Nothing we make ever phones home.

People sometimes read the activation step as friction. It is the opposite: it is what a licence has to look like when the software refuses to call home.

A conventional product checks a licence server. That check is a phone-home by definition — it tells us you are running, from which address, how often, and against how many machines. So a licence in Lens is not a check, it is an artifact: a short string signed by LockFlare's private key, carrying the account or the server address inside it. Lens opens it with the public half built into the app, verifies the signature on your computer, and reads the address out of it. Nobody is asked. Nothing is reported. It works with your network cable unplugged.

That is also why the key comes from a web page in your browser rather than from inside the app: one deliberate visit, made by you, instead of a permanent channel opened by us. And it is why a server licence names one IP address — that address is the only thing the key needs to carry to be checkable offline, and it is the second of the two things we hold.

The term gets stretched, so here is our version in one sentence: the only thing we keep about a server is the IP address on its licence, and the only reason we keep it is so that licence can be reissued. Not to profile you, not to count you, not to know anything about the machine — the address is literally written inside the signed key, so it has to exist somewhere for us to be able to put your licence back when you lose it.

We do not know what that server is. Not its hostname. Not its operating system or version. Not whether it runs a database, a website, a mail server or nothing at all. Not its provider, its region, its size, its role, or what you call it. Not whether it is still alive. The licence issuer holds an email address and a list of addresses that were licensed to it, and that is the entire record.

We do not hold your payment details either. Card payments go straight to Stripe; the number is entered on their form, handled by them, and never touches a LockFlare system. We receive a confirmation that a payment cleared, and we issue a key. There is no card on file, because there is no file.

And on the operational side, the list of what we never see is the whole product: your fleet map, your groups and notes, your SSH credentials, private keys and sudo passwords, your certificate vault, repository secrets and API keys, your snippets, boards, templates and NOC diagrams, your database logins, your backup destinations, your team, what your servers run, what versions they are on, how many boxes you really manage, when you last opened the app, or anything you did in it.

None of that is a policy that could be reversed by a change of management or compelled by a subpoena. It is arithmetic: those things live in a file on your computer, sealed under the signature of the key drive that unlocks Lens, and in an encrypted backup on that drive. There is no server of ours they were ever copied to, so there is nothing to hand over, sell, lose, or be asked for.

Absolute privacy has a price and we would rather you hear it from us than discover it on a bad day.

What we can do. Because we hold your email and your licensed addresses, we can put your licences back. Recovery asks for the account email, its password and the IP address of one server you licensed, mails a code to that mailbox, and hands back every licence as one bundle you paste into Lens. Your entitlements are safe with us, because entitlements are all we keep.

What we cannot do. We cannot restore your map, your saved logins, your certificate vault, your snippets or your boards — not because of a policy, but because we have never had a copy. If you lose the drive and every backup of it, that work is gone and no support call can change it.

Which is why Lens ships three ways to protect it, and all three are yours. The encrypted backup written onto the key drive itself, holding the whole map, the vault and the saved credentials, sealed under a passphrase and under the drive. A travel copy, so the same identity works on a second computer. And a duplicate drive, made in a locked ceremony, for the drawer or the other bag. Set up the first two the day you install; the third takes two minutes.

Lens can be air-gapped because it never needs to move anything between machines. Cipher does: its entire job is to get your application onto servers, sometimes servers you do not own. So it applies the same principle at a different layer, and we would rather be exact about the difference than borrow a word that does not fit.

Your source is packed and encrypted with AES-256-GCM on your own machine, before anything leaves it. What travels is ciphertext. What is stored is ciphertext. What arrives on the server is ciphertext, decrypted only into volatile memory and never written to that disk in the clear. The control plane routes builds and keys them to the machines licensed to run them; plaintext is not part of its job at any point in the path.

So: Lens is air-gapped, and Cipher is zero-knowledge by construction. Both come from the same conviction — that the safest thing to do with your data is not to be able to read it.