Licensing¶

Every EnforceGate vX deployment runs one of three editions — Pro, Business, or Enterprise — self-hosted, sending no telemetry, and running fully air-gapped after first-boot activation.

Editions¶

• Pro — available now. The full self-hosted secure web gateway for small deployments and technically self-sufficient teams: engine and URL match engine, the operator CLIs (eghost / egctl / egpolicy), the standard captive portal (block / warn / AUP), git-backed policy authoring, the community script ecosystem (EGGuard and others), and Exosys Curated Domain Lists (60+ operator-selectable categories, served entirely on-box). 25 bundled connector sessions per engine. Bundled Direct support.
• Business (in development) — for SMEs and MSPs. Adds the Advanced captive portal (user-aware, so pages and acknowledgements attach to a person rather than an IP), Active Directory integration, and the TLS proxy connector (an SSL-bumping inline connector that mirrors decrypted HTTP traffic in clear-text out a dedicated ethernet interface for an IDS to inspect). 40 bundled connector sessions. Bundled Advanced support.
• Enterprise (in development) — for corporate, government and large fleets. Adds RADIUS alongside Active Directory, operator SSO / SAML / RBAC, multi-tenancy and fleet management, full compliance exports with an audit log, and the included NGFW modules. Enterprise also ships two AI-assisted surfaces: AI-driven anomaly and threat detection (traffic-outlier identification, phishing / C2 detection acted on in the request path — self-hosted, no traffic egress) and the Enhanced captive portal, whose on-portal AI assistant explains blocks to the visitor in plain language. 50 bundled connector sessions. Bundled Premium support.

Every edition ships the core gateway — no essential filtering, inspection or policy control is locked behind a higher tier.

Business and Enterprise are in development. Pro is generally available today; see enforcegate.com for current pricing and availability.

Never bricks on a license lapse¶

The engine keeps filtering regardless of billing state — an inline gateway that stops passing traffic when a card expires or a Control Server round-trip fails is disqualifying for production deployments and MSPs. The licensing layer is fail-open on every path:

• Expired license → 21-day grace window. Full entitlements (edition + connector cap) are preserved for 21 days after expiry; the engine keeps enforcing the last-loaded policy, prints a loud renewal reminder, and continues to filter every request. Renewal is a fresh license drop — no phone-home required, so the flow stays offline-friendly.
• Past the grace window → reduced-capability floor. The engine falls back to a reduced floor — 10 concurrent connector sessions and the curated feed disabled — but keeps serving traffic. No hard exit, no traffic disruption.
• Absent / rejected / unreachable Control Server → the same floor. An air-gapped host awaiting an offline license, or a temporary Control Server outage, degrades to the floor and keeps running with a loud Critical log line instead of hard-exiting.

Trials are ordinary short-dated licenses, so the same guarantee applies: when a trial ends the deployment degrades to the floor and keeps serving traffic rather than going dark.

Migrating between editions¶

Moving between editions is a license-file drop — no re-deploy, no policy reload. Contact support to obtain your license credentials, add them to the bundle's .env (ENGINE_LICENSE_SERIAL, ENGINE_LICENSE_USERNAME, ENGINE_LICENSE_PASSWORD), then restart the engine container:

eghost restart enforcegate

On the next boot the engine activates against the Exosys Control Server with the new credentials and enables the upgraded feature surface. Operator state — engine.conf overrides, policy versions, audit logs, the captive-portal leaf cert, and the bump CA — is preserved across the upgrade because all named volumes survive container removal. See persistence for the volume model.

Laws & regulation¶

The software elements within our products include capabilities — such as strong cryptographic algorithms — that may fall under regional regulatory constraints. It is the purchaser's responsibility to verify that the use of such elements is permissible in their jurisdiction before completing a license purchase.

EnforceGate vX also includes SSL/TLS inspection capabilities (peek and bump modes — see SSL inspection) that intercept and, in bump mode, decrypt traffic the end user's browser treats as end-to-end private. Activating these modes can have direct legal consequences under employee-privacy law, GDPR and equivalent data-protection regimes, sector-specific obligations (telecom, banking, healthcare), and wiretap or interception statutes — all of which vary by jurisdiction and deployment context (employees vs. guests vs. customers). The Licensee is solely responsible for confirming that enabling inspection — and the user-notice or consent that may be required to accompany it — is lawful in their environment. The product ships with inspection disabled by default and requires an explicit binding acknowledgement (EULA § 3) before bump mode can be activated.

Activation flow¶

License credentials are supplied to the engine through three environment variables in the bundle's .env file (an .env.example is shipped alongside docker-compose.yml):

ENGINE_LICENSE_SERIAL=EXEGE-0000-0000-0000-0   # replace with your serial
ENGINE_LICENSE_USERNAME=acme-prod
ENGINE_LICENSE_PASSWORD=<your account password>

The container forwards these variables into the engine's [license] section of /etc/enforcegate/engine.conf before startup. The serial and username are echoed on the boot card (a [ WARN ] line) so operators can confirm the right tenant is active; the password is silenced (length-only) to keep it out of docker logs.

License files¶

After activation, the engine stores license-bound state under /etc/enforcegate/license/. These files are managed by the engine and the Control Server — operators do not edit them. Activation survives container removal and image upgrades because the enforcegate-config volume preserves the whole /etc/enforcegate/ tree.

If you need to migrate the deployment to different hardware (different machine ID), contact support to coordinate re-activation against the Control Server.

File-permission enforcement¶

For production hardening, set enforce_permissions = true in the [license] section of engine.conf. The shipped Docker bundle already does this. With the option enabled, the engine refuses to start if the license files' permissions don't match the expected secure defaults — it exits with reason = "apm.permissions.failed" in the diagnostic file. See troubleshooting for recovery.

Serial format¶

EnforceGate product serials are 22 visible characters in the pattern:

XXXXX-XXXX-XXXX-XXXX-X

Five hyphen-separated groups in a 5–4–4–4–1 block layout. The digits 0, 1 and letters I, O are excluded from the alphabet to avoid 0/O and 1/I confusion when reading the serial off a label or over the phone. The last character is a check digit that catches typos — genuine-issuance is proven by the Control Server at activation time, not by the format itself.

Product serials carry the EXEGE prefix and are required for activation against the Control Server.

Online activation¶

Activation is performed by the engine itself at startup against the Exosys licensing infrastructure. The host requires outbound HTTPS connectivity for the first boot; once the license is bound, an internet connection is not required again until the license expires and the engine needs to re-activate.

For firewall coordination (specific endpoint and port range to allow), contact customer support. For air-gapped or restricted environments, the same contact handles the offline-activation procedure.

License files corresponding to your active subscription plan can be downloaded directly from your account dashboard. For activation troubleshooting, the APM diagnostic reason table maps each failure code to a remediation step.