License and editions

Backup and restore are complete in every edition, with no mailbox limit anywhere: a license never throttles how much you can protect or how much you can get back. The software does not technically limit the number of mailboxes or tenants. Business is licensed for one organization, Service Provider for any number of tenants (your own customers only); you use the license within what you purchased. These counts are an honour rule set by the license terms, never enforced in code. Restow shows the number of protected mailboxes on the card Protected mailboxes on the Status tab of Overview (and in GET /api/v1/usage) for your own overview; nothing limits it.

Editions

Edition	Tenants	Price (net)	What it adds
Community	One	Free, no license key, Apache 2.0	Several provider administrators with roles, since 0.3.1 (tenant administrators and users can be invited in every edition). Microsoft 365 and IMAP backup, non-destructive restore, weekly restore checks (sampled read-back verification), alerts, the archive (SHA-256 hash chain with chain verification, search over subject, addresses and body text of imported mail, fed by mail import with archiving, export as EML in a ZIP or as MBOX), endpoint backup for servers and clients (Linux and macOS), Proxmox VE backup of VMs and containers (a preview, since 0.3.1, in every edition), mail file import and export, failure explanations, the opt-in update check, a basic operations log (job history, errors), REST API. Everything that came with 0.4.0 is in every edition too: file share backup (SMB and NFS, without an agent), immutable backups (S3 Object Lock per repository, a deletion delay for directories), ransomware detection with a retention hold, the notification matrix, SharePoint Online backup and restore, agent policies, file restore for the restore role, the Proxmox VE extras (progress, boot tests, file restore of containers and, as a preview, of VMs), updates that wait for or cleanly stop running backups, moving the database to another disk with a low disk space warning, and storage growth on the dashboard. Every read and every restore is recorded in the hash-chained audit log, without the viewer.
Business	One organization	One-time license: €595 list price from general release; €476 during the pre-sale. Optional update year: €295 per year	A perpetual right to use the Business modules for one organization. The archive’s layer designed for GoBD-compliant use: Exchange Online journal receipt and copies that a mail provider forwards (both need a TLS certificate of your own), and, since 0.4.4, capture from the mailboxes (Graph for Microsoft 365, IMAP archiving for IMAP and Google Workspace; near-time, not complete), enforced retention, legal hold. The audit log viewer (list, filter, entry details, hash-chain verification) and scheduled reports by e-mail (all available), and since 0.3.1 the audit log export (CSV, JSON with hashes). Sign-in with Microsoft and single sign-on (SSO), four-eyes approval and a signed restore proof are planned, without dates. The provider team is in every edition since 0.3.1.
Service Provider	Any number (your own customers)	One-time license: €1,950 list price from general release; €1,560 during the pre-sale. Optional update year: €595 per year	Everything in Business, for any number of tenants (your own customers), plus multiple tenants with tenant management, the cross-tenant REST API, delegated tenant administrators, the provider overview across all tenants (tenant reporting) and limiting each team member to chosen tenants (all available), and, since 0.4.0, All tenants under Jobs, which lists every tenant with its jobs, what runs and waits and how the newest backups ended. White label is planned.

The current status of every feature is on the roadmap and on the pricing page. Prices are for business customers only (§ 14 BGB), plus VAT where it applies.

What “one-time purchase” means

The license itself is a one-time purchase and perpetual. Updates have their own, optional terms:

• A license is bought once. Nothing renews automatically; there is no subscription.
• Licenses bought in the pre-sale include every update of the 1.x series. From version 1.0, a license includes 12 months of updates, counted from delivery of the license key. After that, an update year is optional: Business €295, Service Provider €595 net per year, bought one year at a time. Update years go on sale with version 1.0. There is no price per mailbox, user or tenant. Pre-sale licenses need an update year only for a later 2.x series.
• After a gap, the next update year costs the normal price, with no back payment and no surcharge. It covers every version released until it ends, including the versions released during the gap.
• Without an update year, every version released until then keeps running indefinitely, with all modules of the edition; there is no phone-home and no shutdown. It gets no more security fixes: they ship only in new versions, and older versions get none. In later versions, the Business and Service Provider modules stay off until you buy an update year.
• If development stops, this is announced at least twelve months in advance, and the Business and Service Provider modules are then published as open source under the core’s license (Apache 2.0); your installation keeps running without a license key.
• A license includes the software and the updates described above. Support, setup, operation and an SLA are not included; such services need a separate contract.

