Licensing

Self-hosted Align deployments require a valid license file.

How Licensing Works

Align uses signed JWT license files for self-hosted deployments:

• Offline Validation — License is validated locally, no phone-home required
• Cryptographically Signed — JWT signed with RSA-4096 for tamper-proof validation
• Grace Period — 14-day grace period after expiry to allow renewal
• Feature-Based — Licenses enable specific features and set usage limits

License File

Your license file (license.jwt) is a signed JWT containing:

{
  "iss": "https://align.tech",
  "sub": "lic_abc123",
  "aud": "align-self-hosted",
  "iat": 1704067200,
  "exp": 1798761600,
  "nbf": 1704067200,
  "customer": {
    "id": "cust_abc123",
    "name": "Acme Corp",
    "email": "admin@acme.com"
  },
  "plan": "enterprise",
  "limits": {
    "users": 500,
    "decisions": null,
    "connectors": ["slack", "github", "jira", "linear", "teams"],
    "features": ["sso", "auditLog", "customBranding", "apiAccess"]
  },
  "deployment": {
    "type": "self-hosted"
  }
}

Obtaining a License

Contact sales@align.tech to obtain a license for your organization.

You'll receive:

1. A license.jwt file
2. License terms and expiration date
3. Support contact information

Installation

Step 1: Create License Secret

kubectl create secret generic align-license \
  --namespace align \
  --from-file=license.jwt=./license.jwt

Step 2: Enable in Helm Values

# values.yaml
license:
  enabled: true
  secretName: align-license
  secretKey: license.jwt

Step 3: Apply Configuration

helm upgrade align oci://869633161172.dkr.ecr.eu-west-2.amazonaws.com/align/charts/align \
  --namespace align \
  --values values.yaml

Verification

Check that the license is loaded:

# Check gateway logs
kubectl logs -l app.kubernetes.io/component=gateway -n align | grep -i license

# Expected output:
# License loaded successfully: Acme Corp (Enterprise)
# License expires: 2025-12-31

License Limits

Limit	Description
users	Maximum number of users (null = unlimited)
decisions	Maximum decisions per month (null = unlimited)
connectors	List of allowed connectors (e.g., slack, github, jira)
features	List of enabled features (e.g., sso, auditLog)

When limits are exceeded:

• New users cannot be invited
• New connectors cannot be connected
• Warning banners appear in the UI

License Expiry

Grace Period

When your license expires, you have a 14-day grace period:

• Days 1-14: All features work, warning banners displayed
• After 14 days: Read-only mode (can view, cannot create)

Renewal

To renew your license:

1. Contact sales@align.tech
2. Receive new license.jwt
3. Update the Kubernetes secret:

kubectl create secret generic align-license \
  --namespace align \
  --from-file=license.jwt=./new-license.jwt \
  --dry-run=client -o yaml | kubectl apply -f -

4. Restart gateway pod to pick up new license:

kubectl rollout restart deployment/align-gateway -n align

License Plans

Plan	Users	Features
Starter	Up to 25	Core features
Team	Up to 100	+ SSO, Audit log
Enterprise	Unlimited	+ Custom branding, API access, Priority support

Troubleshooting

License not found

Error: License file not found at /etc/align/license/license.jwt

Solution: Verify the secret exists and is mounted correctly:

kubectl get secret align-license -n align
kubectl describe pod -l app.kubernetes.io/component=gateway -n align

Invalid license signature

Error: License signature verification failed

Solution: Your license file may be corrupted. Contact support for a new copy.

License expired

Warning: License expired on 2024-12-31. Grace period ends 2025-01-14.

Solution: Contact sales to renew your license.

Security

• License files are cryptographically signed and cannot be modified
• The public key for verification is embedded in the application
• License validation happens locally — no external network calls
• License files should be treated as sensitive (contain customer info)

Support

For licensing questions:

• Email: sales@align.tech
• Existing customers: Contact your account representative