Licensing¶

Every EnforceGate vX deployment runs one of three editions — Pro, Business, or Enterprise — self-hosted, sending no telemetry, and running fully air-gapped after first-boot activation.

Editions¶

• Pro — available now. The full self-hosted secure web gateway for small deployments and technically self-sufficient teams: engine and URL match engine, the operator CLIs (eghost / egctl / egpolicy), the standard captive portal (block / warn / AUP), git-backed policy authoring, the community script ecosystem (EGGuard and others), and Exosys Curated Domain Lists (60+ operator-selectable categories, served entirely on-box). 25 bundled connector sessions per engine. Bundled Direct support. Pro does not include the threat-intelligence feed, Active Directory integration or the TLS proxy connector.
• Business (in development) — for SMEs and MSPs. Adds the Advanced captive portal (user-aware, so pages and acknowledgements attach to a person rather than an IP), Active Directory integration, the daily threat-intelligence feed, and the TLS proxy connector (an SSL-bumping inline connector that mirrors decrypted HTTP traffic in clear-text out a dedicated ethernet interface for an IDS to inspect). 40 bundled connector sessions. Bundled Advanced support.
• Enterprise (in development) — for corporate, government and large fleets. Adds RADIUS alongside Active Directory, operator SSO / SAML / RBAC, multi-tenancy and fleet management, full compliance exports with an audit log, and the included NGFW modules. Enterprise also ships two AI-assisted surfaces: AI-driven anomaly and threat detection (traffic-outlier identification, phishing / C2 detection acted on in the request path — self-hosted, no traffic egress) and the Enhanced captive portal, whose on-portal AI assistant explains blocks to the visitor in plain language. 50 bundled connector sessions. Bundled Premium support.

Every edition ships the core gateway — no essential filtering, inspection or policy control is locked behind a higher tier.

Business and Enterprise are in development. Pro is generally available today; see enforcegate.com for current pricing and availability.

Never bricks on a license lapse¶

The engine keeps filtering regardless of billing state — an inline gateway that stops passing traffic when a card expires or a Control Server round-trip fails is disqualifying for production deployments and MSPs. The licensing layer is fail-open on every path:

• Expired license → grace window. Full entitlements (edition + connector cap) are preserved for the grace period after expiry; the engine keeps enforcing the last-loaded policy, prints a loud renewal reminder, and continues to filter every request. The default window is 21 days, set by [license].grace_window_days. Individual licences can carry their own window — see Grace on trials below.
• Past the grace window → reduced-capability floor. The engine falls back to a reduced floor — 10 concurrent connector sessions and the curated feed disabled — but keeps serving traffic. No hard exit, no traffic disruption.
• Absent / rejected / unreachable Control Server → the same floor. An air-gapped host awaiting an offline license, or a temporary Control Server outage, degrades to the floor and keeps running with a loud Critical log line instead of hard-exiting.

Grace on trials¶

A trial is an ordinary short-dated licence, so the fail-open guarantee applies unchanged: when a trial ends the deployment degrades to the floor and keeps serving traffic rather than going dark.

Trials are normally issued with a zero-day grace window, so entitlements drop at the expiry date exactly rather than running three weeks past it. The window travels in the licence itself and overrides the deployment-wide [license].grace_window_days — so a trial ends when it says it ends, while a subscription on the same host keeps the operator's configured window. An older engine that predates per-licence windows falls back to the deployment default, which errs toward more grace, never less.

Renewal at expiry¶

When a licence reaches its expiry date, the engine makes one attempt to contact the Control Server on the same serial to collect the renewed licence — the trial-to-subscription handoff, or an ordinary renewal, applied without operator action. On success it swaps the new entitlements in live: tier, connector cap, expiry and feed access all update without a restart.

This is a single touch at the expiry boundary, not a change to the steady-state posture — a licensed engine still never phones home during normal operation. Everything about it is fail-open:

• If the Control Server is unreachable, or the licence has not been renewed, the engine simply enters grace or the floor as it otherwise would.
• Renewing after the boundary still needs nothing from you. The licence stays tied to the same serial, so an engine that renews late collects it at the next restart or licence reload — there is no new file to install and nothing to reconfigure.
• Nothing blocks and no traffic is interrupted while the attempt is made.
• Air-gapped deployments are unaffected — the attempt fails harmlessly and the offline flow (install a fresh licence file, restart) works exactly as before.

