The commercial server (bichon-pro-server) is a separate binary from the open-source Community build and shares its core. It runs a 30-day Pro trial when no license is present, then continues with the Community feature set; a valid license selects Pro or Enterprise. This page covers the trial, how to obtain and install a license, and what each non-valid state means.
The Community edition never checks a license.
The trial
- 30 days, starting automatically the first time the Pro binary starts without a license.
- Runs the Pro feature set with a 2-account limit. The Enterprise compliance suite is not included in a trial.
- The account limit counts every account type — IMAP,
NoSync, and View — not only IMAP sync accounts. - The trial clock is persisted in
license-state.jsonin the data root. Deleting onlylicense.txtdoes not start a new trial; the ledger remembers that a trial started and whether a license was ever installed. Deleting the ledger (or the entire data root) does reset the trial, but it also destroys the archive. - A wall clock moved backwards cannot add trial days: the stored start and last-seen timestamps are monotonic.
When the trial ends, the server keeps running with the Community feature set. The archive stays readable and IMAP sync continues, but Pro-only surfaces (audit log, integrity checks, PDF/Word search, analytics, built-in IMAP server, journaling, View accounts, branding, MCP) stop. Account creation is disabled until a valid license is installed.
Obtaining and installing a license
Licenses are Ed25519-signed certificates bound to the deployment's machine ID, which is derived from the instance-id file in the data root.
- Copy the machine ID from Settings → License in the WebUI, or call
GET /api/v1/license/machine-id. - Send it to rustmailer.com with the edition and account count you need.
- Upload the issued license in Settings → License, or
POST /api/v1/license/uploadwith{"license": "<the signed license text>"}. Uploading requiressystem:root.
An uploaded license is validated and applied immediately, without a restart. The same text is written to license.txt in the data root, so it survives a restart and can be replaced offline during disaster recovery.
Files in the data root
| File | Purpose |
|---|---|
license.txt | The canonical license. Startup preflight reads it before touching any data. Replace it offline to recover; the change takes effect on restart. |
instance-id | The identifier the license is bound to. Created on first start. |
license-state.json | Trial start, last evaluation, and the irreversible "a license was installed here" flag. Do not edit or delete it. |
The Pro backup engine includes all three, so restoring a backup onto a replacement machine preserves the instance identity and the restored deployment remains licensed. Restoring only the mail data without instance-id produces a machine mismatch.
Status states
GET /api/v1/license/status returns one of these values. It requires authentication; license upload additionally requires system:root.
| Status | Meaning | Effect |
|---|---|---|
valid | A valid license is loaded | Pro or Enterprise feature set, subject to edt |
trial | Within the 30-day trial | Pro feature set, 2-account limit |
trial_expired | Trial elapsed with no license | Community feature set; account creation disabled |
update_expired | Build date is newer than the license's update coverage (upd) | Startup refuses: 503 maintenance page until a renewed license is installed or the previous release is restored |
machine_mismatch | License was issued for another machine ID | Startup refuses: 503 maintenance page |
invalid_signature | Signature verification failed | Startup refuses: 503 maintenance page |
invalid_issuer | License was issued for a different product | Startup refuses: 503 maintenance page |
revoked | The license ID (jti) is on the revocation list | Startup refuses: 503 maintenance page |
license_removed | This deployment had a license, but license.txt is gone | Startup refuses: 503 maintenance page. Removing the file never reopens the trial. |
machine_id_unavailable | instance-id cannot be read or created | Startup refuses: 503 maintenance page |
A deployment with no license file that has never had one simply runs as a trial; a deployment that has had a license and lost it does not.
Account limits
| State | Limit |
|---|---|
| Trial | 2 accounts (all types) |
| Pro | 5 accounts by default |
| Enterprise | 100 accounts by default |
| Any | A lower alc claim in the license overrides the edition default |
Two enforcement rules matter in practice:
- Creation is refused once the count reaches the limit. The error names the limit and reminds you that local and View accounts count.
- Restoring a larger data set than the license allows suspends syncing rather than deleting anything. Reads remain available; syncing resumes once accounts are removed or a larger license is installed.
Updates and renewals
- A license is perpetual for the release you purchase. The first 12 months include new releases.
- From year two, an annual update subscription is required to run builds released after the
upddate. The release you already have keeps working; a newer build that exceeds your coverage stops at the maintenance page. - Growing the license later is an upgrade: you pay the difference, and the 12-month update window restarts from the upgrade date.
Note: During early access, update and renewal terms are confirmed with each customer before purchase. See Editions for the feature matrix.
API
| Method | Path | Description |
|---|---|---|
GET | /api/v1/license/status | Current status, masked licensee, edition, account limit and usage, machine ID |
GET | /api/v1/license/machine-id | This deployment's machine ID |
POST | /api/v1/license/upload | Install a license (system:root) |
GET | /api/v1/features | The active edition and feature flags at runtime |