Licensing and activation

A self-hosted Kutrion reads its entitlements — tier, seat count, and term — from a signed offline license file instead of the hosted billing catalog. It is verified locally, so it works fully air-gapped: nothing phones home to activate.

How licensing works on-prem

Set DEPLOYMENT_MODE=onprem (the default for the bundle) to read entitlements from a signed .vtlic file. The file is verified locally against a built-in vendor public key, so there is no activation call and no license server to reach.

Variable	Purpose
DEPLOYMENT_MODE=onprem	read entitlements from the offline license; saas opts out
LICENSE_PATH	path to the .vtlic file (mounted into the container, e.g. /data/license.vtlic)
LICENSE_STATE_PATH	durable store for the monotonic anti-rollback counter; point at a persistent volume

Place the issued license.vtlic in the host directory bind-mounted to /data (by default deploy/onprem/license/); the anti-rollback counter state persists alongside it.

What the license grants

Besides tier, seats and term, a license can carry two optional claims. Each is part of the signed claims, so an operator cannot add or change one without invalidating the signature.

• private_mode decides whether an organization can be switched to Private vault (the org’s vault_mode). A license without it keeps every organization in Connected vault, whatever its tier, and an owner’s attempt to choose Private vault is refused with a message saying the deployment’s license does not include it. With the claim, the same rules as the hosted service apply: Private vault is offered to the owner of a personal organization on a FREE or PRO license tier.
• limits sets per-deployment values for devices, file_connections, items, attachment_bytes, concurrent_sessions, ai_requests and file_protocols, under the same names as the hosted plans. A key the license leaves out keeps the tier’s default; null means unlimited (for file_protocols, every transport).

The vendor sets both when issuing the license, with --private-mode and --limit key=value. A license with a malformed claim is rejected as malformed. When the license lapses past its grace window, both claims stop applying along with the rest of the paid terms.

Signature: Ed25519, optionally quantum-safe composite

The .vtlic is signed by the vendor and verified locally. Two signature algorithms are supported:

• Ed25519 — the baseline signature, verified against the built-in vendor public key.
• Ed25519 + ML-DSA-65 composite — a quantum-safe option (alg=ed25519+ml-dsa-65) that verifies only if both signatures hold. Ed25519-only licenses still verify, so moving to the composite is a key rotation, not a flag day.

Override the built-in verification keys (LICENSE_PUBLIC_KEY, LICENSE_MLDSA_PUBLIC_KEY) only for key rotation. See Keys and licensing config for the full variable set.

Boot enforcement and expiry

Under NODE_ENV=production the server refuses to boot if the license is missing, malformed, forged, or rolled back — that is, presenting an older counter than the last one seen. The anti-rollback counter in LICENSE_STATE_PATH is monotonic, so a replayed or downgraded license is rejected even offline.

An expired license is not a hard outage. It is honored through a shared grace window, then lapses to free-tier limits — a late renewal degrades gracefully rather than taking the install down. The distinction is deliberate: a forged or rolled-back license is fatal at boot; an honestly expired one degrades.

Installing a renewal

There are two ways to install a renewal:

1. Admin console (preferred, no restart). Sign in to the admin app and open the License view. It shows the current lease — tier, seats used and sold, days to expiry, grace — and accepts the renewed .vtlic pasted in. The server re-verifies the signature and the anti-rollback counter before writing the file, then hot-reloads entitlements with no SSH and no restart. The action is step-up gated and audited.
2. File drop. Copy the renewed .vtlic into the license directory and restart the app container.

Issuing is a vendor operation

Issuing and renewing a license is a vendor-side offline operation — the signing private key never leaves the vendor’s signer. Operators receive an issued .vtlic file; they do not generate one. This keeps the trust root off every customer host while letting verification happen entirely offline.

Next

• Keys and licensing config — every licensing variable.
• Air-gapped install — offline install, including offline license verification.
• Backups and recovery — optional license-bound master key and escrow.