Licensing

Consystence licensing has two orthogonal axes. An organisation tier describes the commercial relationship and carries the tenant’s operating entitlements, such as the historian’s retention period; counted per-seat SKU pools are the organisation’s licences for its installs. They are independent: the tier does not imply seats, and seats do not imply a tier.

The model is deliberately provisioned-identity based, not hardware-bound — a licence binds to an install identity written once when a server first starts, so the snapshot, clone, and migrate operations this fleet runs constantly do not invalidate a licence. And a licensing condition can never stop a running plant: expiry and revocation degrade a server, they do not kill it, and they never gate operator control writes.

Public beta

The hosted service is in public beta. During the beta, free individual sandboxes and paid organisations are both arranged with our team: request access. During the beta, the platform is offered for evaluation, authoring and simulation, and supervised commissioning trials alongside existing SCADA; production control stays on your existing systems. Some pieces — online licence renewal for site servers, seat release on decommission, and fully air-gapped activation transport — are roadmap, and are marked as such where they appear below.

The two axes

Axis	What it is	Granted by	Enforced where
Organisation tier	The commercial relationship: free by default, or a paid Integrator or Enterprise tier	Free by default; paid tiers are arranged with our team	Account grants it; the cell applies its operating entitlements, such as historian retention
SKU pools	Counted per-seat licences for installs	Arranged with our team	Cell mediates; site/edge enforce

Consystence offers three public tiers:

• the Free sandbox — an individual account’s own sandbox tenant on .dev, arranged on request during the beta;
• Integrator — for organisations that author and deploy templates, with tenants on .dev;
• Enterprise — for organisations that operate plants, with tenants on .com.

An organisation with no paid tier is free. Integrator and Enterprise access is arranged with our team; see plans.

A tier carries operating entitlements, such as the historian’s retention period, which the cell applies. Tiers do not include install licences — those are held separately as SKU pools, so a single organisation’s tier and its seat counts move independently.

Per-seat SKU pools

A licence is a counted, SKU’d, expiring pool keyed to the organisation (by the organisation’s account-minted id — organisations do not have an Entra oid; that is a person’s key). Each pool carries a SKU, a seat quantity, a term/expiry, a status, and a set of assignments mapping consumed seats to installs.

Three SKUs are counted independently:

SKU	Covers
SiteServer	A site-server install (a server running in Site mode)
Edge	An edge-runtime install
Agent	An engineering-agent install (below)

The engineering agent behind the Agent seat is in early access. It is an engineer’s tool for the vendors’ engineering software, installed on an engineering host. It enrols with the site server and polls outbound-only for approved jobs. It loads generated ControlLogix code online or by download (a download needs the engineer’s explicit download flag, and the web cannot authorise one), verifies PLCnext programs read-only and applies Ignition artifacts. It is used on workshop controllers; plant controllers are not loaded through it.

A pool is distinct from an entitlement. An entitlement is a single-use right to provision one paid tenant; a licence pool has quantity, SKU, expiry, and per-seat assignment that an entitlement does not.

Sandbox quota and provisioning limits

Tenant provisioning sits behind a bounded wall. During the beta, free individual sandboxes and paid organisations are both arranged with our team: request access.

• Each account gets one free individual sandbox tenant.
• Each organisation gets one free trial (simulation) tenant — ever. A trial tenant cannot mint site-activation codes.
• Provisioning attempts are rate-limited per account and globally (429), beneath a global tenant ceiling (409).
• Paid-tenant provisioning requires an org-keyed entitlement — denied with 402 until the organisation holds one. Entitlements for paid tiers are arranged with our team.

See tenant provisioning for how a tenant is requested and provisioned.

Pool term and status

Each pool carries a seat quantity and a term — a multi-seat pack and a single seat are the same mechanism with a different quantity:

• every pool expires at the end of its term;
• a pool held as a subscription renews with that subscription and lapses if the subscription is cancelled.

Pools are held separately from the organisation’s tier, through their own grant path.

A pool’s status follows an append-only lifecycle: Active → PastDue → Cancelled. PastDue is the grace condition (see Graceful degradation); it is not a kill switch.

AI credits

AI usage is metered in credits. Each tier, the free sandbox included, carries a monthly AI-credit allowance; see plans. As an order of magnitude, roughly 1,000,000 credits correspond to one standard AI action. Credit state never touches plant control — AI is advisory-only either way.

Who issues, who enforces

The account control plane is the licence master — it holds the signing key and is the sole issuer. The cell mediates issuance and consumption; the site and edge enforce what was issued. The account never becomes the runtime enforcer.

flowchart LR
  Account[Account control plane<br/>allocate + sign] -->|seat / signed artifact| Cell[Cell mediates]
  Cell --> Site[Site server enforces]
  Cell --> Edge[Edge runtime enforces]

The assignment authority — who may request and assign a seat — is the organisation’s own owner or admin (see Roles), bound to that organisation. The issuance authority — who cryptographically signs — is the account control plane. These are separate concerns: the cell admin surface validates an organisation-scoped admin against the route’s organisation and forwards to the account; it never self-issues.

