GPlatform Control terms

What this covers

GPlatform Control is the service we operate: it issues your licences, carries the catalogue and the signed artifact store, holds the escrowed half of your lockdown key, drives support sessions, and manages the applications we host for you directly.

It is the counterpart to GControl, which is the broker you run on your own infrastructure and which is licensed separately. Where a clause is about what your instance does, it is in the GControl terms; where it is about what we do, it is here.

These sit alongside the general terms of service.

It is a service, not a licence to run it

GPlatform Control is licensed under the Elastic License 2.0, but it is not offered for you to run. There is no self-hosted GPlatform Control, and enrolling is not acquiring one.

What you get is access to the service for as long as your arrangement runs.

Enrolment

An instance enrols with a licence document, or with a pairing code and its confirmation, or with an enrolment token. Enrolment is deliberate, made from your side, and it is the moment the ledger your instance accumulated while standalone is handed over.

An instance that never enrols is entitled to nothing here and needs nothing here. Standalone operation is a first-class mode of GControl and is not a degraded one.

Licences and entitlements

A licence names applications, a tier, modules and caps. It is delivered as a signed lease, refreshed continuously, and what your instance holds is what the lease says.

Withdrawing an entitlement is not a command we send. It drops out of the next lease and takes effect on its own. An instance that never contacts us again still loses a withdrawn entitlement when the lease it already holds expires. That is the licence ending on its own terms; it is not a remote kill switch for the software, which keeps running.

Where you exceed a cap we will tell you before we act on it. Seat and user counts arrive as numbers from your instances and are compared across everything one licence covers.

What we may ask your instance to do

Your instance decides whether to carry out anything we ask, and you configure that. The verb classes, their defaults and the consent rules are set out in the GControl terms and govern the relationship in both directions. They are not restated here, and they are not weakened by anything on this page.

Two things follow from them that belong on this side: we cannot open an inbound connection into your network, and we cannot obtain a privileged verb without a person on your side consenting at the time.

The key we escrow

We generate and hold the private half of your instance's lockdown key so that a sealed instance can be recovered. It is held in Vault, one per instance; our database holds the public half and a path, never the material.

It moves only during an unseal, and only after a person has verified the requester out of band. Seal is refused outright unless the key can be escrowed first, because a discard nobody can undo is not containment.

If we are not here

You are entitled to ask what happens to the escrowed half of your lockdown key if Gelhaus Solutions becomes unable to operate. The honest answer today is that there is no escrow agent and no successor arrangement, and we would rather say so than imply a protection that does not exist.

What is true, and is a real part of the answer: the key is held per instance and never per organisation, so no single event exposes every customer at once; a Seal is refused unless escrow succeeds first, so an instance is never left sealed with no path back; and an instance that is not sealed does not need us at all: standalone operation is a first-class mode and a lease already held continues through its grace period.

If you need a contractual continuity arrangement, ask before you buy and it will be dealt with in a signed agreement rather than here.

Support

Where you open a support session, we see what its scope allows for as long as it lasts, and your side enforces the expiry. Consent that never expires is an approval somebody gave once and a vendor holds forever, so there is none of it here.

Suspension

We may suspend a deployment or an enrolment only on these grounds, and only as the general terms set out:

• For non-payment, after a reminder and 14 days, and never for an amount you have properly disputed. Read access and export stay available while it lasts.
• Where use is unlawful, or where it is causing damage to the service or to others. We give reasons no later than when it takes effect, and before suspending we notify you, let you respond and decide again, except in the urgent cases the general terms list, such as an attack on our systems or on others.

Suspension stops the service. It does not delete your data, and the deletion terms in the data processing agreement apply if the arrangement ends.

Term and notice

Unless a signed agreement says otherwise, an arrangement runs for the period you bought and renews for the same period unless it is ended.

You may end it at any time up to 14 days before the end of the current period, which takes effect at the end of that period. A monthly arrangement can therefore always be ended within a month, and you never need a reason.

We may end it with three months' notice to the end of a period. That is longer than your notice on purpose: moving a control plane is our work to make unnecessary and your work to absorb.

Either of us may end it immediately for good cause (Section 314 BGB), which for us means the grounds for suspension above and nothing else. Ending for good cause does not require a warning where a warning would obviously not help.

A free enrolment has no period bought: either of us may end it with 4 weeks' notice by email, without giving reasons, as the general terms set out.

