Licensing, seats & transfers

A HostSSH license is a single signed token that lives on each server's agent. It unlocks the privileged operations — capture, restore, clone, migrate, transfer, provision — and tells the agent which features your tier allows. The token is offline-verifiable: the agent checks it against a built-in public key with no network call, so a brief loss of connectivity never stops a backup or a recovery. Only HostSSH can mint a token, so a copied license still gets caught.

This page covers the tiers, activating a key, binding and moving servers across seats, the offline grace window, and exactly what happens when a license expires or is revoked. To put a key on a new box, see Install on any VPS.

Tiers at a glance

Every tier captures and restores. Tiers gate how many servers you can run, which transfer modes you get, whether you can provision new VPSs from the panel, team seats, and — at MSP and above — white-label.

Capability	Solo	Team	Business	MSP	Enterprise
Capture + local restore	✓	✓	✓	✓	✓
Mode 1 — Offline / Download	✓	✓	✓	✓	✓
Mode 2 — Peer transfer (transfer key)	✓	✓	✓	✓	✓
Mode 3 — Managed migration	limited	✓	✓	✓	✓
Web-SSH + access (CF Tunnel / Tailscale)	✓	✓	✓	✓	✓
One storage backend (BYO)	✓	✓	✓	✓	✓
Multiple storage targets	—	—	✓	✓	✓
Notifications + monitoring	✓	✓	✓	✓	✓
Git (config-as-code)	✓	✓	✓	✓	✓
DNS automation + provisioning (resold VPS)	—	—	✓	✓	✓
Multi-tenant control plane	—	—	—	✓	✓
White-label + reseller billing	—	—	—	✓	✓
Servers (seats)	1–3	up to 10	up to 25	50+	custom
Team seats (operators)	1	small team	team	per-org	custom / SSO

The three transfer modes are described in full in Backups & recovery:

• Mode 1 — Offline / Download. Build a .hsi, download it, restore it anywhere. Available on every tier; no second online server required.
• Mode 2 — Peer transfer (transfer key). Generate a one-time, scope-locked transfer key on the source and pull the image straight onto a target. Both agents online. Available on every tier.
• Mode 3 — Managed migration. Panel-driven full provision + restore + IP rewrite + DNS flip + verification. Solo can run an occasional managed migration (limited); Team and up get it unmetered.

Provisioning — letting HostSSH spin up a fresh VPS for you (or DNS-cutover on a migration) — starts at Business. Below that you bring your own target VPS and your own DNS, which every tier can do.

White-label (presenting HostSSH and every resource it provisions under your own brand, with the upstream provider hidden) and reseller billing are the MSP headline and carry through to Enterprise. See White-label for the full multi-tenant model.

Storage providers are never gated by tier — all eight backends (R2, S3, S3-compatible, MinIO, B2, Wasabi, SFTP, local) work on every plan. What scales with tier is the count of storage targets, not the choice. See Connections (BYOK).

What a license actually contains

Your key resolves to a signed token whose claims the agent reads on every privileged action:

Claim	Meaning
plan	Your tier (solo / team / business / msp / enterprise)
seats	How many servers the license may bind at once
features[]	Which transfer modes, provisioning, and white-label are enabled
expires_at	When the token must be renewed
server_binding[]	Fingerprints of the servers currently holding a seat

Because the token is signed with HostSSH's private key and verified against the public key baked into the agent, you can confirm a license is valid with no network access — but you can never forge or extend one yourself.

Activate a key

The one-line installer prompts for your key and activates it for you — that flow is documented in Install on any VPS. On a server that already has the agent, activate (or re-activate) directly:

hostssh license activate HSSH-XXXX-XXXX-XXXX

Activation does three things:

1. Computes a machine fingerprint for this server (machine-id + primary NIC
   • an install salt, hashed — no hardware serials leave the box).
2. Calls the control plane to bind a seat to that fingerprint and receive a signed token.
3. Writes the token under /etc/hostssh and starts honoring your tier's features immediately.

Check what you've got at any time:

hostssh license            # plan, seats used/total, expiry, features, last heartbeat
hostssh status             # health + license summary in one view

Activating with no internet

For an air-gapped or firewalled install, run the offline activation flow: the control plane issues a long-lived signed token you paste straight into the agent. No heartbeat is required for that server — it's a deliberate offline SKU, not a workaround. Ask support for an offline license if you need one.

Seats: binding and unbinding servers

A seat is one server's claim on your license. Activating binds a seat; freeing a server returns the seat to your pool.

hostssh license bind                 # bind this server (implicit on activate)
hostssh license unbind               # release this server's seat back to the pool

You can also manage seats centrally from the License section of the control-plane dashboard: see every bound server, its plan, expiry, last heartbeat, and bind, unbind, or transfer seats without touching the box. When you've used every seat, the dashboard offers a one-click raise seat count (an upsell, not a support ticket); the new ceiling applies on the next heartbeat.

