CertifiEd

Cryptographic licensing for on-prem software. Every license is a token signed with Ed25519. Impossible to forge, verifiable even offline.

Request a demo
Documentation
Ed25519Self-hostedMultitenantOffline 30 daysHW fingerprintKey rotationWebhooksAudit log

Proof

Ed25519

The elliptic curve that signs every single license

30

Days of autonomous work with no license server in sight

100%

Self-hosted: deploys entirely inside your perimeter

∞

Depth of the client-company and sub-dealer hierarchy

Features/01

Protocol specification

0x01

eyJhbGciOiJFZERTQSJ9.eyJmZWF0IjpbImFwaSJdLCJleHAiOjE3OTg3NjE2MDB9.4kX9vQ2mR8pLnJ3tYwB6hZ

SIGNATURE VALID

Tamper-proof licenses

The whole config — features, limits, expiry — lives inside a signed token. Change a single byte and the signature falls apart.

0x02

Multitenant company tree

A hierarchy of any depth: dealers, branches, clients. A role granted to a node is inherited by its entire subtree.

0x03

day 30/30

Offline mode

The license is verified locally against the public key — up to 30 days without a server.

0x04
POST /billing

Webhooks

Activation, expiry, revocation — events land in your billing or CRM instantly.

0x05

10:41:07 issue LIC-83A2 → dealer/east

10:41:52 activate fp 9F3A-C41D

10:43:10 webhook delivered · 200

10:44:00 rotate key #17 → #18

10:45:31 revoke LIC-5D11

10:46:02 login admin@hq

Full audit trail

Every issue, revocation and admin login goes into an immutable log.

0x06

Key rotation

Swap key pairs with zero downtime: existing licenses keep verifying.

How it works/02

The assembly line of a living license

Keep scrolling — the conveyor takes a license from blueprint to running product.

Step 1 · Template

Describe your product once

Features, limits, validity, update channels — all in the license template. It becomes the blueprint of every key you issue.

template: enterprise-annual.yaml

{

"product": "ERP-X",

"features": ["reports", "api", "sso"],

"seats": 500,

"expires": "2027-01-01",

"channels": ["stable"]

}

Step 2 · Ed25519 signature

The server seals the token

The config is signed with an Ed25519 private key. One changed byte and the signature no longer matches: forgery is mathematically ruled out.

sig = Ed25519.Sign(payload)

sig = 4kX9vQ2mR8pLnJ3tYwB6hZ

Step 3 · Activation

Bound to the hardware

The SDK computes the machine's hardware fingerprint and activates the key. The license only works where it was issued.

fp: 9F3A-C41D-88E2-07B6

activated

fp 9F3A-C41D-88E2-07B6

Step 4 · Heartbeat

A pulse that doesn't choke

The app periodically checks in with the server. Connection lost? The license lives autonomously for up to 30 days, then degrades gracefully.

POST /heartbeat → 200 alive

grace30 days

SDK/03

A live terminal

One NuGet package: the client activates the key, caches the signed token and verifies it locally — with the Ed25519 public key, no server round-trips.

using CertifiEd.Client;
// Connect to your license servervar client = new CertifiEdClient(new CertifiEdOptions{    ServerUrl  = "https://licenses.company.tj",    PublicKey  = Ed25519.PublicKey("MCowBQYDK2VwAyEA…"),    OfflineTtl = TimeSpan.FromDays(30)});
// Activation bound to the hardwarevar license = await client.ActivateAsync(    key: "CFED-7K2M-9XQ4-TR8B-ED25",    fingerprint: HardwareId.Compute());
// Feature flags straight from the signed tokenif (license.HasFeature("reports.export")){    ExportModule.Enable(license.Limit("reports.rows"));}
Your applicationflags arrive from the license
  • reports.export✓
  • api.access✓
  • sso✓
  • billing.premiumnot in license

License key

CFED-7K2M-9XQ4-TR8B-ED25

Ed25519 signature verified

  • Feature flags and limits are read from the token itself
  • Offline verification: no server needed for up to 30 days
  • REST API for every other stack — Java, Go, Python

Security/04

Paranoia as an architectural principle

Private keys sleep in an AES-256-GCM vault

CertifiEd is designed for perimeters the internet never enters: banks, industry, government. The only thing that leaves your network is — nothing.

0outbound connections beyond your perimeter

  • AES-256-GCM for private keys

    Signing keys are stored encrypted only, and decrypted in memory for the duration of an operation.

  • Zero-downtime rotation

    Rotate key pairs on schedule or on alarm. Issued licenses keep verifying against the old public key.

  • Full audit

    An immutable log of every action: issue, activation, revocation, admin login. SIEM export included.

  • Nothing goes to the cloud

    No telemetry, no phoning home. The platform lives entirely in your infrastructure — air-gap included.

Ready to start

Sign your product. Mathematics does the rest

We'll walk the platform through your scenario: client hierarchy, offline mode, key rotation. Half an hour and you'll know if CertifiEd fits.

Request a demo
info@ofarandagon.tj

Already a customer? Sign in to the portal