Licensing
How licensing works
Written for the people who approve software for restricted networks: what each licensing mode needs, what it sends, and how long a license keeps working without contact.
Three ways to license a machine
1. Online, with a license key
For machines that can reach license.nubestack.com over HTTPS. Paste the key once. The app renews its 30-day license about every 24 hours and keeps working for up to 30 days if it cannot connect. From OpsPilot 0.3.0, while the app is open and the computer is in use, it also asks the license server every few minutes whether this computer is still licensed.
2. Offline, with a request code
For machines with no network route. The app shows a 25-character code; an administrator enters it in the portal on any connected computer and carries back a signed license file. The offline machine never makes a connection.
3. Deployment license
For sites where not even a code may leave. NubeStack approves an organisation-wide license file covering a stated number of seats, which IT deploys with its usual tools. Nothing leaves the site at any point.
What the license check sends
Only online activation (mode 1) makes network requests, and only to license.nubestack.com: the activation; a renewal about once a day; a download of the signed revocation list about once a day, which sends only the product and the number of the list it already has; a deactivation when you release the computer from the app; and, from OpsPilot 0.3.0, a quick check every few minutes while the app is open and the computer is in use. The activation, renewals, deactivations and quick checks contain:
- the license key, only on first activation (the others prove possession with a per-device secret instead of re-sending it);
- a device fingerprint: a one-way SHA-256 hash of the machine ID, the operating-system user and the product name;
- the device label you choose and the operating system family (on activation only), and the app version;
- from OpsPilot 0.4.0, on activation only, whether the key was set by your IT team in the app’s policy file (
policy.json) rather than typed; your organisation’s admins then see that device marked “Key set by IT” in the portal; - a random nonce and timestamp, which stop an activation, renewal or deactivation being replayed (a replayed quick check could only repeat the same answer).
It never sends host names, user names, IP addresses of your servers, connection details, terminal output, AI prompts or usage data. Offline and deployment licenses send nothing at all, and administrators can disable online activation entirely by policy.
The quick check only asks whether this computer is still licensed. The license server records nothing about it, apart from short-lived rate-limiting counters kept in memory. The renewal records the date of each device’s last renewal, which your organisation’s admins see in the portal.
Network and proxies
Online activation needs outbound HTTPS (port 443) to license.nubestack.com and nothing else. The app uses the operating system’s proxy settings and trusted root certificates, so TLS-inspecting proxies work: licenses are protected by digital signatures, not by the connection.
How long a license keeps working
| Situation | Validity |
|---|---|
| Online machine that cannot reach the license server | Up to 30 days from its last successful renewal |
| After a renewal payment fails or a subscription ends (online) | 7 more days after the paid period |
| Offline license files and deployment licenses | The paid period plus 14 days (at most 400 days per file) |
| Files issued in the first 60 days of a new card subscription | Until day 74; the full-term file is available from day 60 |
| Invoiced subscriptions awaiting payment | Until 15 days after the invoice due date, then the full term once paid |
When a license expires, the terminal keeps working with the limits that apply without a subscription: AI features are off, up to 10 sessions can be open at once, and only the first 10 saved connections (the ones created first) can be opened. Sessions already open are never closed, and the other saved connections and every setting are kept. A renewed license lifts these limits at once, and AI comes back by itself in open sessions, except where the user turned it off. Offline sites get reminder emails 30, 14 and 3 days before their newest files expire.
Seats and devices
Each seat is one person, with its own key, on up to 2 machines (online and offline activations count together). Replacing a machine is self-service: release the old device in the app or the portal. A few releases per month take effect immediately; beyond that a released device frees its slot when its license would have expired, which keeps keys from being passed around. A computer activated online and released in the portal stops using that license at its next renewal, usually within a day (from OpsPilot 0.3.0, within about 5 minutes while the app is open and online); one that is off or offline stops the next time it starts or connects, and at the latest when its current license ends. A computer activated offline stops when a revocation list reaches it or its license file expires. Either way, AI then turns off unless that computer is still in its free trial or has another license. Online devices that stop renewing are released automatically after 45 days.
Verifying licenses yourself
License files are plain text (.opslic) containing a JSON Web Signature (ES256). The app trusts only the NubeStack public keys built into it and never downloads keys. The current public keys are published at /.well-known/nubestack-license-keys.json for your security team to inspect.