Unbinding is the right move when you're decommissioning a server for good. To move a running server to new hardware, don't unbind — use a transfer, which keeps your data and the seat together.

Move a license to a new server

Relocating a server is the whole point of HostSSH, so moving its license is designed to be friction-free. There are two paths, depending on whether you're also moving the data.

Relocate (transfer the seat with the migration)

When you migrate or relocate a server to fresh hardware, HostSSH transfers the seat automatically as part of the move — the old fingerprint is released and the new one is bound in the same step, so you never run a seat short mid-cutover.

hostssh migrate --new-ip             # relocate to a fresh VPS; seat follows automatically

This is the recommended path for a provider switch or a VPS-renewal migration: the data, the IP rewrite, and the license all land on the new box together. The full migration flow lives in Backups & recovery.

Manual rebind (move the seat without a full migration)

If you want to free a seat from one server and claim it on another by hand — say you're rebuilding a box from a downloaded image (Mode 1) — release the seat on the old server and activate on the new one:

# on the old server
hostssh license unbind

# on the new server
hostssh license activate HSSH-XXXX-XXXX-XXXX

You can also release a seat from the dashboard if the old server is already gone and can't run the command itself.

Heartbeats

Once a day (configurable), each agent sends a small heartbeat to the control plane over mTLS. The heartbeat is how HostSSH keeps your license honest in both directions:

• It confirms the license is active, not revoked, and within seat count, and returns a fresh short-TTL token so your servers always hold a current one.
• It re-anchors time, so rolling a server's clock backward to dodge an expiry doesn't work (large skew is flagged).
• It catches over-deployment — fanning one key across more servers than you have seats shows up here.

Heartbeats carry license state and telemetry only — never your data and, in zero-knowledge custody, never your encryption key. The dashboard shows each server's last heartbeat so you can spot a box that's gone quiet.

The offline grace window

Heartbeats are not a leash. If a server can't reach the control plane — a network blip, a maintenance window, a temporarily firewalled box — its last valid token keeps working through a bounded grace window, 14 days by default. Inside grace, every privileged action runs normally; the agent simply keeps trying to heartbeat in the background and re-anchors the moment it gets through.

The grace window is what makes the license fair to honest operators while still expiring a permanently disconnected pirate:

• A real server that loses connectivity for a few days never stops backing up or restoring.
• A copy that can never heartbeat eventually runs past grace and loses its privileged actions.
• A genuinely air-gapped server should use the offline license SKU above rather than living in perpetual grace.

If you watch a server approach the end of its grace window in the dashboard, the fix is simply to restore its connectivity long enough for one heartbeat.

Expiry, grace, and revocation

HostSSH makes one promise above all: we will never hold your data hostage. Emergency restore of an existing image always works — even on an expired or revoked license, even with storage retention or quota exhausted. It runs through a dedicated read-only path that can't be gated. What billing can pause is creating new state — new captures and new migrations — not getting your existing data back.

State	Capture / new migration	Restore an existing image	How it's triggered
Active	✓	✓	Normal operation
In grace (offline)	✓	✓	No heartbeat yet still inside the window
Past grace (offline too long)	—	✓	Grace window elapsed with no heartbeat
Expired	—	✓	expires_at passed; renew to restore full function
Revoked	—	✓	Caught at the next heartbeat (offline grace still applies)

A few specifics:

• Expired. The license goes read-only: you can still restore an existing image in an emergency, but capture and new migrations are blocked until you renew. Renewing re-issues a current token on the next heartbeat and everything resumes — your bound seats and images are untouched.
• Revoked / suspended. A revoke (for a refund, a billing failure, or abuse) takes effect at the next heartbeat; the offline grace window still applies, so a revoke is not instantaneous on a disconnected box. Emergency restore remains available regardless — the data-hostage promise holds through revocation too.
• Renewal and dunning. Failed billing triggers dunning in the dashboard before anything is suspended; you'll see the warning well ahead of any read-only transition.

Quick reference

Task	Command
Activate / re-activate a key	hostssh license activate HSSH-XXXX-XXXX-XXXX
See plan, seats, expiry, heartbeat	hostssh license
Bind this server (implicit on activate)	hostssh license bind
Release this server's seat	hostssh license unbind
Move a running server (seat follows)	hostssh migrate --new-ip
Health + license in one view	hostssh status

Seats, revocation, audit history, and per-server heartbeat status are also driven from the dashboard's License section — see Control-plane dashboard. For the underlying token, heartbeat, and enforcement design, the internal reference is Licensing & enforcement; the security guarantees behind the data-hostage promise are in Security.