Modules and licensing
Shield360 is several products on one platform. You subscribe to one or more modules — Developer, Finance, Compliance and Security — or to a bundle of them. Every organisation also has the platform, which is always included.
This page explains what each module contains, how bundles work, and how modules reach your organisation: through a subscription in the cloud edition, or through signed licence keys when you run Shield360 yourself.
What is in each module
Section titled “What is in each module”Coding-agent analytics, AI-code provenance and blame, the cost meter for individuals, Prompt Hub, OpenGround, evaluations, agent tests, context and memory, Vault, telemetry and dashboards, the OpenTelemetry collector fleet, the Kubernetes controller and the MCP gateway for developers.
Costs and the spend report, budgets, subscriptions and seats, vendor keys and reconciliation, cost of code, chargeback, the finance ledger, the Finance overview and the Executive summary.
Framework controls, the Statement of Applicability and its history, evidence packages, findings, internal audits, management reviews, impact assessments, AI intake and approvals, transports between environments, the risk register, legal holds and data retention. Auditor access is part of Compliance.
Visibility of people, computers, shadow AI and traffic, data protection, prompt injection, the enforcement policy and approved models, sequence policies, agent access and MCP policies, documents (agent data gateway), AI account identity, agent activity, the AI analyst and detections, SIEM export and sensitive-data scans.
The platform
Section titled “The platform”These are part of every organisation, whatever it subscribes to:
- Organisations, projects, members, roles, SSO and API keys
- Settings, the collector and extension enrolment, and the ingest pipeline
- The connectors framework
- Home, the audit log and the AI assistant
- Alerting: the inbox, rules, channels and maintenance windows
- The AI inventory, which every module reads
- The model price catalogue, which prices Developer’s cost meter and Finance’s reports alike
- Change control (four-eyes approval of policy changes), which governs changes in every module the way the audit log records them
Bundles
Section titled “Bundles”| Bundle | Modules |
|---|---|
| Governance | Compliance and Security |
| Complete | Developer, Finance, Compliance and Security |
What happens without a module
Section titled “What happens without a module”A module you do not have is not hidden from you:
- In the sidebar, its pages show a lock with “Part of Finance — add Finance”.
- Opening one shows what the module does and where to add it, instead of the page.
- On Home, its card is a short teaser rather than numbers.
- Its API routes answer
402 Payment Requiredwith{"code": "module_required", "module": "finance"}.
Your data keeps flowing. Telemetry, collector and extension events, guard decisions, MCP gateway traffic and SDK calls are accepted whatever modules you hold, so when you add a module its history is already there. Protection that is already configured — the guard, the enforcement policy, the proxy and the extension — keeps enforcing; only viewing and changing it needs the module. Scheduled jobs that produce a module’s results (detections, analyst findings, budget alerts, control snapshots, risk scans, SIEM export) skip organisations without that module.
An Auditor sees Compliance only, whatever else the organisation holds.
Panels from another module
Section titled “Panels from another module”Some pages show a panel that comes from another module: a person’s spend on a Security person page, the analyst’s weekly briefing on the Executive summary, the rules attached to a prompt. Without that module the panel is a short teaser instead — for example “Add Finance to see spend” — and the rest of the page works as usual. The panel’s data is not requested, so nothing on the page fails.
Legal holds
Section titled “Legal holds”Legal holds already placed stay yours to manage, whatever modules you hold. Without Compliance you can still open Govern → Records → Legal holds, see each hold and what it keeps, export it and release it with a reason. Placing a new hold, or preserving more records now, needs Compliance. A hold you could not see or end would keep data against your will.
Security discovery on every plan
Section titled “Security discovery on every plan”Every organisation in the cloud edition can see what AI is in use, including on the free Personal plan. These Security pages are open read-only:
- Visibility: the overview, shadow AI and unapproved AI, websites, flow and fleet
- People and Computers, and each person’s and computer’s page
- AI accounts: personal versus company AI accounts, masked
A banner on each page says it is read-only. Acting on what you find is part of
Security and stays locked, with the same “add Security” upsell as any other
locked page: enforcement policies, approved models, guard settings, agent
access, SIEM export, detections, AI account settings and revealing masked
values. The API routes behind the open pages answer without Security; every
other Security route still answers 402 with "module": "security".
Seats per module
Section titled “Seats per module”A module bought per seat — Developer per developer, Finance and Security per monitored employee — has the seats its subscription, add-on or licence names. Shield360 counts what is in use:
| Module | Counts |
|---|---|
| Developer | People on enrolled collectors (machines), where coding agents report from |
| Finance, Security | People on enrolled collectors and browser extensions |
| Compliance | No seats: priced per organisation |
Devices that are revoked, or not seen for 30 days, do not count. When a module uses more seats than it has, owners and administrators see a banner naming the module, the seats in use and the seats bought. It is a warning only: nothing is refused, and data keeps flowing. Add seats under Settings → Billing.
Cloud edition: modules come from your subscription
Section titled “Cloud edition: modules come from your subscription”| Plan | Modules |
|---|---|
| Personal (free) | Developer, and Security discovery (read-only) |
| Team or Enterprise on a module plan (for example Team — Security) | The modules that plan names |
| Team bought on a plain Team plan before 14 October 2026 | Every module |
| Team bought on a plain Team plan since then | Developer |
| Enterprise (contract) | Every module, unless the contract names them |
Add a module or a bundle to any plan as an add-on under Settings → Billing. The billing page lists each module and where it comes from. If a subscription is paused or cancelled, the organisation falls back to Personal’s modules; add-ons that are still paid for stay.
Organisations that existed when modules launched
Section titled “Organisations that existed when modules launched”Every organisation that existed when modules launched was given every module.
