Control CoreDocs

License Management

This guide explains how Control Core licensing works and how to manage your license connection to ensure uninterrupted platform access.

Commercial model and license context

Control Core is delivered as two commercial tiers—Kickstart (zero-cost pilot in your infrastructure) and Custom (production scale)—per controlcore.io/pricing. There is no vendor-operated Control Plane; the platform always runs on your infrastructure.

What this means operationally:

  • Policy managers, compliance officers, security engineers, CIAM administrators, and auditors can author, test, simulate, and review controls without per-seat or per-decision commercial barriers. Governance workflows are bounded by deployed Bouncer count, not headcount.
  • Licensing telemetry exists to keep Bouncer-count-based invoicing accurate and to gate certain features while a valid subscription agreement is in place.
  • Your investment in the platform accelerates control delivery: policies are reusable across new Bouncers and resources, so adding a protected service does not require rebuilding authorization logic from scratch.

Overview

The Control Plane connects to the Control Core License Server to:

  1. Verify subscription status (Kickstart pilot window or Custom active)
  2. Enable certain feature gates (policy testing and production promotion)
  3. Submit the minimal monthly Bouncer-count telemetry payload used for invoicing

Understanding License Requirements

What Requires License Connection

Certain features require an active connection to the License Server:

  • Policy Testing: Testing policies before deployment
  • Production Promotion: Promoting policies from Sandbox to Production
  • Subscription Verification: Keeping subscription tier current

What Works Without License Connection

You can use these features without License Server connection:

  • Create and edit policies
  • View policies and templates
  • Manage users and roles
  • Configure settings
  • View audit logs and dashboards

Note: While you can create policies without a license connection, you cannot test them or deploy them to production until the License Server is configured.

Subscription tiers

Kickstart

  • Purpose: Zero-cost pilot to prove value in your environment before committing to full production scale
  • Footprint: Single-instance; see Kickstart deployment guide
  • License gate: Feature gates (policy testing, production promotion) require License Server connection and active pilot status
  • After pilot: Move to Custom to expand Bouncer coverage and production topology

Custom

  • Purpose: Production-scale deployment aligned to your organisation's Bouncer fleet and operations model
  • Footprint: Multiple instances, Kubernetes-capable; see Enterprise deployment and scaling
  • License gate: Same pattern — License Server connection required for feature-gated actions
  • Bouncer billing: Monthly telemetry payload reports deployed Bouncer count for reconciliation (see Monthly Bouncer Licensing Telemetry)

For commercial packaging, see Licensing and deployment options and controlcore.io/pricing.

Setting Up License Connection

Step 1: Access Telemetry Settings

  1. Log in to Control Core admin console
  2. Navigate to Settings → General
  3. Click on the Telemetry tab

Step 2: Enter API Key

  1. Enter your API Key in the API Key field

    • Provided by Control Core during setup
    • Used for secure authentication
    • Stored encrypted in the database

  2. Click Show to reveal the API key if it's already configured

License Server URL is server-managed. It is baked into the Control Plane at deploy time and is no longer customer-configurable. The UI shows only a License Server: connected badge.

Step 3: Test Connection

  1. Click Test Connection button
  2. Wait for the connection test to complete
  3. Review the result:
    • Success: Connection is working correctly
    • Failed: Check API key, verify outbound network connectivity

Step 4: Save Configuration

  1. Click Save to store your configuration
  2. Configuration is saved immediately
  3. License verification will begin automatically

Step 5 (optional): Apply an Extension Code

If your trial has expired and Control Core support has issued you an Extension Code, paste it into Apply Extension Code in the same panel and click Apply. See License Enforcement → Apply Extension Code for the full workflow, error matrix, and audit trail details.

License Tokens & Bouncer Activation

Once your Control Plane is connected to the License Server, Control Core automatically manages all required cryptographic material:

  • License Tokens: The Control Plane maintains a signed license token that proves your subscription tier. Tokens refresh automatically—no manual download is required. If the Control Plane cannot refresh a token, the UI will warn you before license-gated actions pause.
  • Bouncer Activation: Each Control Plane issues activation keys to its paired bouncers. When the Control Plane loses its license token, those bouncers will enter a safe “inactive” state until the connection is restored.
  • What You Need To Do: Keep the License Admin URL/API key configured and allow outbound HTTPS access. There are no additional keys or certificates for you to manage.

