Licensing

Cipher is licensed on request, to companies we have spoken with, for the applications they name. The terms are agreed per deployment on four axes — servers, cores, seats and environments — and this page is about how the model behaves once you have a license, not about prices.

There is no public download and no self-service plan. Cipher makes source code unreadable on the server that runs it, so we want to know who is running it: the conversation starts with what you deploy, where, and to whom. Write to us.

The four axes

Axis	What it is
Servers	An engine instance on your infrastructure — cloud, bare metal, or air-gapped. Each holds a license bound to its own address.
Cores	CPU cores the runtime may use, as a pool across the fleet.
Developer seats	A named account in Cipher with its own permissions, login rules and audit trail.
Environments	Development, UAT, Live — each isolated, each with its own servers and push rules.

Each axis is agreed independently, so a deployment with three servers, one environment and two seats is licensed as exactly that. Capacity is changed by agreement, not by a purchase in the app.

A license is a security instrument first

Registering a server issues a key bound to that machine’s public IP address. The Engine presents it on every boot; the control plane checks it against the account and the source address. Every encrypted payload delivered to the server is keyed to that license, which is why a build for one server is not usable on another — and why removing the license leaves a machine that can no longer decrypt anything.

The license is also the root of trust for Enclave: the backup that lets a sealed server be unsealed is held under a license-derived key. See Servers and licenses.

Cores float across the fleet

This is the part worth understanding, because it is not how most per-core licensing works.

Licensed cores are not bound to any single machine. They are a pool. The runtime assigns them across active workloads, and you decide the split per server when you register or edit one.

Add a server today, move cores to it tomorrow, spin up a new environment next week. Only the axis that actually changed needs a word with us — there is no plan to renegotiate and no re-provisioning.

Where your encrypted code lives

With engine-only storage the AES-256-GCM encrypted build lives on each LockFlare Engine server — the machines you install the engine on — and LockFlare retains no copy.

With Cipher repositories a build is also held centrally, encrypted identically, so it can be promoted to any environment without being pushed again and a lost server can be rebuilt from the stored copy. Only the location differs. See Where the build is stored.

Watching your usage

Cipher’s Licensing screen shows all four axes as live gauges — servers, cores, environments and seats — against what your license allows. A gauge turns red at the ceiling, so you can see you are about to run out before an action fails.

Capacity is not added inside the app. Manage licenses on that screen hands off to your LockFlare account, and an agreed change appears the next time Cipher loads.

At the seat ceiling, Add user in Team management offers the same hand-off — and points out that removing a member frees a seat immediately, which is often the faster answer.

Arrangements

Beyond the four axes, agreements cover unlimited servers and cores, dedicated infrastructure, custom service levels, air-gapped and government deployments, and priority support.

Self-hosted artifact storage — which removes LockFlare from artifact custody entirely — is available on request, and is the recommended configuration for regulated workloads.

Where the build is stored Server requirements