License Management

A Sovereign install runs against a signed license issued by the Novantra control plane. The license proves your install is entitled to be running, and it names the organizations and apps it covers. Without a valid license, you cannot create new organizations; existing organizations may also fall back to read-only.

License activation and refresh happen during Sovereign setup and organization-provisioning flows. The system console surfaces license state in the operations and setup/organization-provisioning screens, which are the operator-facing view of what the current signed license grants.

What a license carries

Every license bundles:

Customer identity (customerId) — the commercial party the license belongs to.
Install identity (installId) — the specific install instance the license is bound to. You cannot use one customer’s license on another install.
App keys — which Novantra apps this license enables.
Per-organization entitlements — the list of organization IDs the license covers, each with their plan, feature flags, limits, and validity window.
Package entitlements — optional signed rights for starter, premium, or maintained framework packages. Package access can expire or be revoked independently from existing workspace data.
Validity window (validFrom, validUntil) — when the license is in effect.
Maximum organizations — the cap on how many organizations the install may host.

The license is signed with Novantra’s release key. The install verifies the signature during license import, connected refresh, and entitlement projection; an altered license will not pass verification.

Viewing your license

The setup and organization-provisioning flows show the license details needed for activation and entitlement checks:

Your customer and install identifiers.
The list of apps included.
All organizations covered, with each one’s plan, features, and validity window.
The license’s overall validity window.
The current license state (see below).
The latest import or refresh result when a setup/provisioning step performs one.

You do not need to decode the signed payload manually. Use the setup and organization-provisioning screens as the operator-facing view of what the current signed license grants.

License states

The system tracks the license through four states:

State	What it means
Active	Normal operation. Within the validity window, signature verified.
Warning	Within the validity window but approaching expiry. Banners appear in the admin shell. Time to renew.
Grace	Past the formal expiry but still within a short grace window. Writes are still allowed but increasingly visible warnings are shown.
Read-only	Grace exhausted. Existing organizations remain readable; no writes, no new organizations, no new members. The install keeps your data safe; it just stops accepting changes until a fresh license is applied.

There is no “service shut down” state. A lapsed license never deletes data, never disables key material, never blocks read access. It only blocks new state changes.

Package maintenance follows the same non-destructive rule. If maintenance for a premium framework package expires, Novantra can block new imports, version adoption, maintained mappings, or support for that package, but historical records, evidence, audit trails, and the last imported package lineage remain available unless your contract says otherwise.

Renewing — connected installs

If your install can reach the Novantra control plane over HTTPS, operators can refresh the signed license from the setup or organization-provisioning flow:

The install sends its install identity and activation context to the control plane.
The control plane returns a signed license payload for the install and its entitled organizations.
The install verifies the signature and projects the local entitlement state.

The local reconcile-license-state job evaluates and projects the license state already held by the install. It should not be treated as proof of automatic hourly control-plane renewal. When your commercial team renews the contract upstream, run the connected refresh path or use the offline exchange below to apply the refreshed license.

Renewing — offline installs

If your install cannot reach the control plane, renewal is a manual three-step exchange:

From the install, use the organization-provisioning license step to generate an activation request. The system creates a signed file describing your install’s current state (install ID, app keys, last license fingerprint).
From an internet-connected machine, upload that file to the Novantra control plane portal. The portal returns a refreshed signed license, also as a file.
Back at the install, import the refreshed license through the setup or organization-provisioning license import step. Provide a reason where the flow requests one. The system verifies the signature and replaces the previous license.

Both files are signed end-to-end, so you can carry them across an air gap on a USB stick without exposure to tampering.

Adding a new organization to the license

Whether you’re a connected or offline install, the flow is the same: organizations are added on the commercial side first, then your license reflects them.

Connected: add the org to your subscription with your account team. Then run the connected refresh step in the protected organization wizard so the new signed license names the organization.
Offline: generate an activation request, upload it, get a refreshed license that names the new org, import it. Then create the org through the protected wizard.

Creating an organization in Sovereign requires its organization ID to appear in the signed license. The install will not create an organization the license does not name. This is intentional: it keeps the commercial state of an install consistent with what’s actually running on it.

When a license expires

If renewal lapses, the system walks the state diagram:

Warning banner appears about a configurable window before validUntil. Now is the time to renew.
At validUntil, the state moves to Grace. Operations continue with louder banners.
When the grace window closes, the state moves to Read-only. Writes start failing with a clear “license expired” error. Sign-ins still work; existing data is fully readable; you can still investigate and export. You cannot create or change anything.
Applying a fresh valid license returns the install to Active immediately — no restart needed.

License state and other subsystems

License state governs new state changes; it operates independently of your install’s keys, storage, and backups:

Encryption keys. Customer-managed keys (Self Managed Secret Keys) live in your own KMS, separate from the license. A license lapse doesn’t lock or unlock keys.
Storage bindings. Self Managed Storage continues to function regardless of license state. A read-only install can still read and write your own bucket because file I/O is part of “reading existing data.”
Backups. Backup runs continue in any license state.

Permissions & evidence

Viewing license state requires install-admin access to setup, organization provisioning, or operations surfaces.
Importing a license requires the protected license import flow and an audit reason where requested.
Every import is recorded with the actor, the timestamp, the new license fingerprint, and your provided reason.

Sovereign Installation — the first license is applied during setup.
Updates & Upgrades — license state is independent of the running version; both can change without affecting the other.