TRISTRA licence
Tristra Community is licensed under the TRISTRA Free Edition Licence version 4.6, shown below. It is accepted during setup, on behalf of your organisation. The same text is in the documents archive, as docs/legal/LICENCE_AGREEMENT.md.
TRISTRA Free Edition Licence
Version 4.6, 30 October 2026
Free for your organisation’s own business use. No subscription, usage reports or routine licence audits. You control your data. This licence does not cover providing assessment services to clients.
1. Who this licence is for
1.1 This licence is between Pike & Quill Consulting Ltd, registered in England and Wales with company number 16745602, of c/o Kings Accountancy Ltd, Front Warehouse, Haigh Industrial Estate, Ross-on-Wye, HR9 5NG (we, us), and the organisation accepting it (you).
Our public contact, legal-notice, privacy and security email is support@pikeandquill.co.uk.
1.2 You accept by an affirmative acceptance action in our setup or download process, after receiving an opportunity to read and retain this licence and the Edition Schedule version 4.6 dated 30 October 2026. The individual accepting must be authorised to bind you. Downloading alone, silence or a preselected box is not acceptance. We will make the accepted documents available to retain and record their version and the acceptance.
1.3 This licence is for business and professional use, including public-sector and charitable operations. An organisation means one company, other legal person, or an individual acting as a sole trader. It includes that person’s departments, branches and sites, but not separate group companies. It is not an offer for personal consumer use and does not exclude any mandatory rights that apply despite that intended restriction.
1.4 Software means the TRISTRA proprietary software, documentation and updates we supply under this licence. Third-party components and data feeds have their own terms under clause 5. Your Data means information you put into the Software and the findings, reports and other outputs it generates for you, excluding the underlying Software and independently licensed feed content.
2. What you may do
2.1 We grant you a non-exclusive licence, without a fee, to install and use the Free Edition for your own internal operations. This includes commercial business use. The licence continues for versions lawfully supplied and accepted under it unless terminated under clause 10. It may be transferred only under clause 12.3 and may not be sublicensed.
2.2 You may run one production installation, one standby installation, and up to ten active projects, as explained in the Edition Schedule. There is no contractual asset limit. You may make reasonably necessary backup and archive copies, preserving proprietary notices. A hosting provider may supply infrastructure on your behalf; you remain responsible for the installation.
2.3 Your staff and contractors may operate the Software for your internal operations, subject to your authority and confidentiality arrangements. You are responsible for their use as if it were your own. Their permission ends when their engagement or authority ends. They obtain no independent right to use this installation for other customers.
2.4 You may use and share your lawfully generated reports and findings for your own business purposes, including with auditors, insurers, regulators, advisers and contractors. These rights survive termination, subject to third-party rights and confidentiality. You may not use outputs to reconstruct and redistribute our proprietary detector or remediation corpus.
2.5 You may evaluate and compare products, test the security and performance of your installation, and publish honestly held opinions and accurate benchmark results without our approval. You must have authority for the testing and must not disclose confidential information or another person’s data without permission. No restriction is imposed on independent development that does not misuse our intellectual property or confidential information.
3. Limits that protect the product and other people
3.1 This licence does not permit assessing another organisation’s systems as a service, whether paid or unpaid; reselling or distributing the Software; white-labelling or embedding it; or providing hosted software access to clients. An appropriate Professional Contract Licence is required for a named client engagement. Multi-client and managed-service rights require a separate agreement if offered. A contractor operating your installation solely for your own estate under clause 2.3 is permitted.
3.2 You must not knowingly bypass edition or project limits, falsify licence information, remove proprietary notices, use stolen keys, or extract and redistribute the proprietary detector, matching or remediation corpus. Legitimate installation, configuration, backup, migration, disaster recovery, authorised security testing and third-party component replacement are not deliberate evasion merely because they incidentally affect installation identifiers or licence state; you must correct any resulting excess use within a reasonable period after discovering it.
3.3 Except as permitted by clause 5, you must not modify proprietary executable code or reverse engineer it to obtain source code or protected content. Configuration and extensions through documented interfaces are permitted. You must use the Software lawfully and have all authority needed to collect inventory from and assess the systems concerned.
3.4 You must comply with export controls and sanctions applicable to your use, export, re-export or provision of the Software. You must not make it available to a person or destination where doing so is prohibited by applicable law. This is a compliance obligation, not a warranty that you can determine every sanctions designation or ownership chain without reasonable enquiry.
4. Data, privacy and confidentiality
4.1 As between us, you retain all rights in Your Data. You grant us no right to use it except as necessary for assistance you request and expressly authorise. We will not use it to train AI models or advertise to your users without a separate express agreement.
