Skip to content

Licensing

MazeVault License Tiers

Document Version: 1.0.0
Last Updated: 2026-02-10

1. License Model

MazeVault uses a per-installation license model. Commercial production licenses are issued for a specific deployment and renewed according to the commercial agreement. The PoC tier is always free of charge and is time-limited to a maximum of 3 months.

Each issued license may include:

  • License key enrollment and validation
  • Periodic heartbeat verification with the MazeVault licensing service
  • Grace period handling for temporary connectivity issues
  • Tier-scoped entitlement for the licensed deployment

Licensing defines the right to use and the enabled deployment scope. It does not by itself define support response times, availability commitments, RTO/RPO targets, or service credits. Those commitments are governed by the license variant, the agreement with the Partner, and the Technical Support and Product Escalation Terms (SLA), to the extent incorporated.

2. License Tiers

Tier Intended Use Commercial Model Notes
PoC Evaluation, pilot, or controlled validation deployment Free of charge Always time-limited to a maximum of 3 months
Small Business Standard commercial license for smaller production deployments Paid commercial license Scope is defined by the issued license and agreed delivery
Enterprise Commercial license for larger, regulated, or advanced deployments Paid commercial license Used for advanced deployment patterns, identity federation, and HSM-backed scenarios

3. Entitlement Scope

The exact entitlement of a deployment is defined by the issued license and the agreed implementation scope. In practice:

  • All licensed deployments include license enrollment, heartbeat validation, and the core MazeVault platform scope for secrets, certificates, and access control.
  • Enterprise is the tier used for advanced deployment patterns such as multi-datacenter operation, HSM-backed key custody, and enterprise identity integration.
  • Custom development, bespoke integrations, migration work, and extended support are additional services, not separate license tiers.

Enterprise Functions (Feature-Gated Modules)

Beyond the core platform scope, several modules are enabled by license features. The backend grants them according to the license tier whenever the license is in an effectively valid state (active, grace, or expiring); suspended, terminated, or unknown licenses fall back to the core scope only.

License feature Module PoC Small Business Enterprise Documentation
config_management Configuration Management (config file discovery, templates, secret naming policy) ✅ — ✅ Guide · API
ssh_management SSH Management ✅ — ✅ Guide
keytab_management KeyTab Management ✅ — ✅ Guide · API
deployment_management Deployment (agent deployment records) ✅ — ✅ Guide
token_management Token Management (externally-issued API tokens) ✅ — ✅ Guide · API
multi_dc_sync Multi-datacenter synchronization — — ✅ Gateway DR & Failover
hsm_integration HSM / KMS integration — — ✅ Key Management

The first five modules are grouped in the web interface under Enterprise Functions. Behaviour when a feature is not licensed:

  • The corresponding /api/v1/... endpoints are enforced server-side and return HTTP 403 with a license error.
  • The page in the web interface renders an upgrade banner instead of its content. The menu entry itself is still shown to users who hold the matching RBAC permission (config:read, ssh:read, keytab:read, deployment:read, token:read).
  • Unauthenticated agent bootstrap endpoints used by unattended installs are intentionally not gated, so existing agents keep working.

4. License Enrollment

Initial Setup

  1. Obtain your license key from the MazeVault sales team
  2. During first deployment, the system prompts for license enrollment
  3. Enter the license key in the administration interface
  4. The system validates the key with the MazeVault licensing service
  5. Upon successful validation, the licensed deployment scope is activated

License Heartbeat

The MazeVault platform periodically validates the license status:

  • Heartbeat Interval: Every 24 hours
  • Grace Period: 30 days without connectivity to the licensing service
  • Offline Mode: Available for Enterprise deployments with pre-provisioned offline tokens when included in the agreed delivery scope

License heartbeat exchanges are limited to license and deployment-status metadata needed to validate entitlement. Customer secrets, certificates, plaintext data, and MEK material are not transmitted as part of license validation. Where telemetry contains personal data or is operated through a Partner, the applicable DPA and Subprocessor List govern the processing chain.

Commercial License Renewal

  • Renewal notifications are sent 60 days before license expiration
  • The platform continues to operate during the renewal period
  • After expiration + grace period, the system enters read-only mode (no new secrets or certificates can be created)
  • PoC deployments expire automatically at the end of the approved evaluation period unless converted to a commercial license

5. Contact

For licensing inquiries, tier upgrades, or implementation scoping:

  • Email: info@mazevault.com