Self-hosted licence

An enterprise deployment of Shield360 that you run yourself needs a licence from Shield360. The platform checks the licence offline against a public key built into each release. By default it never makes a network call, sends usage data, or phones home, so the same process works on a cluster with no internet access. The only optional exception is the daily revocation list refresh, which is off unless you turn it on.

Note

Licensing applies only when you set SHIELD360_DEPLOYMENT=self-hosted. The cloud edition at app.shield360.ai and deployments without that setting need no licence, and nothing on this page applies to them.

Turn licensing on

Set this on every Shield360 app container:

SHIELD360_DEPLOYMENT=self-hosted

Then install the licence using one of the methods below. Shield360 uses the first one it finds, in this order:

Order	Where	Best for
1	SHIELD360_LICENSE, containing the licence string	Docker Compose, simple installs
2	SHIELD360_LICENSE_FILE, pointing to a file that holds the licence	Kubernetes and Helm, with the licence mounted from a Secret
3	Settings → Licence in the UI	Installs where you would rather not redeploy to renew

A licence is a single line that starts with S360L1.. The file you receive (.lic) contains just that line.

Register your deployment

Each install has its own deployment ID (s360d_…). Shield360 generates it on first start and never changes it. To see it, open Settings → Licence → Register this deployment as an administrator. Copy request gives you a ready-made licence request. Send it to Shield360 and paste the licence you get back under Settings → Licence.

A licence issued for your deployment ID works on that install only. Nothing is sent from the install: registration is the ID you send to Shield360.

Getting a licence

Shield360 issues licences. Each one is signed for your organisation and names the modules, features, number of seats and term you agreed, and optionally the deployment it is bound to. To get a licence, renew one, add a module or change seats, contact your Shield360 account team or support@shield360.ai, and give them your customer ID if you have one. A module licence must carry the same customer ID as your licence, so quote it when you ask for one. You can’t create or edit a licence yourself: any change to its contents breaks its signature.

Environment variable

SHIELD360_DEPLOYMENT=self-hosted
SHIELD360_LICENSE=S360L1.eyJ2IjoxLC…

Kubernetes Secret, mounted as a file

kubectl -n shield360 create secret generic shield360-license \
  --from-file=license.lic=./acme.lic

# In the Shield360 app Deployment
spec:
  template:
    spec:
      containers:
        - name: shield360
          env:
            - name: SHIELD360_DEPLOYMENT
              value: self-hosted
            - name: SHIELD360_LICENSE_FILE
              value: /etc/shield360/license/license.lic
          volumeMounts:
            - name: license
              mountPath: /etc/shield360/license
              readOnly: true
      volumes:
        - name: license
          secret:
            secretName: shield360-license

To renew, replace the Secret. Shield360 reads the file again within a minute, so there is no need to restart.

Upload in the UI

An organisation owner opens Settings → Licence, pastes the licence or chooses the .lic file, and selects Install licence. Shield360 verifies the licence before saving it, then stores it in PostgreSQL. It replaces any licence uploaded before. Installing or removing a licence is recorded in the audit log with the licence ID, customer and expiry. The licence itself is never recorded.

If platform administrators are configured, only they can change the licence, even if they are organisation owners. Name them by user id in SHIELD360_PLATFORM_ADMIN_USER_IDS (comma-separated). The older SHIELD360_PLATFORM_ADMINS (comma-separated emails) is deprecated: it counts only while no user ids are set, and only for an account whose email a sign-in provider has verified and that is not provisioned by SCIM.

If the licence comes from SHIELD360_LICENSE or SHIELD360_LICENSE_FILE, the page shows it read-only and notes that the deployment manages it. To change it, update the environment variable or file where the deployment is configured.

Modules

A licence can name the Shield360 modules it covers, and a separate module licence can add more later. A licence that names no modules — every licence issued before modules existed — covers all of them. See Modules and licensing.

Air-gapped clusters

• Verification needs nothing but the licence and the Shield360 image. There is no licence server, and no outbound traffic to allow.
• Copy the .lic file into the cluster the same way you copy images, then use either the Secret or the UI upload.
• Keep server clocks roughly correct. A licence is refused if its start date is more than five minutes ahead of the server’s clock.
• Licences withdrawn before their expiry reach an air-gapped cluster through the revocation list: with each new image, or when you upload a newer list.

Revocation list

Shield360 can withdraw a licence before its expiry, for example after a refund or if a licence file leaks. Withdrawn licence IDs are published in a signed revocation list: a single line that starts with S360R1.. It holds licence IDs only, nothing about the customers they belong to. It is signed with the same key as licences, so nobody else can make one.

