Editions, packs and options

What is sold

The unit of sale is an installation — not a seat, not a run.

An edition is the composition of what was delivered and declared in that installation’s licence, not a decision taken at run time: what is not in the delivery cannot be turned on. Three editions ship today, and their composition moves with the product rather than with this page. One property survives every change: a lower edition’s composition is a subset of the higher one’s. A capability that vanished on the way up would make the move up unpayable, so that rule is checked first.

Packs and options

An industry pack is a vertical add-on for one industry: masking profile, connectors, skills, instruction template, decision matrix. An option is a horizontal add-on with no industry attached, and any option fits any edition. Both are bought in addition to an edition, never instead of one.

Where the boundary holds, and where it does not

The boundary rests on two things: what the delivery artefact contains, and what the licence declares. Capabilities are computed in one place, with the edition as one input rather than a mechanism laid over the top, so a capability outside your edition is not selectable and states the reason it is not. Divergence between the declaration and the installed composition is observable state.

We do not claim the boundary cannot be crossed inside your own cluster. Your administrator has full rights there, so the edition boundary is contractual. We say so rather than leave it unsaid.

There is no usage axis either — no run counter, no trace volume, no seat count — because no telemetry travels back to us.

The licence

The licence is a signed document: installation identifier, edition, packs, options, term, grace period. Signed rather than encrypted, because what is needed is authenticity, not secrecy: the contents are known to you, and forgery is what must be impossible. The signing key never leaves us, and only the verification key ships.

Verification is local, with no network access on the verifying path, so an installation without internet keeps working. The licence is bound to an installation identifier created at first start, so one issued for another installation is rejected; a restore from backup or a move needs a declared reissue. A clock moved backwards is caught by a monotonic mark of the highest moment ever observed.

Renewal

Renewal is one string: your administrator pastes it in and the new term takes effect, with no port opened and nothing calling home. A licence ending earlier than the one in force is rejected, so renewal cannot shorten a paid term. Every attempt, accepted or rejected, reaches the audit trail.

When a term ends

A warning appears a declared period before expiry. Two periods follow, both carried inside the licence rather than configured on the installation — otherwise they would be extended by the party they constrain. The defaults are three days and thirty days; your licence carries the values that apply to you.

During the grace period the platform runs in full composition. When grace ends, new operations stop and the wind-down period begins: authentication, the subscription screen, export and deletion remain. A request still waiting on a person is refused rather than left to vanish. After wind-down, only the subscription screen remains.

Expiry does not move the installation to a lower edition. Nothing is deleted in any of these states, permissions are enforced in all of them, and a valid licence entered at any point resumes work with nothing lost.

Export and deletion

Export covers agent settings in machine-readable form, conversations with their attachments, and the artefacts your agents produced, with a manifest of what went in and what did not. It is scoped to one organisation, never includes secret values, and stays available after grace has run out.

Deletion is separate, and the order is deliberate: take the data out first, delete it second. It is irreversible, announced as such before it runs, scoped to one organisation, and reaches derived and cached copies. It leaves a record — kinds, counts, moment — that outlives the data and contains none of it.