pico-fido/ENTERPRISE.md

# Enterprise / Commercial Edition

This project is offered under two editions:

## 1. Community Edition (FOSS)

The Community Edition is released under the GNU Affero General Public License v3 (AGPLv3).

Intended for:
- individual users and researchers
- evaluation / prototyping
- internal lab / security testing

You are allowed to:
- read and study the source code
- modify it
- run it internally

Obligations under AGPLv3:
- If you distribute modified firmware/binaries/libraries to third parties, you must provide the corresponding source code of your modifications.
- If you run a modified version of this project as a network-accessible service (internal or external), you must offer the source code of those modifications to the users of that service.
- No warranty, no support, no SLA.
- Enterprise features (bulk provisioning, multi-user policy enforcement, device inventory / revocation, corporate PIN rules, custom attestation/identity, etc.) are NOT included.

The Community Edition will continue to exist.

## 2. Enterprise / Commercial Edition

The Enterprise / Commercial Edition is a proprietary license for organizations that need to:

- deploy this in production at scale (multiple devices / multiple users / multiple teams)
- integrate it into their own physical product or appliance
- run it as an internal service (VM / container / private cloud "HSM / auth backend") for multiple internal teams or tenants
- enforce internal security policy (admin vs user roles, mandatory PIN rules, secure offboarding / revocation)
- avoid any AGPLv3 disclosure obligations for their own modifications and integration code

### What the Enterprise Edition provides

**Base license package (always included):**
- **Commercial license (proprietary).**
  You may run and integrate the software/firmware in production — including virtualized / internal-cloud style deployments — without being required to disclose derivative source code under AGPLv3.
- **Official signed builds.**
  You receive signed builds from the original developer so you can prove integrity and provenance.
- **Onboarding call (up to 1 hour).**
  A live remote session to get you from "we have it" to "it’s actually running in our environment" with minimal guesswork.

**Optional enterprise components (available on demand, scoped and priced per customer):**
- **Production / multi-user readiness.**
  Permission to operate the system with multiple users, multiple devices and multiple teams in real environments.
- **Bulk / fleet provisioning.**
  Automated enrollment for many tokens/devices/users at once (CSV / directory import), scripted onboarding of new users, initial PIN assignment / reset workflows, and role-based access (admin vs user).
- **Policy & lifecycle tooling.**
  Corporate PIN policy enforcement, per-user / per-team access control, device inventory / traceability, and secure revocation / retirement when someone leaves.
- **Custom attestation / per-organization identity.**
  Per-company certificate chains and attestation keys so devices can prove "this token/HSM is officially ours," including anti-cloning / unique device identity for OEM and fleet use.
- **Virtualization / internal cloud deployment support.**
  Guidance and components to run this as an internal service (VM, container, private-cloud HSM/auth backend) serving multiple internal teams or tenants under your brand.
- **Post-quantum (PQC) key material handling.**
  Integration/roadmap support for PQC algorithms (auth / signing) and secure PQC key storage inside the device or service.
- **Hierarchical deterministic key derivation (HD).**
  Wallet-style hierarchical key trees (BIP32-like concepts adapted to this platform) for issuing per-user / per-tenant / per-purpose subkeys without exporting the root secret — e.g. embedded wallet logic, tenant isolation, firmware signing trees, large fleets.
- **Cryptographically signed audit trail / tamper-evident event logging.**
  High-assurance logging of sensitive actions (key use, provisioning, PIN resets, revocations) with integrity protection for forensic / compliance needs.
- **Dual-control / two-person approval ("four-eyes").**
  Require multi-party authorization for high-risk actions such as firmware signing, key export, or critical configuration changes — standard in high-assurance / regulated environments.
- **Secure key escrow / disaster recovery design.**
  Split-secret or escrowed backup strategies so you don’t lose critical signing keys if a single admin disappears or hardware is lost.
- **Release-signing / supply-chain hardening pipeline.**
  Reference tooling and process so every production firmware/binary is signed with hardware-backed keys, proving origin and preventing tampering in transit or at manufacturing.
- **Policy-locked hardened mode ("FIPS-style profile").**
  Restricted algorithms, debug disabled, no raw key export, tamper-evident configuration for regulated / high-assurance deployments.
- **Priority support / security response SLA.**
  A direct line and guaranteed response window for production-impacting security issues.
- **White-label demo / pre-sales bundle.**
  Branded demo firmware + safe onboarding script so you can show "your product" to your own customers without exposing real production secrets.

These components are NOT automatically bundled. They are available case-by-case depending on your use case and are priced separately.

### Licensing models

- **Internal Use License**
  Internal production use within one legal entity (your company), including internal private cloud / virtualized deployments for multiple internal teams.
  Optional enterprise components can be added as needed.

- **OEM / Redistribution / Service License**
  Integration into a product/appliance you ship to customers, OR operating this as a managed service / hosted feature for external clients or third parties.
  Optional enterprise components (attestation branding, PQC support, HD key derivation, multi-tenant service hardening, audit trail, etc.) can be added as required.

Pricing depends on scope, fleet size, number of users/tenants, regulatory requirements, and which optional components you select.

### Request a quote

Email: pol@henarejos.me
Subject: `ENTERPRISE LICENSE <your company name>`

Please include:
- Company name and country
- Intended use:
  - Internal private deployment
  - OEM / external service to third parties
- Approximate scale (number of devices/tokens, number of users/tenants)
- Which optional components you are interested in (bulk provisioning, policy & lifecycle tooling, attestation branding / anti-cloning, virtualization/cloud, PQC, HD key derivation, audit trail, dual-control, key escrow, supply-chain signing, hardened mode, SLA, white-label demo)

You will receive:
1. A short commercial license agreement naming your company.
2. Access to the base package (and any optional components agreed).
3. Scheduling of the onboarding call.

## Why Enterprise exists

- Companies often need hardware-backed security (HSM, FIDO2, OpenPGP, etc.) under their own control, but cannot or will not open-source their internal security workflows.
- They also need multi-user / fleet-management features that hobby users do not.
- The commercial license funds continued development, maintenance and new hardware support.

The Community Edition remains AGPLv3.
The Enterprise Edition is for production, scale, and legal clarity.