A licence on the list is refused with the reason withdrawn, exactly like a licence that does not verify (see No licence, or a licence that does not verify).

Your deployment combines the revocations built into its release with the newest valid list it has, from any of these:

Source	How it arrives
The image	Each release image carries the list that was current when it was built. Upgrading brings it in.
Settings → Licence → Revocation list	Paste the list, or choose the .s360r file, and select Add revocation list. The same people who can change the licence can add a list. Adding one is recorded in the audit log with its sequence number and the number of IDs.
Online refresh (optional)	Set SHIELD360_LICENSE_REVOCATION_URL to https://app.shield360.ai/api/licenses/revocations, or to a copy on your own network. Shield360 then fetches the list once a day.

Some rules apply to every source:

• Newest wins. Each list has a sequence number. A list that is older than the one in force is never used, and an upload of one is refused. Replaying an old file can’t bring a withdrawn licence back.
• Bad lists are ignored. If a list’s signature doesn’t match, or it was signed with a key this release doesn’t know, it’s ignored. Settings → Licence shows which list was ignored and why.
• The refresh is off by default. Without SHIELD360_LICENSE_REVOCATION_URL nothing is fetched. With it, the refresh is a plain GET with no cookies, credentials, deployment ID or usage data. Every list fetched is checked against its signature before it’s used, so you can serve it from any internal mirror.

Settings → Licence shows which list is in force, when it was signed, how many licences it refuses, and when the online refresh last ran.

Licences bound to a deployment

A licence can be bound to one deployment. It then verifies only on the install whose deployment ID matches the ID in the licence. That ID is the one shown under Register this deployment. You can also set your own, for example to keep one ID across a rebuild that starts with an empty database:

SHIELD360_DEPLOYMENT_ID=acme-prod

Trial licences

For a pilot, Shield360 issues a trial licence. It is an ordinary licence for the deployment, with three differences:

• It grants every module.
• It ends 30 days after it starts unless Shield360 picks another date, and never more than 45 days after.
• Its grace period is 7 days unless it says otherwise (at most 14).

Shield360 shows it as Trial — ends <date> in the banner every signed-in person sees and on Settings → Licence. When the pilot becomes a purchase, install the full licence over it: data, settings and enrolled machines are kept.

A trial licence carries "trial": true in its payload. Releases from before trial licences ignore that field and treat the licence as an ordinary one, so a trial installs on any supported release.

What happens at expiry

Nothing stops the flow of evidence. At every stage, collection, ingest, enforcement (browser extension and guard policy), sign-in, and viewing data and reports keep working.

State	When	What changes
Active	The licence is in date	Nothing.
Expiring soon	Under 30 days to expiry	A banner shows the days left.
Grace period	After expiry, for the licence’s grace period (30 days unless it says otherwise)	A banner shows the days until read-only. Everything still works.
Read-only	After the grace period	Configuration, policy and settings changes are refused, and new computers and browsers cannot enrol. Machines that are already enrolled keep reporting.

While Shield360 is read-only, you can still:

• Install a licence.
• Sign in and change your own profile.
• Switch organisation, and close or export an organisation.
• Handle erasure requests and legal holds.
• Acknowledge alerts.
• Revoke an API key, an install key or a computer.

Refused changes return 403 with the code license_read_only. The collector CLI and the browser extension show the message when they try to enrol.

No licence, or a licence that does not verify

A new deployment with no licence gets a 14-day first-install grace, measured from the first time it started without a licence, with everything working. After that it is read-only until you install a licence. The grace applies once: restarting or removing a licence does not start it again, and a deployment that has already been licensed gets no grace.

A licence that does not verify counts as no licence. This covers a licence that was edited, signed with an unknown key, not yet valid, withdrawn, or bound to another deployment. Settings → Licence shows the reason.

Seats

The licence states the number of seats: people who belong to an organisation on the deployment. Going over only shows a warning, and nothing is switched off.

Collectors

A licence can also limit the number of machine collectors: computers and servers running the Shield360 collector that reported in the last 30 days. Browser extensions and the AI proxy don’t count, because seats already cover the people using them. Machines that stop reporting for 30 days, or that you revoke under Fleet, free their place on their own.

Settings → Licence shows the active count against the limit.

• Over the limit: a warning appears, and new machines can still enrol up to 10% over.
• At the limit plus 10%: new machines can’t enrol. The collector reports that the limit is reached.
• Enrolled machines: they keep reporting either way, so no evidence is lost.

To raise the limit, ask Shield360 for a new licence. A licence without a limit allows any number of collectors.

Monitored people and production applications

A licence can name how many monitored people and production applications it covers, or be a company-wide licence for a headcount or headcount band.

