Activating Your On-Prem License (Online & Air-Gapped)

AI Insights 365 On-Prem Edition runs entirely inside your own infrastructure, which means licensing is handled the same way: locally, with no dependency on an outbound connection at runtime. Activation is performed once using a cryptographically signed license file, and the platform validates that file on your own Windows servers. This guide walks through how to obtain a license, what the signed file encodes, how to activate it both online and in fully air-gapped environments, how to renew it without downtime, and how to diagnose the most common activation errors.

The model is intentionally simple. There is no phone-home requirement, no metering service calling out to a vendor endpoint, and no risk of your analytics platform going dark because an external license server was unreachable. Everything you need to validate entitlement lives in the file you receive and the public verification logic shipped with the product.

How Licensing Works at a High Level

Your license is a signed token that the platform verifies locally. When you request a license, the AI Insights 365 sales process generates a file that is signed with an HMAC-SHA256 signature and encoded as base64url. The product holds the verification key needed to confirm that the signature is authentic and that the contents have not been altered.

Because the signature covers the entire payload, a license cannot be edited, extended, or reused for more seats than were purchased. Any tampering — even a single character change to the seat count or expiry date — invalidates the signature, and the platform rejects the file.

This design gives you three properties that matter in regulated and security-conscious environments:

• Offline-first. Activation never requires the server to reach the internet.
• Tamper-evident. The signature guarantees integrity of seat count, expiry, and edition.
• Self-contained. Entitlement travels with the file, so backups and DR copies carry their own proof of license.

What a Signed License Encodes

A license file is a compact, signed record. While the exact serialized layout is an implementation detail, every license encodes the following entitlement data:

When the platform loads a license, it first verifies the signature, then reads these fields to enforce seat limits and term boundaries. Because the values are signed, the displayed seat count and expiry in System Settings always reflect exactly what was purchased.

Obtaining a License

Licenses are issued through the standard request-and-quote flow:

1. Submit a license request from the AI Insights 365 site (or through your account contact), specifying the number of users and the term you want (1, 2, or 3 years).
2. Sales generates a payment link; pricing scales by number of users multiplied by term length.
3. Once payment is confirmed, you receive your signed license file (base64url text).
4. You apply that file to your server using either the setup wizard or System Settings.

Keep the license file in a secure location alongside your other deployment secrets. It is not sensitive in the sense that it grants no access by itself, but it is the proof of entitlement you will reuse during disaster recovery, server migration, and renewal.

Checking Setup and Activation Status

Before and after activation, you can confirm the platform's state through the health endpoint. The /health endpoint reports setup status, which is useful for smoke tests, load-balancer probes, and automated post-deployment checks.

GET /health

A typical response indicates whether the application has completed setup and whether a valid license is currently loaded. Use this endpoint in your deployment pipeline to confirm that a freshly provisioned node has come up with a valid license before you route traffic to it.

Online Activation

If your server can reach the internet (or your internal network path to the activation step is available), online activation is the fastest route. It is typically performed the first time you stand up the environment, inside the setup wizard.

1. Launch the setup wizard on a fresh installation.
2. Proceed to the License step.
3. Provide your signed license file when prompted.
4. The platform verifies the signature, reads the seat count, expiry, and edition, and activates the environment.
5. Confirm success on the wizard summary and, optionally, by calling /health.

Online activation does not change what the license contains or how it is verified — the verification is still local. The "online" path simply streamlines retrieval and entry. There is no runtime callback after activation completes.

Offline / Air-Gapped Activation

Air-gapped activation is a first-class scenario, not a workaround. If your AI Insights 365 servers sit on an isolated network with no outbound connectivity, you activate by pasting the signed license file directly. No phone-home is required at any point.

The steps are:

1. On any workstation, obtain your signed license file from the license request fulfillment (the base64url text).
2. Transfer the file into the air-gapped environment using your approved media-transfer process.
3. In the setup wizard's License step (or later in System Settings), paste the signed license text into the activation field.
4. The platform verifies the HMAC-SHA256 signature locally and reads the encoded seat count, expiry, and edition.
5. Activation completes entirely offline.

Because verification is local, the experience is identical to online activation from the point the file is pasted forward. This is the recommended path for classified, regulated, or otherwise isolated deployments where an analytics platform must never initiate an outbound connection.

# Air-gapped activation, conceptually:
signed_license (base64url)  ->  paste into wizard/System Settings
                            ->  local HMAC-SHA256 verification
                            ->  read seats + expiry + edition
                            ->  active, no network call

Updating or Renewing a License Without a Restart

Licenses are managed live. You do not need to redeploy, recycle the application pool, or restart the server to apply a new or renewed license. This is handled in System Settings, which supports live edit of the license.

