Files
sencho/docs/features/licensing.mdx
T
Anso 519a59ed2e feat(fleet): open Fleet Actions tab to Community (admin-only) (#1153)
* feat(fleet): open Fleet Actions tab to Community (admin-only)

Removes the requirePaid guard from the five Fleet Actions endpoints
(fleet-stop, fleet-prune, match-preview, prune/estimate, bulk-assign)
and drops the matching isPaid parent gate on FleetActionsTab so Community
admins can run fleet-wide bulk operations. requireAdmin stays on every
endpoint; operator and viewer roles still 403 on apply.

Tests flipped from "403 PAID_REQUIRED on community" to positive
"reachable on community + admin" assertions. Docs (fleet-actions,
fleet-view, licensing, overview, stack-labels) rewritten to state the
admin-role requirement once and drop the prior Skipper framing.

* fix(fleet): apply audit findings from PR #1153 review

- stack-labels.mdx: fix the page intro that still framed fleet label
  actions as "Operators on a Skipper or Admiral license". The cards are
  now Community + admin, so the intro reads "Admins also get a pair of
  fleet-wide actions".
- Collapse redundant role-rule statements on the two affected pages.
  fleet-actions.mdx now states the admin gate once in the lead-in Note
  and again only in the troubleshooting accordion (the Prerequisites
  row was duplicative). stack-labels.mdx trims the "Limits and rules"
  bullet to the value-add half (label authoring is open to every role)
  and drops the Fleet Actions repetition.
- Strip now-no-op mockTier('paid') calls from non-tier tests across the
  three fleet test files, plus the test-wide default in the
  fleet-action-card-endpoints beforeEach. Those mocks were misleading
  after the routes stopped consulting tier; if a future change re-adds
  requirePaid the tests will fail loudly instead of silently passing.
2026-05-22 01:27:27 -04:00