Telemetry Authenticity & Replay Protection

Telemetry that feeds billing and license compliance is now cryptographically signed:

  • Every payload includes a unique nonce, timestamp, and HMAC-SHA256 signature.
  • The License Server validates signatures and rejects replayed payloads within a five-minute window.
  • This ensures license counts, bouncer totals, and usage-based billing cannot be tampered with in transit.

No extra configuration is required, but make sure your Control Plane clock remains accurate so timestamps stay within the acceptance window.

Monthly Bouncer Licensing Telemetry

Control Core sends a dedicated monthly licensing payload from your Control Plane to the License Server (business-admin.controlcore.io) for perpetual-license reconciliation.

  • Cadence: Monthly (1st day of month, 2:00 AM UTC by default).
  • Window: Previous calendar month (period_start and period_end).
  • Minimal fields: customer_id, period_start, period_end, bouncer_count, plus transmission metadata.
  • Security: HMAC signature + nonce + timestamp headers are mandatory and replay-protected.

This monthly payload is intentionally minimal and focused on deployed bouncer count to keep billing telemetry simple and auditable.

Understanding License Status

Checking License Status

You can check your license status in several ways:

  1. Subscription Page: Navigate to Settings → General → Subscription tab

    • View current subscription tier
    • Check trial expiration date (if on Kickstart plan)
    • See license connection status

  2. Telemetry Health: Navigate to Settings → General → Telemetry tab

    • View connection status
    • Check last successful transmission
    • Review recent errors

  3. Feature Access: If policy testing or production promotion is disabled, check the error message for license status

License Status Indicators

  • Connected: License Server connection active, all features available
  • Not Connected: License Server not configured, policy testing/production promotion disabled
  • Trial Expired: Trial period ended, upgrade required for production deployment
  • Connection Error: License Server connection failed, check configuration

Feature Access

Policy Testing

Requirement: Active License Server connection

How to Enable:

  1. Configure License Server connection (see above)
  2. Test connection to verify it's working
  3. Policy testing will be automatically enabled

If Disabled:

  • Error message: "Connect to Control Core License Server in General Settings (Telemetry tab) to enable policy testing"
  • Solution: Configure License Server connection

Production Promotion

Requirement: Active License Server connection + valid subscription

How to Enable:

  1. Configure License Server connection
  2. Verify subscription tier is active
  3. For Kickstart plan, ensure trial hasn't expired
  4. Production promotion will be automatically enabled

If Disabled:

  • Check License Server connection status
  • Verify subscription tier is active
  • For Kickstart plan, check trial expiration date
  • Contact support if issues persist

Trial Management

Understanding Trial Periods

Kickstart Plan:

  • 30-day trial period from signup
  • All features available during trial
  • Trial expiration date displayed on Subscription page
  • After expiration, upgrade required for production deployment

Trial Status

  • Active: Trial is active, all features available
  • Expiring Soon: 7 days or less remaining (warnings appear)
  • Expired: Trial ended, production promotion disabled

Extending Trial

To extend your trial period you have two options:

  1. Apply an Extension Code (offline-friendly) — Contact support@controlcore.io with your customer email. Support generates an ES256-signed, single-use Extension Code and emails it to you. Paste it into Settings → General → Telemetry → Apply Extension Code and click Apply. The trial window extends immediately and the redemption is reported back via the next telemetry tick. See License Enforcement → Apply Extension Code.
  2. Online subscription update — Contact support@controlcore.io; the License Server updates your trial_end_date and the change propagates on the next telemetry sync.