4.2 The Free Edition has no telemetry, produces no licence usage reports and does not contact us for licence verification. It runs on infrastructure under your control. Outbound connections are for feeds you enable and destinations and services you configure. Information you voluntarily send to us, including a support or security report, is separate from normal operation.
4.3 Each party must comply with applicable data-protection law. Do not send credentials or unnecessary personal data. If we agree to process personal data on your behalf, the Support Data Processing Terms version 4.6 must be supplied and incorporated in the written engagement before access. They do not create an entitlement to support.
4.4 Each party must protect the other’s information that is marked confidential or is reasonably understood to be confidential, using reasonable care and using it only for this licence or agreed assistance. Disclosure is permitted to personnel and advisers who need it and are subject to confidentiality, or where required by law. Where lawful, give reasonable notice before compulsory disclosure. These duties do not cover information already lawfully known, publicly available without breach, independently developed, or lawfully received without a duty of confidence. They last five years after termination and, for trade secrets and retained personal data, while their nature or applicable law requires protection. This clause does not restrict permitted reports, reviews or statutory disclosures.
5. Ownership, third parties and statutory rights
5.1 Intellectual property rights in the Software remain with their respective rights holders; no ownership transfer to you is made. No source-code delivery is promised beyond rights under third-party licences. We give no separate contractual warranty of non-infringement or third-party clearance under this Free licence. Nothing in this clause excludes an obligation concerning title or authority that cannot lawfully be excluded, or represents that we can license rights we do not hold.
5.2 Third-party components and feeds are governed by the licences and terms identified in the notices and source register supplied with the Software. Those licences prevail for the relevant component or feed where they grant different rights. You must comply with applicable attribution and redistribution conditions. We cannot guarantee independent publishers’ feed accuracy or continued availability.
5.3 Nothing in this licence restricts acts or rights which cannot lawfully be restricted, including necessary backup copies, qualifying interoperability decompilation and observing, studying or testing under sections 50A, 50B, 50BA and 296A of the Copyright, Designs and Patents Act 1988. Other lawful-user rights apply according to their statutory conditions. You may ask us for interoperability information but need not do so as an additional condition to exercising a statutory right.
5.4 Without limiting other third-party rights, you may replace or modify LGPL libraries and reverse engineer the combined work to debug those modifications to the extent required by the applicable LGPL. The relevant notices and source or relinking materials must accompany the distribution as required by those licences.
6. Maintenance and security
6.1 Free includes no support service, guaranteed update, security-fix deadline or minimum maintenance period. We may publish updates and community guidance. You remain responsible for configuration, updates, access control, backups and recovery testing.
6.2 We will identify any versions for which we offer security maintenance and any stated end date in our published maintenance information. An existing express maintenance commitment will not be shortened without at least 90 days’ notice, unless law or an urgent security issue reasonably prevents it. This does not require us to establish a maintenance programme or maintain every old version. A fix may require upgrading.
6.3 The Software assists assessment; it cannot find every vulnerability, ensure compliance or guarantee security. Matching is deterministic for a given Software version, detector set, configuration, inventory and feed snapshot: materially identical inputs are intended to produce the same result. Deterministic does not mean complete or infallible. Results depend on the completeness and accuracy of collected inventory, detector coverage and correctness, product identification, configuration, and the availability, accuracy and freshness of upstream vulnerability information. Findings may contain errors or omissions, and the absence of a finding does not establish that a system is free from vulnerabilities. You must review the supporting evidence and apply professional judgement to security decisions. Subject to mandatory legal rights, Free is supplied as available without a contractual promise of uninterrupted, error-free or particular-purpose performance.
7. No subscription or routine audit
7.1 We do not require routine licence-compliance reports, compliance records, access to your systems or premises, or payment for contractual licence audits. The Professional agreement’s reporting and audit provisions do not apply.
7.2 Accepting or using Free does not create a paid subscription. If we reasonably believe your use is outside this licence, we will describe the issue and evidence in writing. For a first good-faith breach corrected within 30 days, we waive historical licence charges and monetary claims arising solely from that excess use. You may stop the affected use or separately agree an appropriate licence; you do not have to buy one.
7.3 The waiver does not cover deliberate evasion, knowing infringement, repeated misuse after notice, unauthorised access to others’ systems or harm to third parties. For those matters, lawful remedies remain available, subject to clause 9. No retrospective subscription, undisclosed list-price charge or double recovery is imposed by this licence. Urgent harmful or unlawful activity may need to stop immediately under clause 10.