180 lines
11 KiB
Plaintext

---
title: Licensing & Billing
description: How Sencho licensing works, including trials, activation, and subscription management.
---
Sencho uses an open-core model. The **Community** tier is free forever with unlimited nodes. Paid tiers unlock advanced features: **Skipper** for solo operators and **Admiral** for teams.
<Tip>
*Our tier names are inspired by the meaning of Sencho (船長), because you're the captain of your container fleet.*
</Tip>
## Plans
| Tier | Annual (per mo, billed yearly) | Monthly | Founder Lifetime | Seats |
|------|--------------------------------|---------|------------------|-------|
| **Community** | Free | Free | Free | 1 admin |
| **Skipper** | $5.75 | $9.99 | $149 | 1 admin + 3 viewers |
| **Admiral** | $20.75 | $39.99 | $499 | Unlimited |
For larger deployments, an **Enterprise** tier is available with custom pricing, including SLA, priority support, security questionnaires, and custom contracts. Contact [licensing@sencho.io](mailto:licensing@sencho.io) or see [the pricing page](https://sencho.io/pricing) for details.
**Founder Lifetime** is an Early Access offer available for a limited time. Once the window closes, only the Monthly and Annual cycles remain.
### Feature breakdown
**Community** includes:
- Unlimited nodes, the Monaco compose editor, the full stack file explorer (browse, view, edit, upload, download, rename, chmod, delete; admin role for writes), and the App Store with 199+ one-click templates
- Real-time container stats, global logs, the interactive network topology graph, and stack labels
- Git sources for compose stacks
- Multi-node management in both Proxy and Pilot Agent modes
- Manual fleet snapshots (create, browse, restore, delete) and Remote OTA node updates (per-node and **Update all**)
- Fleet Actions tab (stop stacks fleet-wide by label, bulk-assign labels to many stacks on a node, prune Docker resources fleet-wide; admin role required)
- Custom S3-compatible backup target (bring your own AWS S3, Cloudflare R2, MinIO, Backblaze B2, or Wasabi bucket)
- Vulnerability scanning: install, update, and uninstall Trivy, on-demand scans for vulnerabilities, secrets, and misconfigurations, plus scan comparison
- CVE suppressions
- Alert rules with Discord, Slack, and webhook targets
- Two-factor authentication (TOTP plus backup codes)
- Custom OIDC single sign-on (works with Authelia, Keycloak, Authentik, Zitadel, Pocket ID, or any spec-compliant OIDC provider)
**Skipper** includes everything in Community, plus:
- Fleet View with search, sort, filter, and node-card drill-down
- Webhooks (incoming, to trigger deploys from CI/CD)
- Notification routing (per-stack and per-category rules to Discord, Slack, or any webhook)
- Atomic deployments with rollback
- Auto-update policies for stack images
- Auto-heal policies
- Scheduled operations across the full action catalog (lifecycle, updates, scans, snapshots, prune)
- Scan policies with `block_on_deploy` deploy enforcement, SBOM (SPDX, CycloneDX), and SARIF export
- Auto-update of the managed Trivy binary
- Bulk actions on a label (deploy, stop, or restart every stack tagged with it)
- Fleet-wide bulk Sencho restart
- Blueprints and Fleet Secrets
- Preset SSO for Google, GitHub, and Okta
- Viewer accounts (1 admin plus 3 viewers)
**Admiral** includes everything in Skipper, plus:
- Unlimited admin and viewer accounts with the full role set (deployer, node-admin, auditor)
- LDAP / Active Directory authentication
- Audit log with CSV export
- Host Console (a browser-based terminal on the Sencho host)
- API tokens for CI/CD scripts
- Private and custom registry credentials
- Sencho Mesh (cross-node container networking)
- Sencho Cloud Backup
## Free trial
Sencho offers a **14-day Admiral trial** so you can evaluate the flagship features (Host Console, Sencho Mesh, LDAP / Active Directory, audit log, unlimited accounts) with your real infrastructure before committing. The trial is offered on the monthly and annual Admiral plans; the Founder Lifetime plan does not include a trial.
To start a trial:
1. Visit the [pricing page](https://sencho.io/pricing).
2. Switch to the **Annual** or **Monthly** billing tab.
3. Click **Start 14-day trial** on the **Admiral** card.
4. Complete the checkout. A valid card is required for verification; you are not charged until the trial ends.
5. Your license key is emailed to you within a few minutes.
6. Activate the key in the Sencho dashboard as described in [Activating your license](#activating-your-license).
When your trial ends, the card you provided is automatically charged and your plan continues as a paid Admiral subscription. To avoid being charged, cancel from the **Manage subscription** button in **Settings → License** (or from your receipt email) any time before day 14.
<Tip>
Fresh installs land on the **Community** tier until you activate a license key. All Community features (unlimited nodes, compose editor, global logs, alerts, Custom OIDC, and more) are available immediately.
</Tip>
## Activating your license
Open **Settings → License** in the Sencho dashboard. When the license is not active, the **Activate** section sits below the Plan card:
<Frame>
<img src="/images/licensing/license-activate-section.png" alt="The Activate section of the License page on a Community-tier instance, with a License key input field and an Activate button on the right" />
</Frame>
1. Paste your key into the **License key** field.
2. Click **Activate**.