Early Access

Until general release, licenses are sold as Early Access at the pre-sale price:

• A license bought during the pre-sale is perpetual, also after general release, and includes every update of the 1.x series.
• Features marked in development are delivered later, without a commitment to a date.
• During the beta, do not use Restow as your only backup.
• You can return a license bought during the pre-sale within 30 days, without giving reasons. This right of return is voluntary.

The binding terms are the license terms (German, authoritative; English translation).

Licenses

Restow is one repository and one release, published in two builds:

• Full images (ghcr.io/restow-backup/restow and ghcr.io/restow-backup/restow-web): the core plus the Business and Service Provider modules. A license key decides at runtime which of them are active; without a key the installation runs as Community.
• Community images (ghcr.io/restow-backup/restow-community and ghcr.io/restow-backup/restow-web-community): the core only, without any code from ee/.

Both builds use the same database schema; you switch by changing RESTOW_IMAGE and RESTOW_WEB_IMAGE in .env and running docker compose up -d (see Get started).

The core (everything outside ee/: backup, restore, the archive, endpoint backup including the agent, mail file import and export, the integration API, the web interface) is open source under the Apache License 2.0. The Business and Service Provider modules in ee/ are source-available under the license in ee/LICENSE: using them in production requires a valid license key under the Restow license terms (German, binding; English translation). The source code is in the repository.

Installation → About. Every installation shows its product name, version, commit, the core license (Apache-2.0), a link to the source code of the running release and the third-party licenses under Installation → About. In the full images, the license key is managed in the same tab, and the menu entry Installation → License (for provider administrators) opens exactly this section.

Locked features stay visible in the full images. Without a key, the menu entries of Business and Service Provider features are shown greyed out with a lock that leads to Installation → About (the section Installation → License opens), and their API routes answer 403 with urn:restow:problem:edition-required. There are no banners, pop-ups or counters.

The Community images have no license settings. They show no license section and no locked Business or Service Provider entries: those features do not exist there (the audit log viewer, for example). The provider team does exist there: several administrators with roles are part of the core. Core functions that only a paid edition offers, such as a second tenant, limiting a team member to chosen tenants, provider API keys, Overview (tab Status) across all tenants, the Statistics of all tenants, or time-triggered summary reports, answer 403 with urn:restow:problem:feature-unavailable. To use them, switch to the full images and install a key.

State of 0.4.7

In the 0.4.7 beta, every read and every restore is recorded in the hash-chained audit log in every edition. The audit log viewer (list, filter, entry details, hash-chain verification) and, since 0.3.1, the audit log export (CSV, JSON with hashes) are Business and Service Provider features and are available. The operations log (job history and errors) stays in Community. Several administrators with roles are in every edition; limiting a member to chosen tenants is Service Provider. The release notes of 0.4.0 say that everything they add is part of every edition (the Community core) unless marked otherwise, and mark one item otherwise: All tenants in Jobs, a Service Provider view. Sign-in with Microsoft, single sign-on (SSO) and white label did not come with 0.4.0; they are planned (see the roadmap).

The license key

Business and Service Provider are unlocked by an Ed25519-signed license key bound to this installation’s installation ID, verified entirely offline against a public key built into the release images. RESTOW_LICENSE_PUBLIC_KEY overrides that key; it is meant for development and tests of the full build only. Install a key in the full images under Installation → License → Install a key; Restow quotes your installation ID for the request. There is no phone-home and no expiry date: a key never switches a running installation off, and a license unlocks the edition’s features, not a mailbox count, so there is nothing for the software to throttle. Since 0.4.5 a key also says which releases it covers, see Updates and the license key. Removing a key returns the installation to Community and is itself recorded in the audit log.

RESTOW_EDITION has an effect only together with RESTOW_DEMO=true, for the public demo. Anywhere else it is ignored; a production installation gets its edition from an installed key.

The license check works offline, never contacts the licensor and never switches an installation off. The one place where a key decides whether something starts is a release that the key does not cover, and then the installed version simply goes on running (see below). Restore is never limited, with or without a key.

Updates and the license key

Since 0.4.5 a Business or Service Provider key can say which releases it covers. This applies to the full images only; the Community build needs no key and checks nothing. A covered release works with all modules of the key’s edition permanently. Whether a release is covered is checked only when it is installed through the updater and when it starts, before it touches the database, never while Restow runs.

