License and connectivity

The Aptabit Platform license is issued to your organization and validated in one of two ways: online, through check-ins with Aptabit Manager, or offline, through a file. This page describes what each mode requires and exactly what leaves the installation.

License modes

Aspect	Online	Offline
Validation	Check-in with Aptabit Manager at least every 6 hours.	A license file issued to the installation.
Without a connection	Keeps running for the lease's tolerance: 7 days by default, set per license.	Does not depend on a connection.
Validity	Renewed at each check-in.	Up to 120 days per file, renewable through the same process.
Contact with Aptabit	Check-ins and telemetry, according to the license's level.	None.

Installation identity

Each installation generates an Ed25519 key pair on the machine itself. Aptabit Manager keeps only the public key, and every call from the installation to Aptabit Manager is signed with the private key. The identity lives in <installation>/identity/, mounted read-only into the API container, and is not copied by backups.

What an online license sends

Every check-in sends: the platform version, health status, a machine fingerprint (hashed), the binary's hash, the CPU architecture, integrity flags, a chain token, and the images' provenance statement.

Everything else depends on the telemetry level, set by Aptabit for each license (default standard):

Level	Additional content
`off` and `basic`	No usage data.
`standard`	Aggregate counts: people, organizations, workspaces, agents, flows, integrations, providers, models, documents, stored bytes, tokens, and schedules, plus the totals of positive and negative ratings.
`full`	Also a hardware snapshot (CPU, memory, GPUs, disks, and local inference servers) and an environment snapshot (host name, operating system, kernel, uptime, and container runtime).

No level sends prompts, documents, conversations, files, tables, or embeddings.

The telemetry level is set in Aptabit Manager, per license, and is not changed from the platform's interface. Agree with Aptabit on the level that fits your organization's policy.

CLI failure reports

When a CLI command fails, it tells Aptabit Manager as far as the license's level allows:

Level	What is sent
`off`	Nothing.
`basic`	The failure's code, ID, and title, the command, versions, and operating system.
`standard`	Also the lines that decided the diagnosis and the end of the run log, with secrets removed, and the machine report after `install` and `update`.
`full`	Also the machine report with each failure.

Reports are limited to 30 per hour per license. The diagnostic commands (check, status, doctor, and support-bundle) do not create reports, and an offline installation never sends them.

Other outbound connections

Apart from licensing, the installation connects only to external services the operator triggers or configures:

update checks and CLI self-update;
image downloads: Aptabit's private registry, public base images, and model runtime images;
Hugging Face, for the weights of managed local models;
registered external model providers;
chat web search, when switched on for a message;
OpenTelemetry export to your organization's collector;
the SSO identity provider;
systems registered in Integrations.

The web application loads no third-party CDNs or analytics tools.

Isolated installation

A machine without access to Aptabit Manager installs from copied images and receives its license as a file:

On a connected machine, with the same CLI version, save the images:
Shell
```
aptabit images save -o aptabit-images-<version>.tar
```
Copy the file and the CLI of the same version to the isolated machine and load the images:
Shell
```
aptabit images load aptabit-images-<version>.tar
```
Install in offline mode. The CLI checks that every image is present before writing any file:
Shell
```
aptabit check --offline
aptabit install --offline
```
Create the license request and send the file to Aptabit. It holds no secrets, only the installation's identification, signed by it:
Shell
```
aptabit license request -o request.json
```
Apply the license file issued by Aptabit. The API restarts to load it, and the first sign-in at /setup opens:
Shell
```
aptabit license apply license.lic
```

The platform warns two weeks before the file ends. Renewal repeats steps 4 and 5, and the installation keeps the same seat. license apply refuses files issued to another installation or older than the one installed.

The image bundle holds only the platform stack. Runtime images and weights for local models have to be prepared separately, or the installation can use an OpenAI-compatible inference server available on the local network.

End of the license

An expired or suspended license blocks use of the platform but never removes containers or data: everything stays on the machine. After expiry, there is a grace period of 7 days by default.

Commands

Command	Function
`aptabit license`	Shows the license, the lease, and the installation's standing. With `--json`, for scripts.
`aptabit license request`	Creates the license request for a machine without access to Aptabit Manager.
`aptabit license apply`	Installs the license file issued by Aptabit.
`aptabit license upgrade`	Moves an older, token-based installation to the installation identity, in the same seat.

Commercial model

You pay only for flows published to production. There are no per-user, per-token, storage, or usage charges.