GPlatform Control terms

What this covers

GPlatform Control is the service we operate: it issues your licences, carries the catalogue and the signed artifact store, holds the escrowed half of your lockdown key, drives support sessions, and manages the applications we host for you directly.

It is the counterpart to GControl, which is the broker you run on your own infrastructure and which is licensed separately. Where a clause is about what your instance does, it is in the GControl terms; where it is about what we do, it is here.

These sit alongside the general terms of service.

It is a service, not a licence to run it

GPlatform Control is licensed under the Elastic License 2.0, but it is not offered for you to run. There is no self-hosted GPlatform Control, and enrolling is not acquiring one.

What you get is access to the service for as long as your arrangement runs.

Enrolment

An instance enrols with a licence document, or with a pairing code and its confirmation, or with an enrolment token. Enrolment is deliberate, made from your side, and it is the moment the ledger your instance accumulated while standalone is handed over.

An instance that never enrols is entitled to nothing here and needs nothing here. Standalone operation is a first-class mode of GControl and is not a degraded one.

Licences and entitlements

A licence names applications, a tier, modules and caps. It is delivered as a signed lease, refreshed continuously, and what your instance holds is what the lease says.

Withdrawing an entitlement is not a command we send. It drops out of the next lease and takes effect on its own. An instance that never contacts us again still loses a withdrawn entitlement when the lease it already holds expires. That is the licence ending on its own terms; it is not a remote kill switch for the software, which keeps running.

Where you exceed a cap we will tell you before we act on it. Seat and user counts arrive as numbers from your instances and are compared across everything one licence covers.

What we may ask your instance to do

Your instance decides whether to carry out anything we ask, and you configure that. The verb classes, their defaults and the consent rules are set out in the GControl terms and govern the relationship in both directions. They are not restated here, and they are not weakened by anything on this page.

Two things follow from them that belong on this side: we cannot open an inbound connection into your network, and we cannot obtain a privileged verb without a person on your side consenting at the time.

The key we escrow

We generate and hold the private half of your instance's lockdown key so that a sealed instance can be recovered. It is held in Vault, one per instance; our database holds the public half and a path, never the material.

It moves only during an unseal, and only after a person has verified the requester out of band. Seal is refused outright unless the key can be escrowed first, because a discard nobody can undo is not containment.

If we are not here

You are entitled to ask what happens to the escrowed half of your lockdown key if Gelhaus Solutions becomes unable to operate. The honest answer today is that there is no escrow agent and no successor arrangement, and we would rather say so than imply a protection that does not exist.

What is true, and is a real part of the answer: the key is held per instance and never per organisation, so no single event exposes every customer at once; a Seal is refused unless escrow succeeds first, so an instance is never left sealed with no path back; and an instance that is not sealed does not need us at all — standalone operation is a first-class mode and a lease already held continues through its grace period.

If you need a contractual continuity arrangement, ask before you buy and it will be dealt with in a signed agreement rather than here.

Support

Where you open a support session, we see what its scope allows for as long as it lasts, and your side enforces the expiry. Consent that never expires is an approval somebody gave once and a vendor holds forever, so there is none of it here.

Suspension

A deployment or an enrolment may be suspended where a subscription lapses, where use is unlawful, or where it is causing damage to the service or to others.

Suspension stops the service. It does not delete your data, and the deletion terms in the data processing agreement apply if the arrangement ends.

Term and notice

Unless a signed agreement says otherwise, an arrangement runs for the period you bought and renews for the same period unless it is ended.

You may end it at any time up to 14 days before the end of the current period, which takes effect at the end of that period. A monthly arrangement can therefore always be ended within a month, and you never need a reason.

We may end it with three months' notice to the end of a period. That is longer than your notice on purpose: moving a control plane is our work to make unnecessary and your work to absorb.

Either of us may end it immediately for good cause, which for us means the grounds for suspension below and nothing else. Ending for good cause does not require a warning where a warning would obviously not help.

Notice by email to the address on the account is sufficient for both of us.

If it ends

Your instance keeps running. Licence-dependent features continue through the grace period in the lease you already hold and then stop; everything else was never ours to switch off.

You may export what we hold about your instances, and the deletion terms in the processing agreement apply. Audit anchors we already hold are kept for the integrity of the chains they anchor, and they contain head hashes rather than entries.

Availability

No service level is promised unless a separate signed agreement states one.

This is worth reading together with the design rather than as boilerplate: your instances do not need us to be reachable to keep working. Standalone operation is first class, and a lease already held continues through its grace period. An outage here is not an outage there.

No warranty, no service level, and limited liability

This product is provided as it is and as it happens to be available, without warranty of any kind, and is used at your own risk. No uptime, response time or restoration time is owed unless a separate signed agreement states one. Where it is provided free of charge, liability is limited to intent and gross negligence (Section 521 BGB).

To the fullest extent the law permits, we are not liable for damage arising from its use, its unavailability, or any loss of data — and keeping your own backups is your responsibility. The limits that mandatory law requires, the exclusions that apply within them, and the additional cap that applies to business customers are set out in full in the general terms of service, which govern this product and are not restated here.