What a key covers

Key	Covers
Beta license: every key issued so far, and every key installed before 0.4.5	Every 0.x release and every release of the 1.x series, permanently.
A key with an update period (updates_until): from 1.0, a license includes 12 months of updates, then an optional update year follows (What “one-time purchase” means)	Every release made up to the end of the last day of the update period (UTC), whatever its version.
A renewal (one update year more)	A new key of the same edition whose update period ends one year after the previous one.

All keys issued so far are beta licenses and keep covering every 0.x and 1.x release, so installing 0.4.5 or later changes nothing for them. The key format restow-license-v1 has three optional members since 0.4.5 and ignores members it does not know, so keys that the license server issues later keep verifying:

Member	Meaning
series	The major version series that a key without an update period covers ("1" if absent; the series 1 also covers every 0.x release).
updates_until	The last day of the update period (YYYY-MM-DD, UTC). Absent: no update period.
kid	The id of the vendor signing key, so that the key can be rotated without breaking issued keys. Absent: the original vendor key.

The six members of today (edition, mailbox_limit, multi_tenant, licensee, installation_id, issued_at) stay required, and mailbox_limit keeps its meaning (none). A key with the new optional members verifies only on 0.4.5 and later: an installation from before 0.4.5 refuses it as invalid_payload, so update first with the key you have. The exact format, for the issuer, is in ee/licensing/KEY-FORMAT.md of the repository.

“Made” means the release date that the release’s images carry: the commit date of its release tag. Restow reads it as RESTOW_RELEASED_AT (written into the image when it is built), GET /api/v1/status reports it as releasedAt in the version object, and the release notes publish the same date in a released: line next to the image digests, which is how the update check knows it before anything is installed. A build without a release date, such as a development build, counts as covered.

When an update period has ended, the installed version keeps working with every module, and so does every version released up to the end of the period: you can still install those. Versions released later cannot run the Business or Service Provider modules with that key. Older versions get no security fixes, see What “one-time purchase” means.

What the license page shows

Installation → License shows the update terms of the installed key in the line Updates: all 1.x (beta license), or until a date. From 30 days before the end of an update period, and after it, a short notice on the same page says so: every version released until then keeps working with all modules permanently, and for later versions you can renew the update period by installing the new key there. No e-mail is sent.

Installing and renewing a key

• A new key replaces the active one, also while the active key is still in force: that is how a renewal is installed, the same way as the first key. The earlier keys stay in the installation’s history, and every installation, replacement and removal is written to the audit log (license.installed, license.replaced, license.removed) with the key’s update terms and whether they cover the running version.
• A key that does not cover the running version is refused with 422 urn:restow:problem:license-invalid and the reason outside_update_period: its modules would stay off on this version. Install it on a version it covers, or install a key whose update period covers this one.
• A key signed with a vendor key this version does not know is refused as unknown_signing_key: update first, then install the key.

The update check and the updater

The update check marks each offered release that the installed Business or Service Provider key does not cover and says so calmly on the Updates page: the version lies outside the update period, the installed version keeps working, and the newest version within the period, if one is offered, installs as usual. The updater refuses to announce or plan an uncovered release (409 urn:restow:problem:update-not-covered). The notification bell and the Update available alert rules name only the newest covered release. See Updates.

A release that the key does not cover starts

Updating by hand (docker compose pull, a new RESTOW_IMAGE) bypasses the update check. The api of the new version then checks the installed key before it applies any database migration. If a Business or Service Provider key is installed and does not cover the version, the api does not start and writes nothing to the database. Its log names the version, its release date, the end of the update period and the last release date the key covers. Nothing needs to be restored, because no migration ran. Either

• go back to the version you ran before, or to any version the key covers (put the previous tags back into RESTOW_IMAGE and RESTOW_WEB_IMAGE, then docker compose up -d), and install a renewed key there; or
• start the new version as Community: set RESTOW_RUN_AS_COMMUNITY=1 in .env and run docker compose up -d. The Business and Service Provider modules stay off and nothing is changed or deleted (archives, legal holds and further tenants stay in the database, untouched). The license page says why. Installing a key that covers the version turns the modules on again at once; the variable then has no effect and can be removed.

The opt-in updater sees the api not start and puts the previous version back by itself; since no migration ran, no dump is needed.

The check never stops an installation without a key, the public demo, a development build, or any release on a beta license (every key issued so far). RESTOW_RUN_AS_COMMUNITY has no effect while the key covers the running version. Restow never reads the clock to decide what works: the license page uses it only to decide when to mention the end of an update period.