How a self-hosted product still ships signed updates, protects its core, and detects a cloned VPS — without ever phoning your data home.
Self-hosting and licensing sound like opposites: if the whole thing runs on the customer's box, what stops it from being copied? Our answer is cryptographic, not surveillance-based. We never see your leads.
Your license is a cryptographically signed token bound to the machine's hardware id. The core verifies the signature locally; feature flags are server-signed so we can enable or disable capabilities without shipping a new build.
The instance sends a small periodic heartbeat — license id, hardware id, public IP, timestamp. No lead data, ever. It tolerates being offline with a grace window so a network blip never takes you read-only mid-shift.
Snapshot-clone a licensed box and the same install shows up running from more than one place at once — a pattern a legitimate migration never produces. When it appears, the license is suspended and you get an alert; a real move is handled by a one-click rebind.
The business logic ships as a compiled native core — binaries, not readable Python. Combined with runtime integrity verification, casual reverse-engineering isn't on the table.