- Paying organisations keep them with no end date, for as long as they pay.
- Organisations on the free Personal plan keep them until their next renewal date after 14 October 2026 — the monthly anniversary of their billing period, or of their sign-up if they have no subscription — and then have Personal’s modules. The billing page shows the date. A paid plan that is cancelled falls back to Personal and follows the same rule.
Cloud edition: fair-use allowances
Section titled “Cloud edition: fair-use allowances”A hosted plan includes monthly allowances for what Shield360 runs on your behalf. Counts start again on the first of each month (UTC), and Settings → Billing shows this month’s usage against each one. Enterprise contracts can set their own allowances.
| Allowance | What counts | When it is used up |
|---|---|---|
| AI on Shield360’s model | Tokens the AI analyst and Rex use on the model Shield360 provides | The analyst pauses (its investigations say why) and Rex answers 402 until the month turns |
| Rex messages | Questions to Rex on the model Shield360 provides | Rex answers 402 until the month turns |
| Application telemetry | Spans stored on Shield360’s servers, counted hourly | Still accepted, up to a hard ceiling (150% of the allowance) |
Usage on your own AI provider key is never counted: add one in Chat Settings and the analyst and Rex carry on without limit from the plan.
Administrators are alerted when included AI reaches 90% and when it is used
up, and when telemetry reaches 90% and 100% of its allowance. Above the hard
ceiling, the SDK ingest endpoint (/api/ingest/otlp) answers that
organisation with 429 Too Many Requests and a Retry-After header; OTLP
exporters hold the batch and retry, and a critical alert says it has started.
Telemetry from enrolled machines is not refused. Telemetry is never refused
below 100% of the allowance.
A self-hosted deployment has none of these allowances: it runs on your own model and your own storage.
Self-hosted: modules come from licence keys
Section titled “Self-hosted: modules come from licence keys”A self-hosted deployment’s modules come from its licences. See Self-hosted licence for installing one.
- A licence that names no modules grants every module. This includes every licence issued before modules existed, so nothing changes when you upgrade.
- A licence can name the modules it grants, for example only Compliance and Security. It can also give one module its own seats or its own end date.
- A module licence adds modules to your licence. It is issued for the same customer, verified on its own, and never makes settings read-only when it expires: its modules simply lapse after its grace period.
Add a module licence
Section titled “Add a module licence”Shield360 sends a .lic file for the module, issued to the same customer
as your licence.
Open Settings → Licence, paste the licence or choose the file, and select Install licence. A module licence is added beside your licence; it does not replace it.
If your licence comes from the environment, you can also add the module
licence to SHIELD360_LICENSE or to the licence file, separated from the
other licences by a newline:
SHIELD360_LICENSE="S360L1.eyJ2IjoxLC…S360L1.eyJ2IjoyLC…"Settings → Licence lists every module licence with its state, and the modules in force. The module’s pages unlock within a minute.
How licences combine
Section titled “How licences combine”| Rule | |
|---|---|
| One licence decides seats, expiry and read-only | The first of SHIELD360_LICENSE, SHIELD360_LICENSE_FILE and the uploaded licence, as before |
| Module licences come from every source | The environment, the file and Settings → Licence |
| A module from several licences | Granted once, with the largest seat count and the latest end date |
| A module licence for another customer | Refused (customer_mismatch) |
| A module licence past its expiry and grace | Its modules lapse; nothing becomes read-only |
| No licence yet, or one that does not verify | Every module; the first-install grace and read-only rules apply as before |
Billing and true-up pages
Section titled “Billing and true-up pages”Billing
Section titled “Billing”Settings → Organisation → Billing (/settings/billing) is the Billing & subscription page of the cloud edition. It does not exist on a self-hosted deployment. It shows the modules your subscription includes, this month’s usage against the plan’s fair-use allowances, monitored people and production applications counted against the plan, and the plan with its invoices.
A subscription is priced per monitored person: someone whose AI use Shield360 monitors through a collector or the browser extension. People who only view the dashboards are free and are not counted. Viewing the subscription needs View the subscription (billing.read: owners, administrators and the Finance role). Changing the plan, seats or payment details needs Manage the subscription (billing.manage: owners).
True-up
Section titled “True-up”Settings → Organisation → True-up (/settings/true-up) shows what you are licensed for, what was counted each month, and what the quarterly true-up would add under the rules in your agreement. It appears only where something is bought: a self-hosted licence or a cloud plan. Reading it needs View the subscription (billing.read).
- What you bought comes from your licence or plan, for monitored people and production applications. Each shows the licensed quantity, the quantity included with the buffer, and whether it is Trued up quarterly, Covered company-wide: no true-up or has No limit: no true-up. A company-wide licence covers everyone at your company, so no true-up applies to monitored people. Production applications are still trued up.
- The rules:
- A buffer over the licensed quantity is included at no charge, rounded up to a whole number.
- Each quarter is judged on its peak month, separately for monitored people and production applications.
- When the peak goes past what is included, the true-up adds the peak minus the licensed quantity from the next period on. It is never backdated.
- Only quantities change. Anything added is charged at your locked rate.
- Each quarter shows its peak month, a status (True-up due, Within what is included, No true-up or Not counted yet) and what it would add. A quarter in progress can still rise. The page also shows the next true-up review and when the licence ends or the plan renews.
- The last 12 months are charted against the licensed and included quantities, and listed under Monthly counts: monitored people, production applications and AI calls in production for each month, and whether the month is final. Select Export CSV to download the counts.
- The latest month in detail splits monitored people by source (Collector (computers), Browser extension and AI gateway) and lists the top production applications by AI calls. A person seen by more than one source is counted once in the total.
Usage is counted once a day. The first numbers appear the day after the first count.