Sencho validates the key and unlocks your tier. If activation fails, the toast surfaces the verbatim error; common causes are an invalid key, a typo, or an activation limit reached on a previous instance.
## The Plan section
When a license is active, **Settings → License** opens on the **Plan** section. The page masthead at the top exposes three stat pills, and the section below lists the metadata for the active license.
<Frame>
<img src="/images/licensing/license-admiral-active.png" alt="License page showing an Admiral lifetime plan with the masthead stat strip listing SCOPE, PLAN, and DURATION, then the Plan section with the Customer, Product, and masked License key fields and the Deactivate button" />
</Frame>
The masthead pills are:
| Pill | Meaning |
|------|---------|
| **SCOPE** | Reads `operator` when you are signed in as an admin. |
| **PLAN** | The current tier: `community`, `skipper`, or `admiral`. Trial licenses show the trial tier (typically `admiral`). |
| **DURATION** / **RENEWS** / **TRIAL** / **STATUS** | `DURATION: lifetime` for lifetime licenses, `RENEWS: <date>` for active subscriptions, `TRIAL: Xd left` for trials, and `STATUS: expired` for expired licenses. |
The **Plan** card lists:
- **Tier name** (e.g. `Sencho Admiral`) with a short status line, such as "Active license on this control plane", "Trial: X days remaining", or "Your license has expired."
- **Customer**: the customer name on the purchase.
- **Product**: the purchased product variant (e.g. `Sencho Admiral`).
- **License key**: the last four characters of your key, displayed as `****-****-****-XXXX`. The full key is never re-displayed after activation.
## Managing your subscription
When the license is an active subscription (not lifetime), the Plan section action row exposes **Manage subscription** alongside **Deactivate**. **Manage subscription** opens the billing portal in a new tab, where you can update your payment method, view invoices, cancel, or switch plans.
The same portal is reachable from the profile menu in the top-right corner of the app:
<Frame>
<img src="/images/licensing/profile-menu.png" alt="Profile dropdown popover showing an identity header with the admin role and Admiral tier badges, a navigation strip with Settings, Documentation, and Feedback entries, an Appearance theme picker, and a Log Out button" />
</Frame>
Click your initials in the top-right corner to open the popover. For active subscription licenses, a **Billing** row appears between **Settings** and **Documentation** that opens the same portal as **Manage subscription**. Lifetime licenses have no recurring subscription to manage, so the **Billing** row is hidden.
### Lifetime licenses
Lifetime licenses have no recurring subscription, so the **Manage subscription** button and the profile menu **Billing** row are both hidden, and the masthead shows `DURATION: lifetime` instead of a renewal date. Deactivation, multi-node enforcement, and periodic validation work the same as for subscription licenses.
## License validation
Active licenses are re-validated every **72 hours**. If your instance goes offline, there is a **30-day grace period** before it degrades to the Community tier.
## License states
The License page renders differently depending on the license status:
| Status | Plan section | Activate section | Pricing section |
|--------|--------------|------------------|-----------------|
| **Community** | `Sencho Community` with "Free tier with the core experience." | Visible | Visible |
| **Trial** | `Sencho Admiral (Trial)` with a countdown chip | Visible (so a paid key can replace the trial) | Hidden |
| **Active subscription** | Tier name with Customer, Product, License key, plus `Manage subscription` and `Deactivate` | Hidden | Hidden |
| **Active lifetime** | Tier name with Customer, Product, License key, plus `Deactivate` only | Hidden | Hidden |
| **Expired** | `Sencho Community` with "Your license has expired. Renew to restore paid features." and a destructive **Status: Expired** field | Visible | Visible |
| **Disabled** | `Sencho Community` with "Your license has been disabled. Contact support for assistance." | Visible | Visible |
The **Pricing** section, when visible, holds a single **See pricing** button that opens [the pricing page](https://sencho.io/pricing) in a new tab so you can pick a tier and billing cadence.
<Frame>
<img src="/images/licensing/license-community.png" alt="License page on a Community-tier instance, with the masthead showing SCOPE operator and PLAN community, then the Plan section reading 'Sencho Community · Free tier with the core experience.', the Activate section with the License key input, and the Pricing section with the See pricing button" />
</Frame>
## Multi-node license enforcement
If you manage multiple servers through Sencho's [multi-node feature](/features/multi-node), you only need a license on your **control instance**. All remote nodes automatically inherit the control instance's license tier for proxied requests. No per-node activation is required.
For details on how this works, see [License enforcement across nodes](/features/multi-node#license-enforcement-across-nodes).
## Deactivating a license
To transfer your license to a different instance:
1. Go to **Settings → License**.
2. Click **Deactivate** in the Plan section.
3. On your new instance, paste the same license key into **License key** and click **Activate**.
Deactivation reverts the current instance to the Community tier immediately.
Having trouble with your license? See the [Troubleshooting](/operations/troubleshooting#license-tier-shows-the-wrong-name) page for solutions to common licensing issues.