Enterprise overview
OrkStage Enterprise adds identity, governance and compliance features to the open source core. Same code and images, turned on by an offline license key.
OrkStage is open core. The Community edition, under the GNU AGPL-3.0, is the complete control plane. You can run it on your own infrastructure and use it for production workloads on AWS without paying anyone.
Enterprise adds what larger and regulated organizations need around the core: identity integration, finer governance, compliance exports, several organizations and support with an SLA.
How it works
- One codebase, one build. The Enterprise source lives in a private repository that the official images are built with. There is no separate fork: a build from the public source is the Community edition.
- A license key turns it on. Set
ORKSTAGE_LICENSE_KEYto the key you receive. The key is a signed token (Ed25519) that OrkStage verifies offline. OrkStage does not contact a license server and does not require usage reports. - Your data stays usable. Without a key, or with an invalid key, OrkStage runs as Community. When a key expires, a banner shows a 14 day grace period, after which Enterprise features switch off. OrkStage never deletes or locks your data.
- A clear boundary. Core code never imports Enterprise code; the platform loads the Enterprise
module only when the build has it, and Enterprise features plug into extension points. Without a license that covers them, gated endpoints answer
402 ENTERPRISE_REQUIRED. - Edition at a glance.
GET /api/v1/licensereports the active edition and features. In the console, Settings > License shows the edition, the customer, the expiry and every Enterprise feature with whether the license includes it, and platform staff see a banner during the grace period or when the configured key is not valid. - Locked, not broken. An Enterprise control the license does not cover, such as the audit log export, shows a short explanation with a link to the editions instead of failing.
Feature status
| Feature | Status |
|---|---|
Audit log export: GET /api/v1/audit/export?format=ndjson|csv&from=&to=&tenantId= (scope audit:read) | Available |
| SAML 2.0 SSO, SCIM provisioning | Planned |
| Custom roles and detailed permissions | Planned |
| Approval workflows with several steps, change windows | Planned |
| Policy packs and custom policy authoring | Planned |
| Multiple organizations, status pages with your own branding | Planned |
| Audit retention policies, SIEM streaming | Planned |
| Priority support backed by an SLA | Planned |
The full comparison is on Community vs Enterprise.