What the licence does, and what it refuses to do.

Every installation has a key

Community included. The Community key costs nothing and does not expire, but it is still a key: you create an account, take one, and enter it. There is no unlicensed mode that quietly behaves like Community.

The reason is that entitlements come from the licence rather than from anything compiled into the binary. If an installation with no licence were treated as Community, then "what am I entitled to" would have two answers depending on whether a file exists, and the free tier would be the one branch nobody could revoke, correct or upgrade in place.

Activating

Take a key in your account and paste it into your control plane once. It contacts the licence server, and what comes back is a signed licence carrying your plan, your limits and the features that plan turns on.

What the licence is bound to

Your control plane generates a keypair the first time it activates and never sends the private half anywhere. The activation records the public half, and every later conversation with the licence server has to prove possession of the private one.

The practical consequence is the point of the whole design: copying the licence file to a second machine gets you nothing. The copy has the licence but not the key it was issued against, so the server declines to renew it and the copy expires on its own.

The six-hourly check

A running control plane re-checks its licence every six hours. The check does two things: it confirms the licence is still live, and it pulls back a freshly signed one carrying whatever has changed since the last check.

A licence is short-lived by design. Buying a year does not put a year into the file — it puts a much shorter expiry there and moves it forward each time the check succeeds. That is what makes a cancellation take effect at all, and it is also what makes an upgrade land within hours rather than at the next renewal.

How your servers hear about it

Your servers do not talk to us. The control plane holds the licence and hands each enrolled agent a signed lease derived from it, so an agent never needs to reach the internet to know what it is allowed to do. When the control plane renews, the new lease goes out to every enrolled agent at once rather than waiting for each to reconnect.

When we cannot be reached

A failed check changes nothing. If the licence server is down, or your network is, or a firewall rule got tightened on a Friday, the control plane keeps the licence it already has and carries on. The failure is recorded where an operator can see it, and the next check tries again.

Silence and refusal are not the same answer, and Portiger does not treat them the same way. What limits an outage is the licence's own expiry: you keep everything you were entitled to until that date passes, whether the reason for the silence is ours or yours.

When a plan ends

Cancel, or let a subscription lapse, and the licence simply stops being reissued. The one you hold runs to its expiry and then stops moving.

After that the control plane stops accepting new capacity: adding another node needs a live entitlement. What is already deployed keeps running, your data stays where it is, and nothing is deleted or stopped by us. Re-subscribing restores the entitlement at the next check.

Moving to another machine

A licence follows the control plane, and the control plane is allowed to move. Activate on the new machine with the same key and the new keypair replaces the old one. The old installation stops renewing and expires, which is the correct outcome: the machine you migrated away from should not keep a live entitlement.

If you need both installations live at once, that is two subscriptions rather than one, and it is worth saying so plainly rather than letting someone discover it after the migration.