Bouncer Pair Licensing

Understanding Bouncer Pairs

A bouncer pair consists of:

  • One Control Plane instance
  • One bouncer serving both Sandbox and Production environments

License Allocation

  • First Pair: Included free with all plans
  • Additional Pairs: Require additional licensing
  • Tracking: Telemetry automatically tracks bouncer pairs for license verification

Viewing Bouncer Pair Count

  1. Navigate to Settings → General → Telemetry
  2. View Current Period Data Preview
  3. Check bouncer pair information in telemetry data

Troubleshooting

Cannot Test Policies

Symptoms:

  • Policy testing button is disabled
  • Error message about License Server connection

Solutions:

  1. Navigate to Settings → General → Telemetry
  2. Verify License Admin URL is configured
  3. Verify API Key is entered
  4. Click Test Connection to verify connectivity
  5. Save configuration if changes were made

Cannot Promote to Production

Symptoms:

  • Promote button is disabled
  • Error message about license requirements

Solutions:

  1. Verify License Server connection is configured and active
  2. Check subscription tier on Subscription page
  3. For Kickstart plan, verify trial hasn't expired
  4. Test License Server connection
  5. Contact support if subscription status is incorrect

License Server Connection Fails

Symptoms:

  • Connection test returns failure
  • Telemetry health shows "unhealthy" status

Solutions:

  1. Verify API Key: Ensure the API key is correct and not expired
  2. Check Network: Verify firewall allows outbound HTTPS to the License Server
  3. Review Logs: Check backend logs for detailed error messages
  4. Contact Support: If the issue persists, contact support@controlcore.io (the License Server URL is managed by Control Core and is consistent across deployments, so it is not a customer-configurable field)

Trial Expired Message

Symptoms:

  • "Trial period has expired" message appears
  • Policy create / activate / promote return HTTP 403 with code: license_required_for_create or license_required_for_activate

Solutions:

  1. If support has emailed you an Extension Code, apply it via Settings → General → Telemetry → Apply Extension Code (see License Enforcement → Apply Extension Code).
  2. Check trial expiration date on Subscription page
  3. Contact support@controlcore.io to:
    • Request a fresh extension code
    • Upgrade to Custom plan
    • Verify subscription status

Subscription Tier Not Updating

Symptoms:

  • Subscription tier doesn't match License Server
  • Tier changes don't reflect in Control Plane

Solutions:

  1. Verify License Server connection is active
  2. Check telemetry transmission is working (view transmission history)
  3. License Server webhook should update tier automatically
  4. Contact support if tier doesn't sync after 24 hours

License Health Alerts

Control Core now categorizes license connectivity into three states:

  • Healthy: License token and telemetry are current, all bouncers are activated.
  • Warning: Token is close to expiring, telemetry is delayed, or some bouncers need to refresh activation. Review your telemetry configuration and network egress.
  • Critical: License token expired or telemetry has been offline beyond the grace window. Policy testing and promotion pause until the License Server connection is restored.

You can view the current status in Settings → General → Telemetry. The Control Core team monitors the same data through the Business Admin console and will reach out if a warning escalates.

Manual Billing & Payment Links

Usage-based licenses (for example, extra bouncer pairs) are tallied through telemetry. When an additional charge is due:

  1. Control Core Support emails a secure Stripe payment link referencing the billing month (for example, Manual billing for 2025-11).
  2. The link always points to https://pay.stripe.com and can be opened in any browser.
  3. If you require a PO or clarification, reply to the email—there is no need to resend telemetry because the data is already stored on the License Server.

This process eliminates PDF invoices while keeping the workflow auditable for both teams.

Best Practices

Maintaining License Connection

  1. Monitor Connection Status: Regularly check telemetry health status
  2. Review Transmission History: Check for transmission failures
  3. Test Connection Periodically: Verify connectivity after network changes
  4. Keep API Keys Updated: Rotate API keys before expiration

Trial Management

  1. Track Trial Expiration: Monitor trial days remaining
  2. Plan Ahead: Request extension or upgrade before trial expires
  3. Understand Limits: Know what features require active subscription

Security

  1. Protect API Keys: Never share API keys publicly
  2. Use HTTPS: Always use HTTPS for License Server connection
  3. Enable Encryption: Enable data encryption for telemetry transmission
  4. Enable Anonymization: Enable PII anonymization for compliance

Support

For license-related issues or questions:

  • Email: support@controlcore.io
  • Documentation: See related guides above
  • Troubleshooting: Check troubleshooting section in this guide