Licensing Guide¶

CertifyClouds uses a tiered licensing model with feature gating based on your subscription level.

Licence Tiers¶

STARTER Tier¶

Entry-level licence for small teams getting started with Key Vault security.

Features Included:

• Key Vault scanning
• Compliance scoring
• Email and webhook alerts
• Audit logging
• Manual secret rotation (3 per month)

Limits:

• Maximum 4 Azure subscriptions
• Single user account
• 3 manual rotations per month

Best For: Small teams, initial evaluation, basic monitoring needs

PRO Tier¶

Full-featured licence for teams requiring automation and multi-cloud capabilities.

Everything in STARTER, plus:

• Secret Rotation (App Registration credential rotation)
• Multi-Cloud Sync (Azure to AWS/GCP)
• Dependency Mapping (resource impact analysis)
• Full-stack rotation (credential + dependent resources)
• SSO/OIDC authentication
• External Tenant Registry (Azure AD B2C and Entra External ID)
• Multi-user support

Limits:

• Up to 20 Azure subscriptions
• Unlimited users

Best For: Security teams, multi-cloud environments, automated credential lifecycle

ENTERPRISE Tier¶

Commercial package for larger Azure estates or customers needing custom legal, security, onboarding, or support terms.

Everything in PRO, plus:

• 21+ subscriptions or agreed subscription scope
• MSA, DPA, and signed support schedule
• Guided onboarding
• Procurement and security review support
• Dedicated escalation path
• Corporate Tenant Registry
• MCP Connector for approved read-only AI clients

Best For: Regulated teams, larger estates, and customers with procurement or support requirements beyond the standard Pro terms

Feature Comparison¶

Obtaining a Licence¶

Request Evaluation Licence¶

For a 30-day PRO evaluation licence:

1. Email [email protected]
2. Include:
3. Organisation name
4. Number of Azure subscriptions
5. Intended use case
6. Receive your evaluation licence key within 1-2 business days

Purchase Production Licence¶

Contact [email protected] with:

• Organisation name
• Desired tier (STARTER, PRO, or ENTERPRISE)
• Licence duration (annual recommended)
• Number of subscriptions

Activating Your Licence¶

Environment Variable¶

Set the CERTIFYCLOUDS_LICENSE_KEY environment variable:

# In .env file
CERTIFYCLOUDS_LICENSE_KEY=CC-XXXXXXXX-XXXXXXXX-XXXXXXXX

# Or via Azure Container Apps
az containerapp update \
  --name cc-uks-prd \
  --resource-group rg-cc-uks-prd \
  --set-env-vars CERTIFYCLOUDS_LICENSE_KEY=CC-XXXXXXXX-XXXXXXXX-XXXXXXXX

Verify Licence Status¶

After starting CertifyClouds, check the licence status:

Via API (replace localhost:8080 with your deployment URL if running in Azure):

curl http://localhost:8080/api/system/license/status | jq

Via UI: Navigate to Settings > Licence to view:

• Organisation name
• Licence tier
• Expiration date
• Feature availability

Licence Validation¶

How Validation Works¶

1. On startup, CertifyClouds validates your licence against license.certifyclouds.com
2. Validation confirms tier, expiration, and feature flags
3. Licence is cached locally for offline operation

Offline Operation¶

If the licence server is unreachable, CertifyClouds keeps working from its last validated licence for the grace period. After that, access is blocked until it can reach the licence server again.

• Grace period: 7 days by default, counted from the last successful validation. A licence can carry its own period (1 to 30 days), which takes priority over CERTIFYCLOUDS_LICENSE_GRACE_DAYS
• During the grace period: all features your licence includes keep working
• After the grace period: access to the application is blocked

Network Requirements¶

CertifyClouds needs outbound HTTPS access to:

• license.certifyclouds.com (licence validation)
• management.azure.com (Azure Resource Manager)
• *.vault.azure.net (Key Vault data plane)

Licence Expiration¶

Before Expiration¶

The licence server emails the contact address on your licence 30 days and 7 days before expiry.

On Expiration¶

When your licence expires:

• Access to the application is blocked
• Existing data remains in your database
• Contact [email protected] to renew

Renewal¶

To renew your licence:

1. Contact [email protected]
2. Receive your new licence key
3. Update the CERTIFYCLOUDS_LICENSE_KEY environment variable
4. Restart the application (or it will auto-validate on next check)

Upgrading Tiers¶

From STARTER to PRO or ENTERPRISE¶

To upgrade from STARTER to PRO or Enterprise:

1. Contact [email protected]
2. Receive your new licence key or Enterprise order terms
3. Update the environment variable
4. New subscription limits and licensed features become available immediately

No data migration required - your existing scan history, alerts, and settings are preserved.

Licence Security¶

What's in the Licence Key¶

Licence keys are cryptographically signed and contain your entitlements (tier, expiration, subscription limits, and enabled features). They cannot be tampered with.

What We Validate¶

During validation, we verify:

• Key authenticity
• Expiration date
• Usage limits (abuse prevention)

What We DON'T Send¶

Licence validation does NOT send:

• Azure resource names, IDs, or tags
• Secret values, certificate material, or any credential data
• Scan result content
• Audit log contents
• User-identifying information

What we DO send (opt-out)¶

Unless you switch off Share operational counts with licensing (on by default), the licence heartbeat also includes a small set of aggregate, anonymous operational counters, such as how many scans have run and how many items are nearing expiry, used solely to help us support and improve your deployment. It never includes names, resource identifiers, secret values, or scan contents. You can switch this off at any time in Settings → Advanced → App behaviour, and the data is retained for a maximum of 30 days.

Feature Gating¶

When you attempt to use a PRO feature on a STARTER licence, CertifyClouds returns HTTP 403 with a LICENSE_REQUIRED error code naming the tier you need. The dashboard surfaces this as a lock icon and an upgrade prompt on the relevant page - no error toast on click. The exact response body shape lives in your deployment's /docs.

FAQ¶

Can I try PRO features before purchasing?¶

Yes. Request a 30-day evaluation licence with full PRO features from [email protected].

What happens if I exceed subscription limits?¶

On STARTER tier (4 subscription limit):

• Adding a 5th subscription returns an error
• Existing subscriptions continue to work
• Upgrade to PRO for up to 20 subscriptions, or Enterprise for larger estates

Can multiple installations use the same licence?¶

No. Licence keys are tied to a single installation. For multiple environments (dev, staging, prod), contact sales for appropriate licensing.

Is the licence hardware-locked?¶

No. You can move CertifyClouds between servers or containers without issues. The licence is validated against our server, not tied to specific hardware.

Support¶

For licensing questions:

• Sales: [email protected]
• Technical Support: [email protected]