Licensing
How activation, validation and the grace period work - and what each tier unlocks.
Get a key
Every mlab.sh organisation has a free TPRM license auto-provisioned. Find it under Organization > TPRM on mlab.sh and paste it into LICENSE_KEY in your .env.
Free vs Licensed
| Feature | Free | Licensed |
|---|---|---|
| ICT third-party providers | 5 max | Unlimited |
| Users | 3 max | Unlimited |
| Dashboard, providers, contracts | Yes | Yes |
| Risk assessments & third-party incidents | Yes | Yes |
| Exit strategies, concentration risk | No | Yes |
| Business functions (B_06.01), supply chains (B_05.02) | No | Yes |
| Due diligence, audit tracking, Art. 30 checklist | No | Yes |
| Outsourcing register (ICT / non-ICT), proportionality register | No | Yes |
| Provider reviews (annual monitoring) | No | Yes |
| DORA register & advanced analytics | No | Yes |
| EBA export (15 templates) & validation | No | Yes |
| xBRL-CSV deposit package (.zip) | No | Yes |
| REST API | GET only | Full CRUD |
See the pricing page for the full comparison.
Validation flow
- On boot,
appreadsLICENSE_KEYand registers the instance withmlab.sh/api/v1/tprm/license/validate. - Once per hour the app performs an HMAC challenge-response with mlab.sh: the server sends a nonce, the instance signs it with the secret derived from the license key.
- A successful response refreshes the cached license - tier, limits, expiry - kept locally.
- If mlab.sh is unreachable, the cached license is honored for 48 hours.
- After 48 hours without contact, the instance is locked: read-only, no new writes. Data is never deleted.
- As soon as mlab.sh is reachable again, the lock clears automatically.
License management lives on mlab.sh. Upgrades, downgrades, key rotation and deactivation all happen at mlab.sh/orga/tprm/license. The tprm.mlab.sh instance only reads the current state.
How to upgrade
- Sign in at mlab.sh and open Organization > TPRM > License.
- Choose the Licensed tier and confirm.
- Your running instance picks up the new tier within the hour - no restart, no reinstall. Compliance modules, EBA export and full API CRUD unlock automatically.
What if I hit a free-tier limit?
You get a banner in the UI when you reach 5 providers or 3 users. The platform keeps running for everything already in place - nothing is dropped - but you'll need to upgrade to add more or to unlock the compliance and export modules. Check your current usage under /settings/license.
Network requirements
The instance needs outbound HTTPS to mlab.sh (443) for the hourly license check. That's the only egress required. No telemetry, no usage analytics, no compliance data ever leaves your infrastructure.