Docs / Compliance

Licensing

How activation, validation and the grace period work — and what each tier unlocks.

Get a key

Every mlab.sh organisation has a free TPRM license auto-provisioned. Find it under Organization > TPRM on mlab.sh and paste it into LICENSE_KEY in your .env.

Free vs Licensed

Feature	Free	Licensed
ICT third-party providers	5 max	Unlimited
Users	3 max	Unlimited
Dashboard, providers, contracts	Yes	Yes
Risk assessments & third-party incidents	Yes	Yes
Exit strategies, concentration risk	No	Yes
Business functions (B_06.01), supply chains (B_05.02)	No	Yes
Due diligence, audit tracking, Art. 30 checklist	No	Yes
DORA register & advanced analytics	No	Yes
EBA export (15 templates) & validation	No	Yes
xBRL-CSV deposit package (.zip)	No	Yes
REST API	GET only	Full CRUD

See the pricing page for the full comparison.

Validation flow

On boot, app reads LICENSE_KEY and registers the instance with mlab.sh/api/v1/tprm/license/validate.
Once per hour the app performs an HMAC challenge-response with mlab.sh: the server sends a nonce, the instance signs it with the secret derived from the license key.
A successful response refreshes the cached license — tier, limits, expiry — kept locally.
If mlab.sh is unreachable, the cached license is honored for 48 hours.
After 48 hours without contact, the instance is locked: read-only, no new writes. Data is never deleted.
As soon as mlab.sh is reachable again, the lock clears automatically.

License management lives on mlab.sh. Upgrades, downgrades, key rotation and deactivation all happen at mlab.sh/orga/tprm/license. The tprm.mlab.sh instance only reads the current state.

How to upgrade

Sign in at mlab.sh and open Organization > TPRM > License.
Choose the Licensed tier and confirm.
Your running instance picks up the new tier within the hour — no restart, no reinstall. Compliance modules, EBA export and full API CRUD unlock automatically.

What if I hit a free-tier limit?

You get a banner in the UI when you reach 5 providers or 3 users. The platform keeps running for everything already in place — nothing is dropped — but you'll need to upgrade to add more or to unlock the compliance and export modules. Check your current usage under /settings/license.

Network requirements

The instance needs outbound HTTPS to mlab.sh (443) for the hourly license check. That's the only egress required. No telemetry, no usage analytics, no compliance data ever leaves your infrastructure.