Platform-admin is not the licence authority

Platform administration is an operational capability held by Consystence staff, not the licensing authority. Licence assignment is an organisation owner/admin concern; licence signing is the account control plane’s. Platform operators also hold a support path: they can grant provisioning entitlements and licence pools and issue site-activation codes, but they are never the signing authority (the account signer) or the customer assignment authority (the organisation owner).

Activation

Server identity is provisioned, not hardware-derived

A server’s licence binding is a provisioned identity — an install identity written once when the server first starts and persisted — not re-derived from hardware each boot. This replaces the older hardware-fingerprint model (motherboard serial, CPU ID, MAC), which broke on every snapshot/clone/migrate.

Activation codes: the customer flow

An organisation owner first declares the site on the tenant’s Sites page in the account console, then generates a one-time site-activation code against that declared site. The code is shown once, expires in 7 days, and works once. The installer pastes it into the on-prem site server, which relays it through the cloud cell to the account. The account redeems the code and returns an activation bundle, and the redeeming server joins the declared site. If the organisation has a SiteServer seat available, the account also assigns it and includes a signed licence in the bundle. Without one, the server still enrols: a licence is never a condition of enrolment. Platform operators can also issue a code through a support path. (Trial tenants cannot mint activation codes.)

Online activation

Under the hood, the cell calls the account to assign a pool seat to an install — an idempotent, organisation-keyed consume. When a seat is available, the install then holds one from the pool. No new cryptography is involved in the online path; it is allocation only.

Offline verification: the signed artifact

Once activated, an install needs no live call to the account to stay licensed. The account issues a signed, offline-verifiable licence artifact binding a pool assignment to the install. The site receives it inside the activation bundle, persists it, and verifies it fully offline thereafter — so the cell, site, and edge stay licensed through a network partition.

Fully air-gapped transport is roadmap

Fully air-gapped sites — where the activation artifact moves over removable media rather than a connected cell — are on the roadmap. Today’s flow assumes the installer can redeem the activation code through a connected cell once; after that, verification is fully offline.

Graceful degradation

A licensing condition never stops a plant

Licence expiry, lapse, or revocation degrade a server — they never kill control. The licence boundary sits at the engineering/configuration surface. It is never placed at the operator-control surface: Start, Stop, Reset and other operator commands, and alarm acknowledgements, are never gated by licence state. Gating an operator command would itself be the safety event this rule exists to prevent.

A licence is an expiring entitlement, but failure is bounded:

• A 30-day grace window after expiry, during which the site server’s status pages show the licence as expired and in grace; plant operation is not affected. Online licence renewal for site servers is roadmap: today a site server holds the licence it received at activation.
• At the hard limit the server degrades to constrained, it does not stop the scan loop. On a site server, constrained mode can block only licence-consuming expansion — creating a new site or a new device instance. On an edge, past the grace window a lapsed licence trims the edge to its licensed number of device instances, never to zero. It does not block operator command writes or acknowledgements, and it never stops the running plant.
• There is no instant remote kill for an air-gapped server. Revocation is non-renewal: a licence runs to its stated expiry, so the lever is the expiry length, stated up front rather than discovered in an incident.

Subscription lapse and tenant suspension

Degrade-not-kill governs the site server’s control surface. It does not extend to the hosted cloud tenant: the reachability of a paid tenant held on a subscription follows that subscription, and each such tenant has its own subscription:

• PastDue is the grace state: the tenant stays up and routable.
• Cancellation suspends that tenant only — the organisation’s other tenants are untouched. A suspended tenant is immediately non-routable — the portal bounces to the organisation list with a tenant-suspended notice.
• A successful payment (or reactivating the subscription) restores the suspended tenant.

An on-prem site server keeps running through all of this: suspension makes the hosted cloud workspace unreachable, it never touches plant control.

Clock integrity

Expiry needs a trustworthy clock on a box that may be offline, so a clock rollback can never revoke a licence. A backward wall clock — from an RTC-battery failure, a snapshot restore, or an NTP correction — never shortens a licence or shuts a plant down; a rollback can only ever be safe.

Decommission

Decommissioning an install returns its seat to the organisation’s pool, freeing it for reassignment. Seat reclaim reconciliation is part of the same lifecycle. This is roadmap — seat release on decommission is not yet built.

Status: what is live today

Capability	State
Organisation tiers and paid-tenant entitlements	Built, pre-GA
Per-seat SKU pools (SiteServer / Edge / Agent)	Built, pre-GA
Free individual sandbox (account-console flow)	Built; arranged on request during the beta
Account-side licence signer	Built, pre-GA
Signed offline-artifact issuance + verify/consume (cell/site/edge)	Built, pre-GA
Cell-mediated online seat assignment	Built, pre-GA
One-time site-activation codes (owner console + operator support path)	Built, pre-GA
Provisioned-identity binding (write-once install identity)	Partial
Degrade-not-kill + clock-rollback safety	Built, pre-GA
Online licence renewal for site servers	Roadmap
Seat release on decommission	Roadmap
Fully air-gapped activation transport	Roadmap

For the surrounding model see the platform overview, the organisation & site model, authentication, and the cell topology. The admin surfaces that drive these flows are documented in the API reference.