• Monitored people: people whose AI use a collector, browser extension or AI gateway reported in the calendar month. Each person counts once, however many devices they use: a collector account, a browser profile email and a gateway user that belong to the same person are merged, through your identity connector where you have one. People who only sign in to the dashboard are not counted.
• Production applications: services that made AI calls in production in the month. A span’s deployment.environment of production, prod or prd is production; a span without one follows the environment it reports into. Development and test traffic never counts.
• Company-wide: without a monitored-people number, people are measured against the headcount, or the top of the band.

Usage is counted once a day for the whole install (USAGE_METERING_SCHEDULE, default 41 0 * * *, UTC). Settings → Licence shows this month against the licence and the twelve months before.

• At 90% and at 100%: organisation owners and admins see a banner, and a usage.threshold alert is raised once per threshold per month.
• Up to 10% over: included at no charge.
• Past that: the next quarterly true-up adds the difference from then on, never backwards.
• Monitoring and ingest never stop because of these counts.

A licence without these terms covers any number of people and applications, and releases from before them verify it unchanged.

Usage reporting

A licensed install tells Shield360 its usage once a day, so true-ups use the same figures you see in Settings → Licence. It is on by default for licensed installs, and you can turn it off.

What is sent

One small JSON report a day, to https://portal.shield360.ai/api/portal/usage:

Field	Example
Licence ID	lic_…
Deployment ID	s360d_…
Month	2026-11
Monitored people	120
Production applications	4
AI calls in production	98765
Product version	2.4.1
When the month was counted	2026-11-10T00:41:00Z

Nothing else is sent: no names, emails, organisations, application names, host names or addresses. The portal refuses a report that carries any other field. On the first day of a month the month before is sent once more, after its last day has been counted.

How reports are signed

On its first report the install creates its own Ed25519 key pair and keeps it in Postgres, with the private key encrypted by the install’s secret (SHIELD360_VAULT_ENCRYPTION_KEY, or NEXTAUTH_SECRET). Every report is signed with it, and the first reports carry the public key.

The portal trusts the first key it sees for a registered deployment and pins it (trust on first use). From then on it accepts reports for that deployment only when they are signed by that key. Reports for deployment IDs that are not registered in the portal are refused, so register the install under Deployments in the customer portal first.

Note

If you reinstall with a new database, or change the install’s secret, the install has a new key and the portal refuses its reports. Ask Shield360 support to reset the key for that deployment; the next report pins the new one. Settings → Licence shows the key’s fingerprint to compare.

Turn it off

Set SHIELD360_USAGE_REPORTING=off and restart. Nothing is sent from then on. Send a usage statement instead (below) when Shield360 asks for your usage.

A report that cannot be delivered is retried after 1, 2, 4 and up to 24 hours. Nothing else is affected: monitoring, ingest and the licence carry on. Outbound reports do not go through an HTTP proxy; on networks that only reach the internet through one, use usage statements.

Settings → Licence → Usage reporting shows whether reporting is on, where it sends to, when it last sent, and the last problem.

Offline usage statement

For installs that cannot connect out:

Download the statement

In Settings → Licence → Usage reporting, choose Download usage statement. The file holds this month’s and the two previous months’ counts, the licence ID and the deployment ID, signed with the install’s key. Only people who can change the licence can download it.

Upload it in the customer portal

Sign in to the customer portal, open Usage, and upload the file. The portal verifies it exactly as it verifies a daily report, and it must name one of your registered deployments.

Uploading the same statement twice changes nothing; a newer count of a month replaces an older one.

Environment variables

Variable	Purpose
SHIELD360_DEPLOYMENT	Set to self-hosted to require a licence. Any other value, or none, turns licensing off.
SHIELD360_LICENSE	The licence string. Takes precedence over everything else.
SHIELD360_LICENSE_FILE	The path to a file that holds the licence.
SHIELD360_DEPLOYMENT_ID	This deployment’s ID, for licences bound to one.
SHIELD360_LICENSE_REVOCATION_URL	Optional. Where to fetch the signed revocation list once a day. Unset, which is the default, means nothing is fetched.
SHIELD360_USAGE_REPORTING	Set to off to stop the daily usage report. On by default for licensed installs.
SHIELD360_USAGE_REPORT_URL	Where usage reports go. Defaults to https://portal.shield360.ai/api/portal/usage. Must be https.
USAGE_REPORTING_SCHEDULE	How often the install checks whether a report is due (cron, UTC). Defaults to 23 * * * *; a report is sent about once a day.
SHIELD360_LICENSE_REVOCATION_FILE	The revocation list baked into the image (/app/licensing/revocations.s360r). Set by the image, so you don’t normally change it.