What’s the business model? Is this FOSS or just OSS?
1. For the managed Cloud product, it'a typical freemium model, where we have a pretty generous free tier, and you can upgrade if you need more features or higher limits than the free tier.
2. For the open source version, almost all the features (especially the ones that are needed by individual developers and small teams) are completely free with the exceptions of some managerial/compliance features (e.g., audit logs, potentially certain types of 2FA). These managerial features require a license. Some of these paid features are still under development. Plus, for the open source version, we also sell support packages to help with redeployments/maintenance/emergency situations.
If 2fa is the only way you can differentiate in order to force enterprises to pay, it’s better to have a fee for security than to die because you can’t make money… but broadly, as a security company, you should aim for maximum security for every user.
If I were in your position, I’d start out by making security features available to everyone and then only if you feel you don’t have a choice would you put them behind a paywall — and at that point, you can grandfather existing customers in to these features for free.