Provisioned users vs billed users

Hello,

A couple of questions about the 1P for business. We use OneLogin, so I'm really digging being able to provision users through that. How does the billing work? Is it how many users are actually using 1P, or would we need to sign up for the maximum possible number of users (ie the entire company)?

Second, I know I'm going to get asked this question: where is the 1P vault data stored? Are we able to store the vaults ourselves in our own systems so that we can stay in line with our contractual compliance terms?

Related #1: we are already using Hashicorp Vault for our systems automation. It's a really great product, and I don't see us switching away from it. Despite having a rudimentary web UI, Vault is not meant as a user-facing tool like 1P. This is a long shot, and it's making me think about passwords used by people need to be different from passwords used by computers (they're different entities, so should have their own account/passwords) -- but is there any sort of 1P-vault integration? For example, is 1P able to use Vault as a backend for storage? Is 1P able to call Vault, maybe using a plugin? I haven't completely thought out the use cases, just kind of rolling it around in my head.

Related #2: Is there any sort of API or other automated/programmatic means of configuring 1P - the sort of admin level settings that the docs talk about? We use Terraform extensively, including for our Vault stack and some of our OneLogin applications. I see there's a 1P TF module in the registry, but that looks like it's only managing the actual password data - maybe for 1P enterprise?

thanks!

1Password Version: n/a
Extension Version: n/a
OS Version: n/a
Sync Type: n/a