License
What each license tier includes, how to get a trial, online and offline activation, and what each license state means.
You activate on the License tab in the Settings group; it is visible to administrators only.
License scope
| Tier | Includes |
|---|---|
| Not activated (Community) | Free, 1 user. Ask AI, all three masking modes, posture, audit, runbooks, baseline and ledger |
| Trial | Every Enterprise feature for 14 days on one host. Apply in the console |
| Professional | Licensed per user. The four paid engines: alert batch triage, alert investigation, detection-rule drafting, and the Platform health checkup with its AI read, plus reports |
| Enterprise | Everything in Professional, plus audit forwarding, SSO, model failover and offline activation |
For the full comparison, see Editions.
Every edition uses the same delivery archive; only the license differs. To upgrade from Community, an administrator imports a license on this page; no reinstall is needed. The paid engines ship encrypted, with only ciphertext in the image. The license server issues the keys per tier, bound to the activated host, so a gateway without a license cannot run them.
License overview
| Card | Shows |
|---|---|
| License status | The current state, see below |
| Expires | Expiry date and days left. Below 30 days it shows Time to renew |
| Features unlocked | Each licensed feature, or Wildcard * (enterprise) |
| Usage | User seats (enabled accounts / licensed), Features unlocked, and Last heartbeat |
License states
| State | Meaning | Action |
|---|---|---|
| Not activated | No license; the gateway runs as Community | Apply for a trial or buy |
| Valid | Normal | None |
| Expiring soon | Less than 7 days to expiry; everything works | Renew and paste the new key |
| In grace period | Expired less than 7 days ago; everything still works | Same |
| Heartbeat lost | An online license has not reached the license server for longer than the offline grace period | Allow outbound access to license.reallysec.com:443 |
| Expired, Revoked, Invalid | The license is unusable | Contact sales. Invalid usually means the key belongs to another host |
In Heartbeat lost, Expired, Revoked and Invalid, the gateway locks queries, analysis and the paid engines. Sign-in, password changes and license actions keep working, so you can activate again at any time.
Activate online
Steps
- Under Activation method, select Online.
- Paste the license key from the console (it starts with
ey) and select Activate.
The gateway binds this host with the license server and then sends a heartbeat every 24 hours, retrying every 5 minutes after a failure. Renewals, tier changes and keys for new engines arrive over the heartbeat. You never need to send the host fingerprint to anyone.
Activate offline
Offline activation is for air-gapped sites and is an Enterprise feature.
Steps
- Under Activation method, select Offline.
- Select Copy the host fingerprint and send it to Reallysec.
- When you receive the
.licfile, select Upload a license file, or paste its contents into the text box. - Select Activate.
The gateway verifies the signature and host fingerprint locally. After that it sends no heartbeat and makes no outbound connection. The feature set is fixed in the file, so renewals and tier changes need a re-issued file.
The host fingerprint comes from state/machine-id and state/server_guid in the install directory. They cannot be regenerated once created; back up the whole state/ directory.
Replace, renew or deactivate a license
To replace or renew, paste the new key under Replace or renew and activate. You do not need to deactivate first.
Deactivate this license returns the gateway to the unactivated state, and an online license gives its host seat back to the license server. Deactivate before you move to another host.
AI settings
Configure LLM providers, failover order and reasoning effort, set the knowledge-base embedding model, and check provider health and 24-hour call volume.
Audit log
A record of sign-ins, queries, model calls, and settings changes with operator, time, index, action, outcome, and token use. Filter, export, and forward to a SIEM.