Licensing & activation

The controller is always free to run. Paid editions (Pro, Ultimate, Enterprise) unlock features by installing a license issued by the Tessera portal for your organization. Without a valid license the controller runs in Community mode — full brokering, no paid governance features.

What a license is

A license is a small, signed token that states your plan, seat count, expiry, and the features you’re entitled to. It is:

Signed with the portal’s Ed25519 keys. Released/customer builds bake the portal’s master public key at build time and verify the full chain master → org → license locally, with the signing algorithm pinned — a tampered or re-signed license is rejected. The operator-supplied TESSERA_LICENSE_PUBKEY applies only to dev/legacy self-verify builds.
Encrypted — the signed claims are wrapped (AES-256-GCM) into an opaque bundle, so the license file doesn’t leak your plan details at rest. A production portal issues master-certified tlic2.… chained bundles (the org key is certified by the portal’s master key); tlic1.… is the dev/self-signed (no-master) variant only.

The controller checks the license offline — there is no per-connection phone-home. Features are gated locally by what the verified license grants.

Two ways to run it

Both install the same kind of file. The difference is who keeps it up to date, and it is the choice that matters most — pick the wrong one and the controller stops on a date nobody wrote down.

Connected — the licence renews itself

Link the controller to your portal organization once and it pulls its licence automatically. Renewals, plan changes, extra seats and cancellations all reach it on their own, usually within the hour. This is the right choice for any controller that can reach the internet, including one behind a proxy or a strict egress allow-list — the only host it needs is portal.tessera.company.

Linking uses a one-click consent flow in the portal (the owner approves), after which the controller holds an activation token (tac_…).
The activation token is an opaque bearer credential used only to pull the licence — it grants no other access and can be rotated from the portal at any time. Rotating it disconnects any controller still using the old token until you reconnect it.
Each pull sends two things about the controller itself: a random identifier it generates on first run, and its version. That is the complete list. Your account page uses them to show how many controllers are running on the subscription, and support uses the version to know what you are on. No user names, target names, session data or addresses are sent — the pull asks for an entitlement and reports nothing about what you do with it.
The token a connected controller holds is valid for up to 30 days at a time and is replaced well before that. You never see the date and never act on it. It exists so that a licence we withdraw cannot outlive the withdrawal indefinitely on a controller that has been unplugged.
If the portal is briefly unreachable, nothing happens: the controller keeps running on the licence it holds, which has weeks left on it. Only if that licence also runs out during the outage does a one-hour cushion apply, and then Community. This is an outage cushion, not a billing grace period.

A licence pasted or set via TESSERA_LICENSE on a controller that is otherwise connected is a starting point, not a subscription. It carries the same 30-day cap. Link the controller, or use the air-gapped licence below.

Air-gapped — the whole paid period in one file

For an installation that genuinely cannot reach us: License → Air-gapped deployment in the portal issues a file covering your entire paid period — a year on an annual plan — instead of the rolling 30-day window. It needs no connection at any point.

Because that file works with no way for us to reach it, it is also a file we cannot recall. So requesting one ends the voluntary 14-day refund for that subscription, and the portal asks you to confirm that in as many words before anything is issued. Your other remedies are untouched: a failure to deliver, a duplicate charge or a billing error is refunded either way — see the refund policy. If you are not sure you need this, you do not: choose connected mode, keep the refund, and nothing about the product differs.

Renewals are not automatic here — nothing can reach the controller to renew anything. When the subscription renews, a new file is waiting in the portal and someone has to install it. We email the account owner 30 days and 7 days before the file expires, and the controller’s own licence panel starts warning at the same 30 days.

Install it at Settings → License → Install, or via TESSERA_LICENSE (a literal token, or @/path/to/file). A released controller requires the master-certified tlic2.… bundle a production portal issues; tlic1.… is the dev/self-signed form only. Replacing the value and restarting installs the new licence.

One thing to know about the offline file. It is a signed file, so nothing in it stops it being copied onto a second controller — which is why a controller running one reports in once a day if it can reach the internet. It sends the licence it is running, a random identifier it made up on first start, and its version, to https://portal.tessera.company/api/license/checkin. That is the whole payload: no users, no targets, no sessions, no commands.

If your network is actually isolated the report never leaves, the licence panel will say it has never reached the portal, and the controller carries on exactly as before — that is the normal, expected state for an air-gapped install, not a fault. Silence always means carry on. You are free to block it outbound; we would rather write that here than have you find it in a packet capture.

There is one answer the controller acts on. If the report arrives and we reply that this licence has been withdrawn — a refund, a cancellation, a licence reissued in its place — the controller falls back to Community rather than running to the file’s own expiry date. Nothing is deleted, and installing a current licence restores everything. No other reply changes anything, including “we do not recognise this token”, which has innocent explanations and is ignored.

Its other purpose is to show us when one licence file is running in more places than it was sold for, and what happens then is EULA section 2: we contact you first.

A connected controller does not do this — it is already counted every time it pulls.

Expiry and downgrades

Subscriptions renew automatically; you keep your edition through the paid period. Tessera does not use a grace period after a licence actually expires — when it lapses, paid features lock immediately and the controller falls back to Community behavior (your data and targets are untouched; brokering keeps working). Access control does not lapse with it: a controller whose licence expired keeps enforcing the roles and read-only rules that licence granted, rather than opening up.

What warns you depends on which mode you are in:

	Connected	Air-gapped
Licence file valid for	up to 30 days, replaced automatically	the whole paid period
Renewal	automatic, nothing to do	install the new file yourself
Warnings before expiry	not needed — you never reach the date	email at 30 and 7 days, plus a banner in the controller
Cancellation reaches the controller	within the hour	on the next daily check-in, or at the end of the paid period if it cannot reach us
14-day refund	yes	given up when the licence is issued

The portal also emails the account owner before a cancelled subscription’s period ends, and before an annual subscription renews, in either mode.

Defense in depth

Feature gating is enforced in more than one place: the license manager and an independent consistency check must both agree before a paid feature is allowed. This makes a single tampered check insufficient to unlock features.