Notice by email to the address on the account is sufficient for both of us.

If it ends

Your instance keeps running. Licence-dependent features continue through the grace period in the lease you already hold and then stop; everything else was never ours to switch off.

For 30 days after it ends you may export what we hold about your instances; after that the deletion terms in the general terms and the processing agreement apply to everything except what this product keeps. Audit anchors we already hold are kept for the integrity of the chains they anchor, and they contain head hashes rather than entries. Instance, licence and entitlement records are kept as the record of the licence, and the stamps your instances carry are kept for good, as the GControl terms describe.

Availability

No service level is promised unless a separate signed agreement states one.

This is worth reading together with the design rather than as boilerplate: your instances do not need us to be reachable to keep working. Standalone operation is first class, and a lease already held continues through its grace period. An outage here is not an outage there.

What you can take with you

When you switch to another provider under the general terms, or at any time before, you can take the following with you. The list is exhaustive; our switching page describes the formats and every limit we know of.

• your organisation, users and memberships;
• licences with their apps and events, entitlements, and licence files;
• your instances and the apps on them, with their meter readings and health samples;
• support sessions, commercial and cloud access requests, cloud deployments, tenants and subscriptions;
• notifications and diagnostics consents;
• anything else you or your users put into GPlatform Control or generated by using it, with its metadata.

How. Licence files download from the portal. Everything else we hand over as JSON when you ask.

Formats. JSON; licence files in their .gclicence format.

What stays behind. Only the private half of your instances' lockdown keys, which we escrow and which leaves Vault only in an unseal (see "The key we escrow"), session secrets, and our internal database identifiers. Leaving these behind never delays or prevents a switch.

Your content, your account and these clauses

The general terms carry these clauses in full: the licence to your content, moving accounts, new terms, restrictions and suspension, suspension for non-payment, and ending a service. This section says only what is specific to GPlatform Control.

What the licence covers. What you and your instances send us: what each instance sends (the heartbeat with the head hashes that anchor your audit chain, the ledger handed over at enrolment, command results, and diagnostics if you turn them on), your support requests and the support bundles you send, and what a support session you open shows us. It also covers what is inside an application we host for you, only to run that deployment. We use all of it only to operate and provide GPlatform Control as these terms describe. The escrowed half of your lockdown key, which we generate and hold for you, is used for nothing but the purpose under The key we escrow.

Who receives it. Only the providers who run GPlatform Control for us, named in the privacy notice, and our other products where it is used for the same purpose; and, as for every product, a successor under the transfer clause and companies affiliated with Gelhaus Solutions, only to operate and provide the service. Nobody receives a licence to your content for their own purposes.

What we keep after the end. Nothing you send is published. What this product keeps after the arrangement ends (the audit anchors, the instance, licence and entitlement records, and the stamps) is set out under If it ends above.

Your account. Sign-in to GPlatform Control moves to GPlatform SSO, the sign-in service we run for our products, under the rules for moving accounts in the general terms: we email you at least 30 days in advance and say what moves; we move only the data needed to sign you in and keep what you hold; and if access becomes materially harder, you may end the arrangement free of charge within 30 days. Both are run by Gelhaus Solutions, so your account stays with us.

Free or paid. An instance on GControl's free base tier can enrol without paying, and that enrolment is a free service. If you have not accepted new terms when the six weeks the general terms give are over, a free enrolment is restricted until you accept: you can still sign in, read, export your data, exercise your data-protection rights, close the account and accept, and nothing else, and your instance keeps running on the base tier, as an unenrolled one does. A paid enrolment is never restricted: you keep it on the old terms until we end the arrangement at its next ordinary end date, with the notice under Term and notice. Export and your data-protection rights never depend on accepting.

Suspension follows the general terms, as set out under Suspension above.

No warranty, no service level, and limited liability

This product is provided as it is and as it happens to be available, without warranty of any kind, and is used at your own risk. No uptime, response time or restoration time is owed unless a separate signed agreement states one. Where it is provided free of charge, liability is limited to intent and gross negligence (Section 521 BGB).

To the fullest extent the law permits, we are not liable for damage arising from its use, its unavailability, or any loss of data, and keeping your own backups is your responsibility. The limits that mandatory law requires, the exclusions that apply within them, and the additional cap that applies to business customers are set out in full in the general terms of service, which govern this product and are not restated here.