Licensing
This page is for partners who host their own ScamSafe deployment. It explains how your deployment is licensed, what you need to set up, and what happens if your license lapses.
What you receive
When your partnership is set up, the Global Cyber Alliance (GCA) gives you:
- The ScamSafe server to run on your own infrastructure.
- A license key, which looks like
SS-ABCD-EFGH-.... It identifies your deployment and is tied to your agreement with GCA. - The license server address:
https://scamsafe.license.globalcyberalliance.org.
Treat the license key like a password. Anyone who holds it can license a deployment under your agreement. Keep it in your secrets manager, not in source control or shared documents, and contact GCA straight away if you think it has been exposed so it can be replaced.
Setting up your deployment
Configure the server with your key and the license server address, using either environment variables or command-line flags:
| Environment variable | Flag | Value |
|---|---|---|
LICENSE_KEY | --licenseKey | Your license key |
LICENSE_SERVER_URL | --licenseServerURL | https://scamsafe.license.globalcyberalliance.org |
The server will not start without a license key.
Your deployment must be able to make outbound HTTPS connections to scamsafe.license.globalcyberalliance.org. If your network restricts outbound traffic, allow that address. No inbound connections are needed.
On its first start, the deployment activates its license and downloads the tutor's content (its glossary of scam types and its learner personas). Once it is running, an administrator can confirm everything is in order:
GET /api/feature-statusreturns"licenseState": "active".- The glossary and personas are populated in the admin panel.
Renewal is automatic
Your deployment checks in with the license server in the background and renews its license on its own, well before it runs out. There is nothing to schedule and no action needed while your agreement is current. The same check also delivers updates to the tutor's content as GCA publishes them.
A deployment does not need to be online all the time. If it can't reach the license server for a while, for example during a network change or maintenance window, it carries on normally and catches up once it can connect again.
Renewing your agreement with GCA doesn't change your license key, so there is nothing to reconfigure.
License states
Your deployment is always in one of these states, reported as licenseState by GET /api/feature-status:
| State | What it means | What to do |
|---|---|---|
active | Everything is working | Nothing |
expiring | Your deployment has been unable to renew for some time and its license will lapse soon. Administrators see an amber banner in the admin panel | Check the deployment can reach the license server, then contact GCA if it still can't renew |
expired | The license has lapsed. Administrators see a red banner | See below |
Learners never see these banners.
When a license lapses
A license lapses if your agreement ends, or if your deployment has gone too long without being able to renew.
The core of ScamSafe keeps working. Learners can still take assessments and see their results, and all existing data is kept. These features switch off until the license is restored:
| Feature | While the license has lapsed |
|---|---|
| The tutor | Unavailable. Learners see a message that the tutor isn't available right now |
| The roadmap builder | Unavailable. Learners can't build new roadmaps, but can keep working through one they already have |
| Your branding | The site shows the standard ScamSafe branding. Your branding, logos and their history are not deleted, and administrators can still see them in the admin panel |
| Editing branding | Unavailable. Administrators can still reset the branding to the default or remove a logo |
| Tutor content updates | Paused. The tutor's existing content stays in place |
Restoring a lapsed license
Contact your GCA representative to renew your agreement. Once it is renewed, your deployment picks up the renewal by itself, normally within an hour. You don't need to restart anything or change your configuration. Your branding comes back as it was, and the switched-off features return.
If the license lapsed because your deployment couldn't reach the license server, restore its outbound access to scamsafe.license.globalcyberalliance.org and it will recover in the same way.
Your changes to the tutor's content
You can edit or remove entries in the tutor's glossary and personas from the admin panel. When GCA publishes an update, your deployment applies it without overwriting your changes: entries you have edited keep your version, and entries you have deleted stay deleted. New entries from GCA are added.
If you want to discard your changes and return to GCA's current content, use the import option on the glossary or personas page in the admin panel. This replaces the whole set with GCA's version.
Common problems
| Problem | What to check |
|---|---|
| The server won't start and reports that a license key is required | LICENSE_KEY is set in the server's environment |
The state is expired straight after a new installation | LICENSE_SERVER_URL is correct, and the deployment can make outbound HTTPS connections to the license server. The server logs a warning beginning License refresh failed with the reason |
The state is expiring | The same checks as above. If the deployment can connect and the problem continues, contact GCA |
| The tutor's glossary or personas are empty | The deployment can reach the license server. If someone deliberately emptied them, use the import option in the admin panel to restore GCA's content |
For anything else, contact your GCA representative with the time of the problem and any warnings from the server's logs. Never include your license key in a support request.