Licensing

A valid license key is required to use Tayra in all environments. Request a free trial key at tayra.dev or purchase a production license - see pricing for details.

Setting Your License Key

Set the LicenseKey property in TayraOptions:

services.AddTayra(opts =>
{
    opts.LicenseKey = Environment.GetEnvironmentVariable("TAYRA_LICENSE_KEY");
});

Without a valid license key, resolving ITayra from the DI container will throw a TayraLicenseException.

Environment Variables

Store your license key in an environment variable or secrets manager rather than hard-coding it. This prevents accidental exposure in source control.

Trial Licenses

Trial licenses are free, fully-functional signed keys with a time limit (typically 15 days). Request one at tayra.dev or by emailing hello@tayra.dev. Trial keys work identically to production keys during the trial - there are no artificial limitations, watermarks, or feature gates.

The one difference is at expiry: a trial key stops encrypting new data when its term ends (with no grace window - that is production-only). Decryption behaves exactly as it does for a production key: it is perpetual and unconditional, the host still starts, and anything you encrypted during the trial stays readable. Move to a production key before you need to encrypt again.

Production Licenses

A production key carries a single license term (the expiresAt date, typically 12 months, extended by renewal). The term governs three things, and it is deliberately asymmetric so that a lapsed license can never cause a data outage:

• Decryption is perpetual and unconditional. Data already encrypted with your keys keeps decrypting forever, before and after the term ends. There is no license check on the decryption path at all - not the clock, not the term, not the grace period, not the build's publish date, not the state of the key. No licensing condition can make your stored PII unreadable.
• Encryption of new data is term-bound with a 60-day grace. New encryption is allowed through the term end plus a grace window (60 days by default, or whatever the key encodes). After the grace elapses, EncryptAsync throws a TayraLicenseException rather than storing data unprotected - Tayra never silently writes cleartext.
• Adopting newer versions is bound by the term end (no grace). A release published on or before your term end is licensed for encryption use, regardless of version, including across majors. A release published after the term end still decrypts your data, but will not encrypt new data until you renew and receive a key with a later term. Decryption is unaffected by the running build's date.

When a missing, tampered, malformed, or unverifiable key is supplied, the host fails to start - that is the only startup-time failure, and it applies to trial and production keys alike. A key that verifies always starts, however far past its term. See the License for the binding text.

Renewal never risks your data

Because decryption is never gated and the startup gate only fails on an inauthentic key, letting a license lapse degrades to "can't encrypt new data" and "can't adopt newer builds" - never "can't read stored data" and never "won't boot".

Validation

Tayra validates the license key entirely offline - no network calls, no phone-home, no telemetry. Your application can run in air-gapped environments, private networks, or anywhere without internet access. The signature is checked once at startup; the runtime encryption gate (term + grace, and the version limit) is re-evaluated on each encrypt call, so a grace window that lapses while a long-running process is up is observed. DecryptAsync performs no license check whatsoever - there is no code path in Tayra that can refuse a decryption for licensing reasons.

Editions

Tayra is available in two editions. Both editions fully support GDPR-compliant data protection - the Compliance edition adds reporting and tooling, not the protection itself.

Edition	Package	What You Get
Essentials	Tayra.Core	Field-level encryption, crypto-shredding, key rotation, blind indexes, observability-grade audit logging, all framework integrations, CLI tool - everything needed to protect personal data and comply with GDPR
Compliance	Tayra.Core + Tayra.Compliance	Everything in Essentials, plus the regulator-facing artifact suite: PII data maps (Art. 30), data subject access exports (Art. 15/20), breach notification reports (Art. 33/34), formatted HTML compliance reports, ECDSA-signed reports, scheduled report runs with pluggable archive, persistent hash-chained audit trail, and the curated Grafana dashboard

One license = one legal entity

A purchased Tayra license covers a single named legal entity (the "Licensee" identified on the license key or purchase record). It does not extend to parent companies, subsidiaries, sister companies, joint ventures, or other affiliates - even when they share common ownership or control. Each separate legal entity that uses Tayra in production must obtain its own license. See the License for the binding text.

TIP

The Essentials edition already provides the technical foundation for GDPR compliance. The Compliance edition automates the reporting that GDPR requires - the kind of work that would otherwise take weeks of custom development.

The Compliance reporting features are distributed in a separate Tayra.Compliance NuGet package. Install it alongside Tayra.Core:

dotnet add package Tayra.Compliance

Attempting to resolve a Compliance service (e.g., ITayraCompliance) with an Essentials license will throw a TayraLicenseException.

Pricing & Tiers

For license tiers, pricing, and eligibility details, see tayra.dev/#pricing.

To obtain a license key, contact hello@tayra.dev.

Validating Your License

You can check whether a license is valid by resolving the LicenseChecker from the DI container:

var checker = provider.GetRequiredService<LicenseChecker>();

if (!checker.IsAuthentic)
{
    // Missing / tampered / malformed key - the host refuses to start on this.
}

if (!checker.IsLicensed)
{
    // Authentic, but no longer usable for new encryption (an expired trial).
    // The host still started, and decryption still works.
}

// For a production key, IsLicensed stays true even after the term lapses. To find out whether new
// encryption is still permitted, ask the runtime gate - it throws when the term + grace has elapsed
// or the running build is newer than the term:
checker.EnsureCanEncrypt();

There is no EnsureCanDecrypt counterpart, deliberately. Decryption is not gated, so there is nothing to ask.

See Also

• Dependency Injection - Service registration
• Options - All configuration options