Licensing

OSO Kafka Backup Enterprise uses Ed25519-signed license files validated entirely offline. No license server, no phone-home, no network dependency. The license file is self-contained and cryptographically verifiable.

License Model

Tier	Target	Features	Pricing
OSS	Individuals, small teams	Core backup/restore, PITR, all storage backends	Free
Standard	Growing teams, single cluster	+ Schema Registry, RBAC backup, encryption	Per cluster/year
Enterprise	Multi-cluster, compliance-driven	+ All features, unlimited clusters	Custom
Trial	Evaluation	All enterprise features, 1 cluster, 14 days	Free

Licensed Features

Each license encodes which features are enabled:

Feature Flag	Description
`schema_registry`	Confluent Schema Registry backup & restore
`rbac`	Confluent RBAC backup & restore (MDS)
`migrations:msk-kraft`	AWS MSK ZooKeeper to KRaft migration execution
`migrations:msk-kraft:plan`	AWS MSK ZooKeeper to KRaft plan/precheck entitlement
`encryption`	Field-level encryption (planned)
`masking`	Data masking for non-production (planned)
`audit`	Audit logging (planned)
`wasm`	WebAssembly plugin system (planned)
`support`	Priority support SLA entitlement

Obtaining a License

Free Trial

The enterprise binary includes a 14-day free trial on first run — no signup, no credit card. Just install the enterprise binary and start using all features immediately.

For an extended 30-day trial, request one at:

Web: enterprise.kafkabackup.com
Email: sales@oso.sh

Purchase a License

Buy a Standard or Enterprise license at enterprise.kafkabackup.com or contact sales directly:

Web: enterprise.kafkabackup.com
Email: sales@oso.sh

Pricing is per Kafka cluster per year. A cluster can grow from 3 to 30 brokers without changing the license cost.

License File Format

Licenses are distributed as PEM-encoded files containing a JSON payload signed with Ed25519:

-----BEGIN KAFKA-BACKUP LICENSE-----
eyJsaWNlbnNlX2lkIjoiYWJjZGVmMTItMzQ1Ni03ODkwLWFiY2QtZWYxMjM0
NTY3ODkwIiwiY3VzdG9tZXJfaWQiOiJjdXN0XzEyMzQ1NiIsImN1c3RvbWVy
...
-----END KAFKA-BACKUP LICENSE-----

The license payload contains:

Field	Description
`license_id`	Unique identifier (UUID)
`customer_id`	Customer identifier
`customer_name`	Organization name
`customer_email`	Contact email
`tier`	`standard` or `enterprise`
`features`	List of enabled feature flags
`max_clusters`	Maximum Kafka clusters (optional)
`max_nodes`	Maximum brokers across all clusters (optional)
`issued_at`	Issue date (ISO 8601)
`expires_at`	Expiry date (optional — `null` = perpetual)
`schema_version`	License format version

License Activation

Apply from File

kafka-backup license apply --file /path/to/license.key

This validates the license and saves it to ~/.config/kafka-backup/license.key.

Output:

License applied successfully.
  License ID:  abcdef12-3456-7890-abcd-ef1234567890
  Customer:    Acme Corp
  Tier:        Enterprise
  Saved to:    /home/user/.config/kafka-backup/license.key

Verify a License (Without Applying)

kafka-backup license verify --file /path/to/license.key

Output:

License is valid.
  License ID:  abcdef12-3456-7890-abcd-ef1234567890
  Customer:    Acme Corp
  Tier:        Enterprise
  Features:    encryption, schema_registry, rbac, audit, support
  Expires:     2027-01-15 (285 days remaining)

Check Current License Status

kafka-backup license info

Output when licensed:

  License ID:   abcdef12-3456-7890-abcd-ef1234567890
  Customer:     Acme Corp (acme@example.com)
  Tier:         Enterprise
  Features:     encryption, schema_registry, rbac, audit, support
  Max clusters: 5
  Issued:       2026-01-15
  Expires:      2027-01-15 (285 days remaining)
  Status:       Valid

Output when unlicensed:

  No license found. Running in OSS mode.

  To activate enterprise features:
    kafka-backup license apply --file /path/to/license.key

  Get a license at https://enterprise.kafkabackup.com

License Discovery

The license is loaded automatically at startup. The tool searches these locations in order:

Priority	Source	Description
1	`ENTERPRISE_LICENSE_KEY` env var	Base64-encoded PEM content (for CI/CD)
2	`ENTERPRISE_LICENSE_FILE` env var	Path to license file
3	`/etc/kafka-backup/license.key`	Default for containers and Kubernetes
4	`~/.config/kafka-backup/license.key`	Default for CLI users

Kubernetes Secret

For Kubernetes deployments, mount the license as a secret:

apiVersion: v1
kind: Secret
metadata:
  name: kafka-backup-license
  namespace: kafka-backup
type: Opaque
stringData:
  license.key: |
    -----BEGIN KAFKA-BACKUP LICENSE-----
    eyJsaWNlbnNlX2lkIjoiYWJjZGVmMTItMzQ1Ni03ODkwLWFiY2QtZWYxMjM0
    ...
    -----END KAFKA-BACKUP LICENSE-----

Mount it in your deployment:

volumes:
  - name: license
    secret:
      secretName: kafka-backup-license
volumeMounts:
  - name: license
    mountPath: /etc/kafka-backup
    readOnly: true

Environment Variable (CI/CD)

For CI/CD pipelines, pass the license as a base64-encoded environment variable:

export ENTERPRISE_LICENSE_KEY=$(base64 < license.key)
kafka-backup backup --config backup.yaml

Graceful Degradation

Enterprise features never block your backup. If a feature is configured but not licensed:

A warning is logged: "Schema Registry backup is configured but not licensed. Skipping."
The backup continues without the enterprise feature
Kafka data backup runs normally
Exit code is 0 (success)

This means you can deploy the enterprise binary everywhere and activate features per-environment by providing licenses only where needed.

Offline Validation

License validation is fully offline:

The Ed25519 public key is embedded in the binary at compile time
No network calls, no license server, no DNS dependency
Works in air-gapped environments
Validation checks: signature integrity, expiry date, feature flags

Security

The private signing key is held exclusively by OSO DevOps — never distributed
The public verification key is embedded in the enterprise binary
Licenses cannot be forged or modified without the private key (Ed25519 is 128-bit security)
License files contain customer information but no secrets — safe to store in version control or config management

FAQ

Q: What happens when the license expires? Enterprise features stop activating. The binary continues to work as an OSS-equivalent tool. No data loss, no downtime.

Q: Can I use the same license on multiple machines? Yes. The license is not tied to a machine or MAC address. It is limited by max_clusters (number of distinct Kafka clusters backed up).

Q: Do I need internet access to validate the license? No. Validation is 100% offline using Ed25519 signature verification.

Q: What if I lose my license file? Contact sales@oso.sh — we can reissue your license from our records.

License Model​

Licensed Features​

Obtaining a License​

Free Trial​

Purchase a License​

License File Format​

License Activation​

Apply from File​

Verify a License (Without Applying)​

Check Current License Status​

License Discovery​

Kubernetes Secret​

Environment Variable (CI/CD)​

Graceful Degradation​

Offline Validation​

Security​

FAQ​