Self-hosted

The five capabilities that need a key

Version 1 — last updated September 4, 2026

This list is written into the licence itself, in the Additional Use Grant of the LICENSE file, so its scope is fixed by the version you downloaded and cannot be changed under you afterwards. Everything else in Notifuse runs without a key.

1. 1.More than three workspaces

   Creating a fourth workspace on one deployment. Nothing is done to the workspaces you already have — an installation holding eight keeps all eight and simply cannot create a ninth.

   Refused at: Creating a workspace

2. 2.Granular permissions

   Writing a permission set that is not full access: setting a member's permissions, inviting a member with a restricted set, or creating an API key with a restricted scope. Permissions already granted stay enforced in every licence state — the authorization engine never consults the licence — and removing a member is always allowed, because that is what revokes a leaked API key.

   Refused at: Saving permissions, inviting with a restricted set, creating a scoped API key

3. 3.Amazon SES tenant isolation

   Provisioning a new SES tenant. A tenant provisioned earlier keeps sending through its own reputation forever after: the send path contains no licence check of any kind.

   Refused at: Enabling tenant isolation on an SES integration

4. 4.Template translations

   Adding a language to a template, or editing the content of one already there. Translations already saved keep being sent in every licence state, editing the rest of a template that carries them is never refused, and removing one is always allowed.

   Refused at: Saving a template that adds or changes a translation

5. 5.Single sign-on (OpenID Connect)

   Signing in through SSO. Without a licence that covers it the SSO button is not offered, and everyone signs in with a login code instead — nobody is locked out, and sessions already open are unaffected.

   Refused at: The sign-in page stops offering the SSO button

Install a key under Settings › Licence as the root user, or set NOTIFUSE_LICENSE_KEY. Verification is offline against a signature compiled into the binary: no phone-home, no account, nothing about your installation leaves it.

What a licence never covers

A list of what you must pay for is a price list. This is a commitment, and it is only a commitment because it is dated, versioned, and hard to walk back. Every line below can be checked against a running instance in ten minutes.

Nothing that is free in v40 will ever be moved out of this list. Any change to it carries 90 days' notice, with the previous version left visible — and the version and date above are how you hold us to that.

• ✓ No per-email fee, ever. No sending cap, no throughput tier, no volume meter.
• ✓ No contact meter: unlimited stored contacts, active contacts, timeline events, custom events and pageviews, with no retention expiry when you self-host.
• ✓ Unlimited team members, invitations and user accounts. No seat cap, in any build, at any size.
• ✓ Permissions already granted stay enforced in every licence state, and removing a member is always allowed.
• ✓ Three workspaces on every installation, each with its own isolated PostgreSQL database. The isolation architecture itself is never licensed — only the count beyond three.
• ✓ Login-code sign-in always works, on every installation, licensed or not, and no session in progress is ever ended.
• ✓ Full read and export of your data, at any time. The application never blocks a read, never deletes a row, and never stops a transactional email or a broadcast in flight.
• ✓ Every release becomes AGPL-3.0-or-later four years after it ships, on a clock that runs per version.