8. Third-party claims
Neither party gives the other a contractual indemnity under this Free licence. Claims remain subject to clause 9 and to any right that cannot lawfully be excluded. We do not promise to defend a third-party IP claim under this licence.
9. Liability for the Free Edition
9.1 Nothing excludes or limits liability for death or personal injury caused by negligence; fraud or fraudulent misrepresentation; any obligation as to title or authority which cannot lawfully be excluded or limited; or any other liability that cannot lawfully be excluded or limited. This protection overrides every exclusion below.
9.2 Free is supplied without a licence fee and without paid support, a performance warranty or an IP-defence undertaking. Subject to clauses 9.1 and 9.3 and to the fullest extent permitted by applicable law, Free is supplied as available, without warranty, and we will not be liable to you for any loss or damage arising out of or connected with the Free Edition, this licence, or the use, inability to use or nature of the Software, whether in contract, tort (including negligence), misrepresentation, breach of statutory duty or otherwise. This includes loss caused by a failure to detect a vulnerability, inaccurate results, interrupted use, loss or corruption of data, and response or restoration costs.
9.3 The exclusion in clause 9.2 and the cap in clause 9.4 do not apply to a party’s knowing infringement of the other’s intellectual property or intentional circumvention of agreed licence limits to obtain use it knows is unauthorised. Ordinary mistakes, reasonable security testing, and backup or recovery errors do not by themselves meet that test. This exception does not override clause 5 or make lawful acts actionable.
9.4 Subject to clauses 9.1 and 9.3, each party’s total aggregate monetary liability connected with the Free Edition and this licence is £100 across all installations and versions accepted under it. For us, this cap applies to any liability that clause 9.2 does not exclude, including where clause 9.2 is held ineffective in whole or in part; it is a separate limit and continues to apply if clause 9.2 fails. This cap does not create any payment obligation on us or on you merely because the licence is accepted.
9.5 Each exclusion and limit is separate and applies only to the extent lawful. Nothing restricts non-monetary enforcement of an existing obligation, statutory component rights, data subjects’ rights, regulatory powers or duties owed to third parties. The licence cannot prevent an independent rights holder bringing its own claim. Each party must reasonably mitigate loss and there is no double recovery. The first-good-faith-mistake waiver in clause 7.2 continues to apply. Any separately agreed support engagement may expressly replace this allocation for that engagement; no such replacement arises merely from accepting Free.
10. Duration, changes and ending use
10.1 You may end this licence at any time by stopping use and deleting your Software copies, subject to clause 10.4. No notice or deletion certificate is required for ordinary voluntary departure.
10.2 Either party may terminate for the other’s material breach which is irremediable or remains uncorrected 30 days after written notice describing it and the required remedy. For a remediable breach you are diligently correcting, we will consider a reasonable extension. We may require the affected use to stop immediately, or terminate immediately where necessary, for knowing unlawful access, deliberate evasion or another irremediable material breach posing material harm. Measures must be proportionate; an ordinary licence mistake receives the correction opportunity in clause 7.2.
10.3 We may discontinue new Free downloads or change future offers on at least 90 days’ published notice. We cannot withdraw your right to use an accepted version merely because we change our offer. Different terms for a future version require your affirmative acceptance; security updates for that accepted version do not themselves amend this licence. No term change applies retrospectively.
10.4 On termination, stop new assessments. For 90 days you may use the existing installation solely to read and export existing data, then uninstall and delete Software copies except a legally required archive copy. The Software will not delete Your Data because a licence ends. You may retain Your Data and lawfully generated outputs. Statutory third-party component rights continue independently.
10.5 Accrued rights and clauses concerning data, confidentiality, ownership, outputs, liability, disputes and this exit permission survive as needed to give them effect.
11. Free and Professional together
11.1 A signed Professional Order replaces this licence for the installation and period that Order covers. Other Free installations remain under this licence. No paid obligation arises without the signed Order.
11.2 On paid expiry, internal use may continue under this Free licence if it was previously accepted or is then affirmatively accepted, and the use qualifies within Free limits. A client deployment does not become authorised merely because the Software falls back to Free functionality. The paid agreement provides its own exit rights.
12. General and disputes
12.1 This licence and the supplied Edition Schedule are the entire agreement for Free use. This licence prevails over the Schedule for legal terms; the Schedule defines technical entitlements. Neither can override mandatory law or third-party licence rights. Marketing statements are not security guarantees, but nothing excludes liability for actionable misrepresentation or an expressly agreed written commitment.
