your feature list. They lose sleep over the numbers. IDC surveyed 1,200 information workers and found they spend an average of 4.5 hours a week just looking for documents — and in a financial setting that number tends to climb.
Then there is the risk side. IBM's 2025 Cost of a Data Breach report found that among stolen data, customer PII made up 53 percent, employee PII 37 percent, and intellectual property 33 percent — and for intellectual property, the cost per lost record can run as high as 178 dollars. When you hand a batch of contracts and client files to a public-cloud model, you are not buying convenience. You are deciding whose vault the keys sit in.
One-time buyout or subscription? The answer depends on who's signing
The pricing lesson I took too long to learn: for a buyer like this, recurring fees are not just a cost, they are a recurring question about whether the data is still leaving. A subscription to a cloud service is, structurally, a permission slip that renews itself. A one-time buyout that runs inside their own walls reads differently — the relationship ends when the software is delivered, and so does the exposure.
That does not make subscription wrong. For small teams and individuals, a subscription lowers the door and keeps them on the latest version. The mistake was treating both buyers with one price. The differentiation was not the feature set; it was data sovereignty, and the pricing had to echo that. If the whole pitch is "your data never leaves," a model that keeps reaching back into their environment every month quietly undercuts the story. I wrote more on that tradeoff on the company blog at https://www.uglypear.com/en/blog/.
Local-first as a strategy, not a checkbox
"Local-first" gets used as a buzzword, but for this kind of buyer it is the only premise that makes the rest possible. The constraint is not technical elegance; it is that the documents can never cross a network boundary. Once I stopped treating offline support as a setting and started treating it as the architecture, a lot of decisions got simpler.
The same logic applies to the data's weight. Komprise's 2026 report found that 74 percent of large enterprises now store more than 5 petabytes of unstructured data, 40 percent exceed 10 petabytes, and 85 percent of IT leaders expect storage spending to keep rising through 2026. Financial archives, imaging, and logs are exactly the kind of data that sits cold and expensive — which means any tool that helps without shipping it outbound has a genuine wedge.
Distribution lessons from selling to people who don't click ads
The hardest distribution truth: the buyers who need this most will not find you through a funnel. They talk to peers at other institutions, ask their audit firms, and watch whether you can survive scrutiny. If you are building something similar, the product overview at https://www.uglypear.com/en/products/ is where I started documenting what "private by default" actually looks like in a box.
So I changed what I optimized, investing in being verifiable instead of top-of-funnel volume. When I say a private system works, it should be something a skeptical engineer can confirm themselves. Recently, building under UglyPear Data, my private and offline knowledge-base system passed end-to-end verification — upload, incremental ingestion, source-traced retrieval, citation-constrained question answering, and usage metering, all running in a container that deploys fully offline. What sold the room was not a deck; it was that response time had dropped from over a minute to under a second, because at that speed people actually use the thing instead of emailing a colleague.
I'll be honest about what didn't work: outbound cold emails to generic addresses converted close to zero. What moved the needle was showing up in the exact conversations where someone said "we can't put this in the cloud." Be where the constraint is named out loud, not where the crowd scrolls past.
There is a quieter lesson about pace. Indie builders ship weekly; institutions buy on a calendar measured in quarters. That gap almost broke the early deals, because I read silence as rejection. It wasn't. A compliance team evaluating something that touches two million documents moves slowly because the cost of being wrong shows up in audits, not in churn. The fix wasn't pushing harder — it was handing them a data-flow description, the offline deployment steps, and a verification checklist they could give to security without me in the room. Sell the ability to be evaluated without you present, and the long silence becomes a feature instead of a threat.
What the engineering actually buys
If you're a founder positioning a tool like this, or a buyer trying to choose, the dimensions matter more than the logos. Ask where the data physically lives at each step, what happens to it the moment a subscription lapses, and whether answers trace back to a source document — in a regulated setting an untraceable answer is just a liability with good grammar. Also ask which formats show up in your real estate, scans and OFD and video, and whether the pipeline handles them without a second system bolted on.
The public benchmarks I can share without breaking confidentiality are humbling in a good way. A 443-page OFD document processes end to end in roughly 124 seconds. Image material compressed before reaching a model like GPT-4o cut token cost by about 85.9 percent. Volume typically falls 60 to 80 percent smaller, which means the same retrieval budget covers more ground. The sensitive-information detection covers 13 categories, and the format handling spans 8 common types. The home page at https://www.uglypear.com/en/ frames the same idea from the buyer's side, if you want the less technical version.
What I'd tell myself at the start
Build the verification first. A privacy-first claim is only as good as the moment a customer's security team tries to break it, and the fastest way to lose a conservative buyer is a demo that needs the internet. Price to match the premise — if you're selling sovereignty, don't build a business model that quietly asks for it back every month. And distribute to the constraint, not the crowd; the people who need local-first most are the ones already saying the words out loud.
I still don't have all of this figured out. But the part I'm sure about: when your whole value is that the data stays put, everything downstream — the price, the pitch, the architecture — has to agree.
FAQ
Q: For a privacy-first tool, should I sell a subscription or a one-time buyout?
A: It depends on the buyer. A subscription lowers the door for small teams and individuals, but for regulated institutions a recurring fee reads as a recurring question about whether data is still leaving. A one-time buyout that runs inside their walls ends the relationship — and the exposure — when the software is delivered.
Q: Why does local-first win conservative buyers over a cloud pitch?
A: Because the constraint is non-negotiable: the documents can never cross a network boundary. Once offline support is the architecture rather than a setting, security reviews and deployment decisions get simpler, and "your data never leaves" becomes a property they can verify rather than a promise.
Q: How do you distribute a product that regulated buyers never find through ads?
A: You show up where the constraint is named out loud — peer conversations at other institutions, audit firms, the exact moment someone says "we can't put this in the cloud." Cold funnels convert near zero; being verifiable converts.
Q: What does "verifiable" mean in practice for a privacy product?
A: It means a skeptical engineer can confirm the claims themselves: a written data-flow description, offline deployment steps, and a verification checklist they can hand to security without you in the room.
Q: Does private deployment cost more than a cloud subscription?
A: In the short term it needs your own compute, but ingestion is a one-time cost while queries repeat forever. Preprocessing that shrinks the token surface pays back on every query, and it removes the compliance risk of exporting sensitive data.
Try it now
If you are scoping a private knowledge base, these are good places to start:
- Products: https://www.uglypear.com/en/products/
- Home: https://www.uglypear.com/en/
- Blog: https://www.uglypear.com/en/blog/