> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Licensing & Activation

> Activate your Enclave appliance with the licence issued by Kvelden, and understand trial, renewal, and expiry behaviour.

<Info>
  This guide is for the person who deployed the Enclave appliance. Licence
  activation is done in the appliance web UI at **`/license`** — no console
  access is required.
</Info>

## How appliance licensing works

The appliance is licensed with a **signed licence file** that Kvelden issues
for your organisation. The licence is cryptographically signed; the appliance
verifies it against a trust anchor built into the image, so it cannot be forged
or altered. No connection to Kvelden is required to activate — the appliance
validates the licence entirely offline.

Appliances are licensed at the **Enterprise‑Advanced** tier. Commercial terms
(number of seats, licence duration, support level) are encoded in the licence
your account team issues; every appliance feature is included.

| Phase        | What happens                                                                                                                                                                                      |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Trial**    | A fresh appliance runs a **30‑day full‑featured trial** from first boot — no licence required to evaluate.                                                                                        |
| **Licensed** | Uploading a valid licence replaces the trial and unlocks the licensed seat count and term.                                                                                                        |
| **Expired**  | The appliance never hard‑locks. On expiry it enters **read‑only** mode — existing data stays fully readable and downloadable; new uploads and changes are paused until a new licence is uploaded. |

***

## Upload and activate a licence

<Steps>
  <Step title="Obtain the licence file">
    Your Kvelden account team issues a licence file (`.json`) scoped to your
    organisation. It contains the validity dates, seat count, and tier — and a
    signature. Keep the file; you will upload it as‑is.
  </Step>

  <Step title="Open the licence page">
    Sign in to the appliance as the administrator and go to **`/license`**
    (for example `https://vault.yourcompany.com/license`).
  </Step>

  <Step title="Upload the licence">
    Select the licence file and click **Activate**. The appliance verifies the
    signature, confirms the licence is within its validity window, and activates
    it. On success the licence details (tier, seats, expiry) are shown.
  </Step>

  <Step title="Confirm">
    The trial banner is replaced by your licence details. Feature access and the
    seat limit now reflect the licence.
  </Step>
</Steps>

<Note>
  **Keep the appliance clock accurate.** Licence activation checks the licence's
  validity dates against the appliance's own clock. If the appliance clock is
  wrong — commonly after a VM is suspended, or on a network that blocks public
  NTP — activation can fail with **"License is not active yet"** or
  **"License has expired"** even though the licence is valid.

  Before uploading, confirm the clock on the appliance console with `time show`.
  If it is off, correct it with `time ntp <your-ntp-server>` (for example your
  internal domain controller) or, on an isolated network, set it manually with
  `time set <YYYY-MM-DD> <HH:MM:SS>` in **UTC**. See
  [Time & clock synchronisation](/deployment/private-appliance#time-and-clock-synchronisation).

  Licences are issued with a short grace on their start date to absorb minor
  clock differences, so an accurate appliance clock always activates a
  freshly‑issued licence.
</Note>

***

## Renewing before expiry

To extend or resize your deployment, request a new licence from your account
team and upload it at **`/license`** the same way. The new licence takes effect
immediately; there is no downtime and no reinstallation.

We recommend renewing a few days before expiry. If a licence does lapse, the
appliance remains available in read‑only mode and uploading a new licence
restores full function immediately — no data is lost.

***

## Troubleshooting

| Symptom                                      | Cause                                                                   | Resolution                                                                    |
| -------------------------------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| **"License is not active yet"**              | Appliance clock is behind the licence start date                        | Correct the clock (`time show`, then `time ntp` / `time set`), then re‑upload |
| **"License has expired"**                    | Licence past its end date, or appliance clock is far ahead              | Verify the clock; if correct, request a renewed licence                       |
| **"Invalid license signature"**              | File was modified, or it was issued for a different Kvelden signing key | Re‑download the original file from your account team; do not edit it          |
| **"License does not belong to this tenant"** | Licence issued for a different organisation                             | Confirm you received the licence issued for *your* organisation               |
| Upload appears to do nothing                 | Appliance clock or a transient error                                    | Check the appliance console `health`; retry after confirming the clock        |

<Note>
  The appliance never contacts Kvelden to validate a licence, and it never
  hard‑locks your data. Even an expired licence leaves every file readable and
  downloadable.
</Note>