Free Store
Get started
Concepts

Plugin licensing

A Quox plugin adds a capability to your instance. Licensing decides which plugins your organisation is allowed to run, and it is enforced server-side, not in the browser. This page explains the states a plugin passes through, how you get a licence, how server bands are planned to work, and the limits of what self-hosted enforcement can and cannot do.

Three states a plugin can be in

Enabled, licensed, and active are separate things. A plugin can be enabled without being licensed, and licensed without yet being active. The one that controls access is licensed.

EnabledYou turned it on. Enabling a plugin is a local choice in your settings: it says you want this capability present. On its own it does nothing if your org does not hold the licence for it.
LicensedYour org holds the entitlement for the plugin. This is the state that gates the plugin. The entitlement is checked server-side against the calling org, so enabling a plugin your org is not licensed for leaves its page and its data closed.
ActiveThe plugin is licensed, provisioned, and running. Its bundle has loaded, its routes answer, and it is doing work for your org. A plugin only reaches active once both the licence and the activation are in place.

Licensed is the state that gates a plugin's page because the licence check runs on the server, keyed to the org making the request. The frontend can show or hide a menu item, but that is presentation. The real gate is the entitlement, and a request from an unlicensed org for a plugin's data or secrets is refused at the collector regardless of what the browser displays.

How you get a licence

Core is free. The base platform and the plugins that ship as core carry no licence cost, and a fresh organisation can run them without paying anything.

Entitlements attach to your organisation, not to a person or a single machine. When your org is granted a plugin, that entitlement is what every instance in the org is checked against. Activation then binds a running instance to the entitlement and gives it a persistent instance id, so the same seat is not spent twice.

Free plugins can be claimed directly through the device activation flow. From a signed-in org, you start an activation, the box polls for approval, and you approve it on the account side. The flow forwards only free plugin ids and approves only free ones. A paid plugin claimed by a user without the entitlement is still refused. In practice this means a new org owner can claim the free plugins for their instance in under two minutes, without needing instance-admin rights.

Server allowance and bands

The pricing model is built around servers, but lightly. Core plus one or two servers is free. Charging only starts at three servers and up, and it is meant to stay affordable. The real value is in the enterprise plugins, not in counting servers, so the server bands exist to be fair about scale rather than to be the main price.

The planned band ladder is below. This is the intended structure, not a live price list. Banded billing is not switched on yet. It is waiting on the billing work, so you cannot purchase a band today, and no amounts are published here as a live offer.

1 to 2 serversFreeCore plus one or two servers. No charge.
3 serversPlannedThe first paid step. Priced to stay affordable.
4 to 5 serversPlannedNext band up.
6 to 10 serversPlannedSmall fleet.
11 to 20 serversPlannedGrowing fleet.
21 to 50 serversPlannedMid-size fleet.
51 to 100 serversPlannedLarge fleet.
100+ serversPlannedEnterprise fleet.

Until banded billing lands, the checkout guard fails closed: it refuses to sell a band that has no configured price rather than guess one. The free allowance for Core plus one or two servers works today. The paid bands are planned, and this page will carry real prices once billing is live.

The honest ceiling

Self-hosted software cannot be made uncrackable, and we do not pretend otherwise. Licensing stops key forgery, seat abuse, a cancelled customer continuing to run, and unpaid downloads. It does not stop a root operator who patches their own box, and some features ship thin client code that is visible on the customer's own machine. No vendor's licensing model closes those gaps on self-hosted software, and we do not claim ours does.

The durable boundary is the Quox Verified countersignature. A cracked box still emits its own real evidence. What it cannot do is obtain our signature on that evidence. Verification is a separate, stateless check against a record we hold, so the value that survives tampering is the countersignature, not the licence key.

We never call a customer's own evidence fake. If a box is running outside its licence, that is a licensing matter. The evidence it produces is still the customer's, and we treat it as real. What we withhold is the countersignature, not the truth of their records.