Licensing
License keys, signed licenses, places per instance, offline running and what each tier unlocks.
Get a key
A license key is required on every instance, Free included. Every mlab.sh organisation gets one automatically: find it under Organization > TPRM on mlab.sh and paste it into LICENSE_KEY in your .env.
An instance without a key, or without a valid license, is paused: users see a locked page and nothing can be read or written until a license is in place. Data is never touched or deleted while the platform is paused.
Free vs Licensed
| Feature | Free | Licensed |
|---|---|---|
| ICT third-party providers | 5 max | Unlimited |
| Users | 3 max | Unlimited |
| Dashboard, providers, contracts | Yes | Yes |
| Risk assessments & third-party incidents | Yes | Yes |
| Exit strategies, concentration risk | No | Yes |
| Business functions (B_06.01), supply chains (B_05.02) | No | Yes |
| Due diligence, audit tracking, Art. 30 checklist | No | Yes |
| Outsourcing register (ICT / non-ICT), proportionality register | No | Yes |
| Provider reviews (annual monitoring) | No | Yes |
| DORA register & advanced analytics | No | Yes |
| EBA export (15 templates) & validation | No | Yes |
| xBRL-CSV deposit package (.zip) | No | Yes |
| REST API | GET only | Full CRUD |
See the pricing page for the full comparison.
How validation works
- On boot, then every hour, the instance sends its
LICENSE_KEYand its own instance id tomlab.sh/api/v1/tprm/license/validate. The instance id is drawn once, on first boot, and kept in the database. - When the instance holds a place on the license, mlab.sh answers with a signed license: tier, number of places, expiry. The instance checks the signature against the mlab.sh public key built into the application, so no other server can make an instance licensed.
- The signed license is kept in the database and is valid for 7 days. It survives restarts, and the platform keeps working on it while mlab.sh is unreachable.
- Each successful check replaces it with a fresh one. If mlab.sh stays unreachable for longer than 7 days, the license expires and the platform is paused until the next successful check.
Tier changes made on mlab.sh (upgrade, downgrade) reach the instance at its next hourly check, or at once with Check now in /settings/license. No restart, no reinstall.
Places
A license has a number of places, one per running instance. Organisations that run one instance per entity or branch use the same key everywhere, one place each.
- A license has 1 place unless your contract says otherwise. Contact us to raise it.
- An instance that already holds a place keeps it. A new instance takes a free place, if there is one.
- When every place is taken, the new instance is refused and paused (status
in_use). Its locked page lists the instances holding the places. - An instance that has not checked in for 3 hours gives its place back on its own, so a removed or rebuilt instance frees its place without any action.
- To free a place at once, open Organization > TPRM > License on mlab.sh: every instance is listed with its host, version, last check-in and validity, with a button to release its place.
- An administrator can also take a place from a paused instance with Use this instance: the instance heard from least recently gives up its place.
Recreating an instance gives it a new id. If you wipe the database volumes and start again, the new instance needs a place of its own: release the old one on mlab.sh, wait 3 hours, or use Use this instance. Keeping the volumes keeps the instance id and its place.
License status
/settings/license shows the license guard: status, until when the license is valid, the last confirmation, the places on the license, and a Check now button. Administrators see the same reason on the locked page.
| Status | Meaning | What to do |
|---|---|---|
active | mlab.sh confirmed the license at the last check. | Nothing. |
offline | mlab.sh is unreachable; the instance runs on its kept license. | Restore outbound HTTPS to mlab.sh before the license expires. |
missing_key | LICENSE_KEY is not set. | Set it in .env and restart the app container. |
invalid | mlab.sh does not know this key (never issued, or rotated). | Copy the current key from mlab.sh. |
in_use | Every place on the license is taken. | Release a place on mlab.sh, or use Use this instance. |
expired | mlab.sh was unreachable for longer than the kept license lasts. | Restore connectivity, then Check now. |
Managing the license
License management lives on mlab.sh, under Organization > TPRM > License, for members allowed to manage billing:
- the plan and the places used out of the maximum;
- one row per instance, with a button to release its place;
- the key, and Rotate key. Rotating issues a new key and frees every place: update
LICENSE_KEYon each instance, which stays paused (invalid) until you do.
How to upgrade
- Sign in at mlab.sh and open Organization > TPRM > License.
- Choose the Licensed tier and confirm.
- Your running instances pick up the new tier within the hour, or at once with Check now. Compliance modules, EBA export and full API CRUD unlock automatically.
What if I hit a free-tier limit?
You get a banner in the UI when you reach 5 providers or 3 users. The platform keeps running for everything already in place - nothing is dropped - but you'll need to upgrade to add more or to unlock the compliance and export modules. Check your current usage under /settings/license.
Network requirements
The instance needs outbound HTTPS to mlab.sh (443) for the hourly license check. That's the only egress required. The check sends the license key, the instance id, the application version and the container hostname - no telemetry, no usage analytics, and no compliance data ever leaves your infrastructure.
To route the check through a proxy or a gateway, set MLAB_LICENSE_URL (see Configuration). The address is not a trust decision: whatever answers there cannot grant a license that mlab.sh did not sign.