License
Community, Professional, Enterprise and trial compared, upgrading from Community, online and offline activation, and license states.
License is a tab of the Settings page. Only administrators can see it and activate a license. The paid features (offense batch triage, offense investigation, the rule copilot, the platform-ops copilot and reports) need an activated license; every other feature is available in every edition.
Editions
| Edition | License | Capabilities |
|---|---|---|
| Community | Free, no license, 1 user | Ask AI, offense sync with AI summaries and write-back, security posture, log-source whitelist, field masking, audit, outbound channels |
| Professional | Commercial, per user, 1 node | Everything in Community, plus the four paid engines and reports |
| Enterprise | Commercial, unlimited nodes | Everything in Professional, plus audit forwarding to an external SIEM, LLM failover, OIDC single sign-on and offline activation |
| Trial | Every Enterprise feature, 14 days, 1 host | Request one at console.reallysec.com |
For the full comparison, see Editions.
Every edition uses the same archive; only the license differs. The four paid engines ship encrypted; the license server issues their decryption keys per edition, bound to the activated host.
Upgrade from Community
Import a Professional or Enterprise license on this page. No reinstall is needed; data and the host fingerprint are kept. Activate it online or offline as described below.
Activate online
Prerequisites
- The gateway host can reach
license.reallysec.comon 443.
Steps
- Under Paste a license key, paste the license key from the console (it starts with
ey), or select Upload a license file. - Select Activate.
The gateway binds this host with the license server and then sends a heartbeat once a day; renewals and edition upgrades arrive through the heartbeat. Online activation never requires sending the host fingerprint to anyone.
Activate offline
Offline activation is an Enterprise feature for air-gapped sites.
Steps
- Under Host fingerprint, select Copy the host fingerprint and send it to Reallysec.
- When you receive the
.licfile, select Upload a license file, or paste the file's content. - Select Activate.
The gateway checks the signature and the host fingerprint locally and unlocks; after that it sends no heartbeat and makes no outbound connection. An offline license fixes its features in the file, so a renewal or edition upgrade needs a new file.
The host fingerprint comes from state/machine-id and state/server_guid in the installation directory and cannot be regenerated. Back up the whole state/ directory.
Replace, renew or deactivate
- Replace or renew: paste the new license key under Replace or renew and activate it; there is no need to deactivate first.
- Deactivate: select Deactivate this license under Deactivate to return to the unactivated state. An online license also returns its host seat to the license server. Do this before moving to another host.
License states
License overview shows the License status, Expires, Features unlocked and Usage. Within 30 days of expiry it shows Time to renew.
| State | Meaning | Paid engines |
|---|---|---|
| Not activated | No license; the gateway runs as Community | Unavailable |
| Valid | Normal | Available |
| Expiring soon | Less than 7 days to expiry | Available |
| In grace period | Expired less than 7 days ago | Available |
| Expired | Expired more than 7 days ago | Unavailable |
| Heartbeat lost | An online license has not reached the license server for more than 7 days. Check outbound access to license.reallysec.com:443 | Unavailable |
| Revoked | The issuer revoked the license | Unavailable |
| Invalid | Signature, product or host binding does not match; usually the key belongs to another host | Unavailable |
While the license is expired, heartbeat lost, revoked or invalid, queries, investigation, triage and other features are unavailable. Signing in, changing passwords, and activating or deactivating a license still work.
AI settings
The LLM providers the gateway uses, their failover order and reasoning effort, with each provider's health and 24-hour call volume.
Audit log
Records of sign-ins, queries, model calls, offense write-backs and settings changes: who, when, data source, action, outcome, latency and token usage. Filter and export; Enterprise forwards them to a SIEM, including back to QRadar.