---
description: How the Actian-signed Licence works on a self-managed deployment, how to install or replace it, what happens during the grace period and after expiry, and where members see it.
---

# Licence

!!! info "Availability"
    - **Who can do this:** installing or replacing the Licence is an operator task on the host or cluster. Viewing it in **Settings** → **Usage** needs Studio access.
    - **Deployment:** Self-managed deployments only. On Actian SaaS, see [Billing & Usage](../settings/billing.md).

A self-managed deployment runs on a Licence: a file that Actian signs and sends you. The Licence sets what your deployment is entitled to, such as Seats, limits and features, and when that entitlement ends.

## Install the Licence

The Licence is read once, when the server starts. After you add or replace it, restart the server.

=== "Compose bundle"

    The Compose bundle always runs with Licence checks turned on (`ENTITLEMENT_BACKEND=licence`).

    1. Save the signed Licence as `licence/licence.json` in your installation directory (the directory that holds `docker-compose.yml`).
    2. Optional: to use a different directory or file name, set `LICENCE_DIR` or `LICENCE_FILE` in `.env`.
    3. Load the Licence into the server:

    - First start: run `docker compose up -d --wait`.
    - Licence already installed and the server already running: run `docker compose restart server`. `docker compose up -d` doesn't restart a running server when only the Licence file changed.

=== "Helm chart"

    1. Create a Secret that holds the Licence under the key `licence.json`. The name `ai-analyst-licence` is an example; any name works:

        ```sh
        kubectl -n <NAMESPACE> create secret generic ai-analyst-licence \
          --from-file=licence.json=./licence.json
        ```

    2. Reference the Secret in your values file:

        ```yaml
        server:
          licence:
            existingSecret: ai-analyst-licence
        ```

    3. Install or upgrade the release. The chart mounts the Secret at `/etc/ai-analyst/licence` on every server pod and sets `ENTITLEMENT_BACKEND=licence`, `LICENCE_PATH=/etc/ai-analyst/licence/licence.json` and `LICENCE_PUBLIC_KEY_PATH=/etc/ai-analyst/licence/licence-public.pem`.

    !!! warning
        The chart turns on Licence checks only when `server.licence.existingSecret` is set. The default is empty. Set it on every self-managed install.

### Replace the Licence

When Actian sends you a renewed Licence:

- **Compose bundle:** replace `licence/licence.json`, then run `docker compose restart server`.
- **Helm chart:** update the Secret's `licence.json` key, then restart every server Deployment (for example with `kubectl rollout restart`).

## Licence states

| State | When | What members see |
|---|---|---|
| **Active** | Until the Licence end date. | Nothing special. |
| **Grace** | From the Licence end date until the end of the grace period. | AI Analyst keeps working. Studio shows an amber banner at the top of the page: *Your licence ended on &lt;date&gt;. AI Analyst keeps working until &lt;date&gt;; renew the licence before then to avoid interruption.* |
| **Expired** | After the grace period ends. | The server refuses product work for every organization on the deployment. |

The grace banner appears only in Studio. Members who use only Explorer don't see it, so tell them about an upcoming expiry yourself.

<!-- screenshot: self-managed-licence-grace-banner -->

### After the Licence expires

The server keeps starting, and members can still sign in, load their session and switch organizations. Every other request for product work is refused with HTTP status 403, code `licence_expired` and the message *The deployment's licence has expired*. This includes pages that only read data.

You can still take your data out:

- **Workspace export through the public API.** The [public API](../public-api/README.md) Workspace export keeps working for members after expiry. Importing, and the export and import history, are refused. The in-app **Settings** → **Import / export** page isn't reliable once the Licence has expired, so use the public API to take a Workspace out. See [Export semantic layer and agents](../governance/export-semantic-layer-and-agents/README.md).
- **Diagnostic export.** On Air-gapped deployments only, members with the **Manage organization** capability can still produce a [Diagnostic export](diagnostic-export.md) for Actian.

To restore service, install a renewed Licence and restart the server.

## See the Licence in the product

Open **Settings** → **Usage** (under **Administration**). On a Licence-based deployment, the page shows:

- **Licensed to** with the customer name from the Licence, and **Licence ends** followed by the date, for example **Licence ends 3 March 2027**.
- Under **Usage**, the numeric limits such as **Seats** and **AI Analysts**.
- Under **Message usage by user**, the **Messages** meter.
- Under **Features**, each feature as **Included** or **Not included**.

<!-- screenshot: self-managed-licence-usage-card -->

## Troubleshooting

**The server won't start and the log starts with `LICENCE_PATH`.**
The Licence is missing, unreadable, malformed or not signed by Actian. Check that the file is at the expected path (`licence/licence.json` with Compose, or the `licence.json` key in the Secret with Helm), and that nobody edited its values. If the file is intact, ask Actian for a fresh copy.

**I replaced the Licence but Settings still shows the old end date.**
The server reads the Licence only at start. Restart the server.

**Members can't add a connection of a certain type.**
Your Licence, the deployment's connector allowlist, or a missing JDBC bridge may restrict that connector. Check `CONNECTORS_ENABLED` and the JDBC bridge settings in [Warehouse connectivity](warehouse-connectivity.md). If neither explains it, ask Actian whether your Licence restricts that connector.