---
id: licensing-and-entitlements
title: Licensing and entitlements
sidebar_label: Licensing and entitlements
---

A **licence** is a signed statement of what one instance may do. An
**entitlement** is the configuration a licence is cut from.

## Tiers

Three tiers, in both deployments. The allowances are identical across cloud and
self-hosted; what differs is the term on offer, not what you get.

|                       | Free      | Professional | Enterprise            |
| --------------------- | --------- | ------------ | --------------------- |
| Servers (base)        | 3         | 5            | 10                    |
| Monitors              | 3         | unlimited    | unlimited             |
| Secret groups         | 1         | unlimited    | unlimited             |
| Notification channels | 1         | unlimited    | unlimited             |
| Audit retention       | 30 days   | 365 days     | unlimited             |
| Support               | Community | Email, 24×5  | Email and phone, 24×7 |

The server count is **metered**: the base allowance comes with the tier, and you
buy additional servers on top. That is why Professional shows a real number
rather than "unlimited": the number you actually have is the one in your
entitlement.

## Features

Four features are enabled per instance rather than bundled into a tier:

| Feature                | What it enables                                                                 |
| ---------------------- | ------------------------------------------------------------------------------- |
| Browser console        | The [browser console](../vantage/browser-console.md)                            |
| Single sign-on         | [Sign-in through your identity provider](../vantage/settings.md#single-sign-on) |
| Vulnerability scanning | [Package vulnerability scanning](../vantage/vulnerabilities.md)                 |
| Status pages           | [Public status pages](../vantage/status-pages.md)                               |

No tier includes them by default; you enable them on the instances that need
them.

## Entitlements: desired and granted

Each instance has one entitlement row holding two configurations:

|             | Meaning                      |
| ----------- | ---------------------------- |
| **Desired** | What you last asked for      |
| **Granted** | What a payment has confirmed |

Checkout is built from **desired**. A licence is only ever signed from
**granted**. An abandoned checkout therefore leaves a desired that reached
nothing and changed nothing.

### Increases and reductions

An increase takes effect when payment confirms, and the entitlement is promoted
desired → granted.

A **reduction** is scheduled rather than immediate: you keep what you paid for
until the end of the term, and the portal shows the date it drops. The collapse
happens at renewal.

## What a licence carries

Your instance ID, whether it is cloud or self-hosted, the tier, your limits,
which features are enabled, and when it expires. All of it is signed.

Two properties follow from that:

- **A licence works for one instance only.** Moving it to a rebuilt install
  takes a [relink](./self-hosted-instances.md#relinking).
- **A licence is a snapshot.** Changing a plan later does not rewrite a licence
  already issued.

Verification is local. Your instance does not call HQ to check a licence, and
signing happens only in HQ.

## Expiry, grace and degraded mode

Expiry is padded with a few days' grace. Past that, an instance goes into
**degraded mode**, which means:

- It keeps running, and all of your data stays exactly where it is.
- You can still sign in and read everything.
- Adding or changing anything is refused.
- Deleting things still works, so you can get back under a reduced allowance.
- Applying OS updates still works, because security patching is never blocked.

A brand-new self-hosted install behaves the same way until you install its first
licence.

The way out is a current licence: renew or purchase, then paste it
(self-hosted) or let it be written for you (cloud).

## Server limits in practice

When you exceed your server allowance, enrolling another one is refused. The
existing fleet is unaffected. Raise the allowance in the portal, or remove a
server you are not using.