If renewal does not succeed, show license reports why in specific terms — the serial has expired and was not renewed, the serial is not registered, or the activation limit for that serial has been reached — rather than a generic failure.

Migrating between editions¶

Moving between editions is a license-file drop — no re-deploy, no policy reload. Contact support to obtain your license credentials, then set them with:

eghost license credentials

The verb prompts for the serial, username and password (the password is masked and never appears in your shell history), writes them to the bundle's .env, recreates the engine, and then checks the boot log for a rejected login so a typo surfaces immediately.

On the next boot the engine activates against the Exosys Control Server with the new credentials and enables the upgraded feature surface. Operator state — engine.conf overrides, policy versions, audit logs, the captive-portal leaf cert, and the bump CA — is preserved across the upgrade because all named volumes survive container removal. See persistence for the volume model.

Laws & regulation¶

The software elements within our products include capabilities — such as strong cryptographic algorithms — that may fall under regional regulatory constraints. It is the purchaser's responsibility to verify that the use of such elements is permissible in their jurisdiction before completing a license purchase.

EnforceGate vX also includes SSL/TLS inspection capabilities (peek and bump modes — see SSL inspection) that intercept and, in bump mode, decrypt traffic the end user's browser treats as end-to-end private. Activating these modes can have direct legal consequences under employee-privacy law, GDPR and equivalent data-protection regimes, sector-specific obligations (telecom, banking, healthcare), and wiretap or interception statutes — all of which vary by jurisdiction and deployment context (employees vs. guests vs. customers). The Licensee is solely responsible for confirming that enabling inspection — and the user-notice or consent that may be required to accompany it — is lawful in their environment. The product ships with inspection disabled by default and requires an explicit binding acknowledgement (EULA § 3) before bump mode can be activated.

Activation flow¶

License credentials are supplied to the engine through three environment variables in the bundle's .env file (an .env.example is shipped alongside docker-compose.yml):

ENGINE_LICENSE_SERIAL=EXEGE-0000-0000-0000-0   # replace with your serial
ENGINE_LICENSE_USERNAME=acme-prod
ENGINE_LICENSE_PASSWORD=<your account password>

The container forwards these variables into the engine's [license] section of /etc/enforcegate/engine.conf before startup. The serial and username are echoed on the boot card (a [ WARN ] line) so operators can confirm the right tenant is active; the password is silenced (length-only) to keep it out of docker logs.

License files¶

After activation, the engine stores license-bound state under /etc/enforcegate/license/. These files are managed by the engine and the Control Server — operators do not edit them. Activation survives container removal and image upgrades because the enforcegate-config volume preserves the whole /etc/enforcegate/ tree.

If you need to migrate the deployment to different hardware (different machine ID), contact support to coordinate re-activation against the Control Server.

File-permission enforcement¶

For production hardening, set enforce_permissions = true in the [license] section of engine.conf. The shipped Docker bundle already does this. With the option enabled, the engine refuses to start if the license files' permissions don't match the expected secure defaults — it exits with reason = "apm.permissions.failed" in the diagnostic file. See troubleshooting for recovery.

Serial format¶

EnforceGate product serials are 22 visible characters in the pattern:

XXXXX-XXXX-XXXX-XXXX-X

Five hyphen-separated groups in a 5–4–4–4–1 block layout. The digits 0, 1 and letters I, O are excluded from the alphabet to avoid 0/O and 1/I confusion when reading the serial off a label or over the phone. The last character is a check digit that catches typos — genuine-issuance is proven by the Control Server at activation time, not by the format itself.

Product serials carry the EXEGE prefix and are required for activation against the Control Server.

Online activation¶

Activation is performed by the engine itself at startup against the Exosys licensing infrastructure. The host requires outbound HTTPS connectivity for the first boot; once the license is bound, an internet connection is not required again until the license expires and the engine needs to re-activate.

For firewall coordination (specific endpoint and port range to allow), contact customer support. For air-gapped or restricted environments, the same contact handles the offline-activation procedure.

License files corresponding to your active subscription plan can be downloaded directly from your account dashboard. For activation troubleshooting, the APM diagnostic reason table maps each failure code to a remediation step.