Built by a team who needed this — and couldn't find it.
PermitCore started as an internal tool. We were building software products, needed license management, and found that every existing option was either too expensive, too complex to integrate, or treated license keys as plaintext in a database. That last one bothered us a lot.
"We couldn't find a license server where we could look the database admin in the eye and say: your keys are genuinely safe even if you get breached. So we built one."
What makes us different
The core insight behind PermitCore is simple: a license server should never need to store the actual license key value. AES-256-GCM encryption happens in your browser before storage — plaintext keys are never persisted, so a database breach never exposes usable keys. When a customer's app calls the validation endpoint, it does send the plaintext key over the wire (that's how validation works), but the server hashes it, checks it against the stored value, and doesn't keep what it received.
Everything else — the white-label store, the analytics, the webhook integrations, the offline activation tokens — grew from the same principle: give software teams the tools they need, without creating new security risks to manage.
What PermitCore is, honestly
We are
- A focused license management platform
- Zero-knowledge on license key storage
- Self-hostable on Enterprise tier
- Built in the EU, EU-hosted, available worldwide
- Designed to support GDPR obligations, with a real DPA
- Built to last: minimal dependencies, long-lived API design
We are not
- A VC-backed startup chasing growth at all costs
- Planning to add AI features to every button
- Going to change our pricing without warning
- Hiding limits in fine print
- Collecting more data than we need to operate
Tech stack (in the spirit of transparency)
We run on .NET 10, PostgreSQL, and Blazor WebAssembly. Nothing exotic. The stack was chosen for longevity and correctness, not to impress engineering blogs. The cryptography is Web Crypto API in the browser (PBKDF2 + AES-GCM), standard APIs that will outlive any JavaScript framework.
Infrastructure runs on servers physically located in the EU. See Security → Infrastructure and data residency for exactly what that covers.
Contact
General: [email protected]
Security: [email protected]
Legal: [email protected]