Licensing

All Align deployments require a valid license. Self-hosted deployments use signed JWT license files that are validated locally with no phone-home requirement.

How Licensing Works

Align uses cryptographically signed JWT license files:

• Offline Validation - License is validated locally using an embedded public key. No phone-home or internet access required
• Cryptographically Signed - JWT signed with RSA-4096 for tamper-proof validation
• Grace Period - 14-day grace period after expiry to allow renewal
• Feature-Based - Licenses enable specific features and set usage limits
• No Source Code - Self-hosted deployments use pre-built container images; no repository access is provided

Deployment Model

Align follows a registry-based distribution model (no source code distribution):

1. Customer purchases license at align.tech/pricing or via sales
2. Receives license key for container registry access + license.jwt for validation
3. Pulls pre-built images into their own infrastructure
4. Services validate the license.jwt locally on startup (no network calls)
5. All customer data stays in the customer's environment

Why this model?

• Enterprise-friendly: works in air-gapped and restricted network environments
• Consistent seat-based billing across all deployment types
• Feature entitlements (connectors, analytics, compliance modules) controlled per license
• Automatic access to new container image versions during your subscription
• No risk of unauthorized redistribution since source code is never distributed

Obtaining a License

Contact sales@align.tech to obtain a license for your organization.

You'll receive:

1. Registry credentials for pulling container images
2. A license.jwt file for local service validation
3. License terms and expiration date
4. Support contact information

Installation

Step 1: Authenticate to Container Registry

# Log in to Align's container registry (AWS ECR) using your AWS credentials
aws ecr get-login-password --region eu-west-2 | \
  docker login \
    --username AWS \
    --password-stdin 869633161172.dkr.ecr.eu-west-2.amazonaws.com

Step 2: Create License Secret

kubectl create secret generic align-license \
  --namespace align \
  --from-file=license.jwt=./license.jwt

Step 3: Enable in Helm Values

# values.yaml
license:
  enabled: true
  secretName: align-license
  secretKey: license.jwt

Step 4: Apply Configuration

helm upgrade align oci://869633161172.dkr.ecr.eu-west-2.amazonaws.com/align/charts/align \
  --namespace align \
  --values values.yaml

Verification

Check that the license is loaded:

# Check gateway logs
kubectl logs -l app.kubernetes.io/component=gateway -n align | grep -i license

# Expected output:
# License validated successfully: Acme Corp (Enterprise)
# License expires: 2026-12-31

License File Contents

Your license file (license.jwt) is a signed JWT containing:

{
  "iss": "https://align.tech",
  "sub": "lic_abc123",
  "aud": "align-self-hosted",
  "iat": 1704067200,
  "exp": 1798761600,
  "nbf": 1704067200,
  "customer": {
    "id": "cust_abc123",
    "name": "Acme Corp",
    "email": "admin@acme.com"
  },
  "plan": "enterprise",
  "limits": {
    "users": 500,
    "decisions": null,
    "connectors": ["slack", "github", "jira", "linear", "teams"],
    "features": ["sso", "auditLog", "customBranding", "apiAccess"]
  },
  "deployment": {
    "type": "self-hosted"
  }
}

License Limits

Limit	Description
users	Maximum number of users (null = unlimited)
decisions	Maximum decisions per month (null = unlimited)
connectors	List of allowed connectors (e.g., slack, github, jira)
features	List of enabled features (e.g., sso, auditLog, gpuModels)

Proprietary Model Distribution

Enterprise licenses include access to Align's fine-tuned decision models. These are distributed as container images via the same registry used for all Align services:

registry.align.tech/align/llm-server:v1.0.0   # vLLM + Align model weights

How it works:

1. Your license JWT grants pull access to the model server image
2. You pull the image to your cluster (or mirror to your internal registry)
3. The model runs locally via vLLM - no inference data leaves your infrastructure
4. No phone-home, no telemetry, no network calls during inference

Air-gapped deployments: Mirror the model image alongside all other Align images. See Installation - Mirror to Your Registry.

The proprietary value is in the model weights (trained on anonymized decision patterns), not the serving infrastructure (vLLM is open source). Weights are gated behind your Enterprise license and registry authentication.

License validity is verified and logged at gateway startup. Seat enforcement is opt-in and off by default - set LICENSE_ENFORCEMENT_ENABLED=true to turn it on.

Note: the seat-enforcement middleware (checkLicenseSeats) ships in this release but is not yet attached to any route, so setting LICENSE_ENFORCEMENT_ENABLED=true does not block anything today. Wiring it onto the user-provisioning route is a follow-up, pending the final seat model. The flag exists so the behaviour below is testable and ready to switch on.

When the middleware is wired and enabled, and a valid license's seat limit is reached, user-provisioning requests are refused with a clear error. The seat limit comes from the license; a null limit means unlimited seats and nothing is enforced. If the license is missing, invalid, or the seat count cannot be determined, enforcement fails open (logged, not blocked) so a self-host is never locked out. Connector access is never gated - all deployments get all integrations.

License Expiry

Grace Period

When your license expires, you have a 14-day grace period:

• Days 1-14: grace period - the license reports as in-grace in startup status/logs
• After 14 days: the license reports as expired in status/logs

The 14-day grace is tracked and surfaced in the license status; expiry does not by itself switch the app into read-only mode.

Renewal

To renew your license:

1. Contact sales@align.tech
2. Receive new license.jwt
3. Update the Kubernetes secret:

kubectl create secret generic align-license \
  --namespace align \
  --from-file=license.jwt=./new-license.jwt \
  --dry-run=client -o yaml | kubectl apply -f -

4. Restart gateway pod to pick up new license:

kubectl rollout restart deployment/align-gateway -n align

Plans

Plan	Who it's for	Notes
Design Partner	Teams helping shape Align	Free, full product access, all integrations, direct founder support
Enterprise & Self-Hosted	Teams needing self-hosting, SSO, or compliance	Custom engagement; licensing based on team size

All deployments get all integrations - there are no connector limits. A license encodes a seat limit; enforcement of that limit is opt-in (see above).

Network Requirements

License validation is fully offline. The only network requirement is pulling container images during initial deployment or upgrades:

Endpoint	Purpose	When
869633161172.dkr.ecr.eu-west-2.amazonaws.com	Container image pulls	Deployment/upgrade only
registry.align.tech	Model server images (Enterprise)	GPU model deployment only

For fully air-gapped environments, images can be mirrored to an internal registry. Contact sales@align.tech for air-gapped deployment support.

Troubleshooting

License not found

Error: License file not found at /etc/align/license/license.jwt

Solution: Verify the secret exists and is mounted correctly:

kubectl get secret align-license -n align
kubectl describe pod -l app.kubernetes.io/component=gateway -n align

Invalid license signature

Error: License signature verification failed

Solution: Your license file may be corrupted. Contact support for a new copy.

License expired

Warning: License expired on 2026-12-31. Grace period ends 2027-01-14.

Solution: Contact sales to renew your license.

Security

• License files are cryptographically signed (RSA-4096) and cannot be modified
• The public key for verification is embedded in the application
• All validation happens locally - no external network calls for license checks
• License files should be treated as sensitive (contain customer info)

Support

For licensing questions:

• Email: sales@align.tech
• Existing customers: Contact your account representative