To update or renew:

1. Complete your renewal request with sales to obtain a new signed license file (for example, a longer term or a higher seat count).
2. Open System Settings in the running application.
3. Locate the License section.
4. Paste the new signed license file.
5. Save. The platform verifies the new file and swaps the active entitlement in place.

Because the change takes effect without a restart, you can renew ahead of expiry during normal business hours with no maintenance window and no interruption to scheduled reports, dashboards, or active sessions. Apply the renewed license before the current term ends to avoid any expiry handling at all.

Seat-Count Enforcement Behavior

The seat count in the license is the ceiling on named users. Enforcement is based on the number of provisioned user accounts measured against the licensed seat count.

• While you are below the seat limit, you can add users normally across your workspaces.
• When you reach the seat limit, adding another named user is blocked until you either remove an existing user or apply a license with a higher seat count.
• Increasing seats is a license change: request additional seats, receive a new signed file, and apply it live in System Settings. The new ceiling takes effect immediately.

Because seats are signed into the license, the enforced limit always matches what was purchased; it cannot drift from edits to local configuration.

What Happens at Expiry

The expiry date is part of the signed payload and marks the end of your licensed term. The intended operating practice is to renew before expiry — since renewal is a live, no-restart operation, there is no reason to let a term lapse.

If a term does reach its expiry date without a renewal applied, the environment is no longer covered by a valid term. The correct remediation is always the same: obtain a renewed signed license from sales and paste it into System Settings. Once the new file is verified, the environment is current again. Keep your renewal file staged ahead of the expiry date so the transition is a single paste-and-save.

Troubleshooting Common Activation Errors

Most activation problems fall into a small number of categories. Work through them in order.

"Invalid signature" or "license verification failed"

The signature did not validate against the payload. Common causes:

• The license text was truncated, wrapped, or had whitespace introduced during copy/paste or media transfer. Re-copy the full base64url string and paste it again without modification.
• The file was edited. Any change to seat count, expiry, or edition breaks the signature. Use the original file exactly as issued.
• The wrong file was used (for example, a license issued for a different environment or edition). Confirm you are applying the file that matches your purchase.

"Seat limit reached"

You have provisioned as many named users as the license permits. Either remove unused user accounts or request additional seats and apply the new signed license in System Settings.

"License expired"

The term end date has passed. Request a renewal, then paste the renewed signed file into System Settings. The change applies live.

Activation step won't complete in the wizard

• Confirm you are pasting the complete signed license text into the correct field.
• Verify the application is healthy by calling /health and checking reported setup status.
• For air-gapped systems, confirm the transferred file is byte-for-byte identical to the issued file — transfer tooling sometimes alters line endings or encoding.

Renewed license not reflected after save

• Re-open System Settings and confirm the displayed expiry and seat count match the new file.
• Because updates are live, no restart is needed; if values look stale, re-paste and save again, ensuring the full string was captured.

Planning for Disaster Recovery and Migration

Your signed license file is a portable artifact, and that portability is deliberate. Because verification happens locally against the embedded signature, the same file activates the platform on a rebuilt host, a standby server, or a migrated environment without any new issuance step. Treat the file as part of your disaster-recovery kit rather than something tied to one machine.

A few practices keep this friction-free:

• Store the original. Keep the issued signed license text in your secrets manager or DR vault alongside other recovery material. If you only ever pasted it into the wizard, export or re-request it so a copy exists outside the running deployment.
• Document the entitlement. Record the seat count, edition, and expiry that the license encodes, so an operator restoring service at 3 a.m. can confirm the recovered deployment matches the contracted entitlement without guesswork.
• Rehearse the paste. During DR drills, include a step that re-applies the license to the recovered instance and confirms the seat and expiry values via System Settings and /health. This proves the file and your process both work before a real incident.
• Mind the clock. Seat and expiry enforcement depend on the host system clock. On air-gapped servers without internet time sync, make sure the clock is set correctly from a trusted internal source — a badly skewed clock can make a valid license look expired or not-yet-valid.

When you migrate to new hardware, bring the license file with the rest of your configuration and backups. There is no deactivation handshake to perform on the old host and no re-registration on the new one: the new deployment verifies the signature locally and begins enforcing the same entitlement immediately.

Quick Reference

• Activate online: setup wizard → License step → provide signed file → verified locally.
• Activate air-gapped: transfer file in → paste signed text in wizard or System Settings → verified locally, no phone-home.
• Renew / add seats: request new signed file → System Settings → paste → save → live, no restart.
• Confirm status: call /health for setup and license status.
• Keep: your original signed license file, stored securely for DR, migration, and renewal.

Activation in AI Insights 365 On-Prem is designed to be undramatic: a signed file, a local verification, and a live update path that never forces a maintenance window. Whether your servers are connected or fully isolated, the same signed license carries everything the platform needs to enforce your entitlement on your own terms.