Licensing & entitlements
Ticketra enforces licensing entirely offline. There is no phone-home, no licence server to reach, and no telemetry — a signed licence token is verified locally against a bundled public key. This keeps air-gapped deployments fully supported.
Understanding two distinctions will explain almost all licence behaviour:
- Features vs limits — these behave differently when a licence lapses.
- Enforcement vs entitlement — Ticketra never deletes your data; it restricts what you can add or change.
Features vs limits
This is the single most important concept on this page.
| Limits | Features | |
|---|---|---|
| What they are | Numeric caps (users, workspaces, playbooks) | Capabilities that are on or off (SSO, playbooks, multi-tenancy) |
| When exceeded | Blocked from creating more | Capability is unavailable |
| Protected by grandfathering | Yes | No |
Grandfathering (below) raises numeric limits to match what you already use, so introducing licensing never locks existing users out. It does not enable features. A feature you are not licensed for is unavailable regardless of whether you were using it before.
If your licence does not include multi_tenant, tenant workspaces become
read-only — reads work normally, but writes to tenant-scoped data are
rejected with TENANT_READ_ONLY. System-scope data is unaffected.
Because it is a feature, grandfathering does not protect it. Plan licence renewal accordingly if you run more than one workspace.
Tiers
Four tiers exist. FREE applies whenever no valid licence is installed.
| Tier | Users | Workspaces | CTI providers | Audit retention |
|---|---|---|---|---|
FREE | 5 | 0 | 2 | 30 days |
PLAN_1 | 10 | 1 | 2 | 365 days |
PLAN_2 | 15 | 3 | 6 | 1095 days |
ENTERPRISE | Unlimited | Unlimited | Unlimited | Unlimited |
-1 in the API means unlimited.
Feature availability
| Feature key | Capability | FREE | PLAN_1 | PLAN_2 | ENTERPRISE |
|---|---|---|---|---|---|
auth_ldap | LDAP / Active Directory | — | — | ✓ | ✓ |
auth_sso | SSO (SAML/OIDC) | — | — | ✓ | ✓ |
cti_premium | Premium CTI providers | — | — | ✓ | ✓ |
webhook_sources | Webhook / SIEM sources | — | ✓ | ✓ | ✓ |
notifications | Notification channels | — | ✓ | ✓ | ✓ |
playbooks | Playbooks / automation | — | ✓ | ✓ | ✓ |
reports_branding | Reports with branding | — | — | ✓ | ✓ |
scheduled_backups | Scheduled backups | — | ✓ | ✓ | ✓ |
multi_tenant | Multi-tenancy (workspaces) | — | ✓ | ✓ | ✓ |
Other limits
| Limit key | FREE | PLAN_1 | PLAN_2 | ENTERPRISE |
|---|---|---|---|---|
max_webhook_sources | 0 | 1 | Unlimited | Unlimited |
max_notification_channels | 1 | 3 | Unlimited | Unlimited |
max_playbooks | 0 | Unlimited | Unlimited | Unlimited |
max_custom_roles | 0 | 2 | Unlimited | Unlimited |
Grandfathering
The first time a Ticketra release with licensing starts, it records a snapshot of what you are already using — active users, workspaces, custom roles, webhook sources, notification channels, playbooks and enabled CTI providers.
That snapshot becomes a permanent floor. Free-tier limits are never applied below it:
effective limit = max(tier limit, first-boot snapshot)
So an existing deployment with 11 users does not suddenly drop to the free cap of 5. Nobody is locked out, and no data is removed.
Two consequences worth understanding:
- The floor is a floor, not headroom. If you had 11 users, you keep those 11 — but you cannot add a 12th without a licence covering it.
- The snapshot is taken once and never shrinks automatically. Installing a real licence replaces the floor rather than lowering it.
Grandfathering applies to limits only. See the warning above.
Grace period
When a licence expires, Ticketra does not switch off immediately. A grace period keeps licensed entitlements active so renewal is never an emergency.
| Setting | Value |
|---|---|
| Default | 21 days |
| Minimum | 14 days |
| Maximum | 30 days |
Adjustable via the license.grace_period_days system setting, clamped to the
range above. During grace the UI displays a persistent banner. After grace
ends, entitlements fall back to FREE — subject to your grandfathered floor.
Instance binding
A licence may be bound to a single deployment, which prevents one key being shared across multiple installations.
The deployment identifier is a random UUID generated once and stored in the
database (license.instance_id). It is deliberately not derived from
hardware, hostname or network configuration, so none of the following
invalidate a licence:
- rebooting or migrating the server
- rebuilding or recreating containers
- changing IP address, hostname or reverse proxy
- restoring onto different hardware
Because the identifier lives in the database, restoring a database backup
carries the identity with it. A bound licence presented to a deployment with
a different identifier is rejected with binding_mismatch.
Find your instance ID under Admin → License; quote it when requesting a bound licence.
Clock-tamper protection
Ticketra records a high-water mark of the newest time it has observed. If the system clock is later found to be significantly behind that mark, the licence is flagged as clock suspect and the deployment is treated conservatively.
This exists so licences cannot be extended by moving the clock backwards. It can also trigger legitimately after restoring an old backup or fixing a badly skewed clock — running NTP resolves it.
What happens when a licence lapses
| Behaviour | Effect |
|---|---|
| Your data | Untouched. Nothing is deleted or hidden. |
| Reading | Unaffected everywhere. |
| Numeric limits | Fall back to the grandfathered floor. |
| Existing records over a limit | Retained; you simply cannot add more. |
| Licensed features | Unavailable. |
| Tenant workspaces | Read-only if multi_tenant is not licensed. |
| System-scope data | Remains writable. |
See also
- Managing your licence — applying keys, starting a trial, reading the status page
- Multi-tenancy & isolation
- Security model