12.2 Changes to an accepted licence require both parties’ express written agreement or acceptance under clause 10.3. Failure to enforce a right is not a waiver. An invalid provision is severed only to the extent needed; the remainder continues. No third party acquires enforcement rights under the Contracts (Rights of Third Parties) Act 1999.
12.3 You may transfer this licence to a solvent successor to substantially all the relevant business, with written notice, provided it accepts these terms and you cease using the transferred installation. Other transfers need our reasonable consent. We may transfer it with substantially all the relevant product business if the successor assumes our obligations and your rights are not reduced. Each party remains responsible for its contractors.
12.4 Notices may be sent to a notice email expressly designated in the acceptance record or later notified, or to the receiving party’s registered office or stated business address. Our address is in clause 1.1 and notices to us may be emailed to support@pikeandquill.co.uk. Email is received on the next Business Day after transmission unless a failure notice is received; tracked post is received on recorded delivery. A Business Day excludes weekends and public holidays in England. Provide usable contact details when accepting. This clause does not govern court documents.
12.5 Before court proceedings, give written particulars of a dispute and allow 20 Business Days for a good-faith attempt to resolve it. This does not prevent urgent relief or a protective filing to preserve a limitation period. Either party may seek appropriate interim relief. English law governs this licence and related non-contractual claims; the courts of England and Wales have exclusive jurisdiction, subject to mandatory rights.
TRISTRA Edition Schedule
Version 4.6, 30 October 2026
This Schedule accompanies the TRISTRA Free Edition Licence or Professional Subscription Agreement version 4.6, as applicable. It defines technical scope; the relevant agreement governs legal rights and remedies. A signed Professional Order may vary technical quantities expressly. Only Free and Professional are included. A feature described as planned is not a purchased entitlement.
1. Entitlements
| Item | Free Edition | Professional Edition |
|---|---|---|
| Price | No fee; no automatic subscription | Fees agreed in a signed Order |
| Permitted use | Internal business operations of one legal entity | Internal Licence for named entities, or Contract Licence for a named client engagement |
| Separate group companies | Each needs its own qualifying Free installation or an appropriate paid licence | Covered only if expressly named in an Internal Order; client scope as stated in a Contract Order |
| Production installations | One | As stated in Order; one if omitted |
| Standby | One for that production installation | One per production installation unless Order varies it |
| Active projects | Ten per production installation | Twenty-five per production installation unless Order expressly varies it |
| Contractual asset limit | None | Asset Band stated in Order |
| Overage | Not applicable | Default 20% operational tolerance; temporary excess and fees governed by Professional clause 7 |
| Licence file | Not required | Signed, installation-bound, checked offline |
| Usage reports and compliance audits | None contractually required | Professional clauses 7–8; annual delivery normally, not quarterly by default |
| Updates | Discretionary; no guaranteed maintenance | Applicable generally released updates during term under Professional clause 9 |
| Personal support | Not included | Only as specified in an attached Order support specification |
| Term | Continued accepted-version use, subject to the Free Licence | Agreed subscription; no automatic renewal unless expressly selected |
| Liability | Free Licence clause 9 | Professional clause 14; no separate cap created by this Schedule |
2. Counting and infrastructure
2.1 A production installation is one operational TRISTRA deployment identified by its installation identifier. The database, workers and other services of that single deployment are not separate installations merely because they run in separate containers. Independently operational deployments count separately.
2.2 A standby installation is a copy used for backup, testing, disaster recovery and failover, not as additional routine production capacity. Temporary overlap reasonably necessary for a failover, migration or recovery exercise is permitted; stop duplicate operational use promptly after completion. Repeatedly alternating systems to increase licensed production capacity is not standby use. Reasonably necessary inactive backup and archive copies do not count as additional production installations.
2.3 An active project is a project enabled in the Software for new runs or inventory imports. Archiving or pausing a project removes it from the active-project allowance only where the Software disables those activities. It remains available for permitted reading/export. Renaming or deleting a project does not erase already accrued charges or assessment obligations. Technical actions must genuinely stop new work to release a slot.
2.4 An Active Managed Asset is a distinct host identified by its external host identifier in a project, for which the Software recorded evidence in the preceding 90 days. Agent and agentless evidence using the same identifier within one project count once. The same host recorded in different projects counts once in each project. Different identifiers may count separately; follow documentation to avoid duplicates. Asset Bands apply per production installation unless the Order expressly pools them and states the counting method. Removing a host from current assessment does not erase its recorded 90-day activity; the temporary-excess allowance must be assessed using this counting method.
2.5 The default 20% tolerance affects when the Software records an over-band state; it is not permanent purchased capacity or an automatic fee. Professional clause 7 provides a 30-day opportunity to correct temporary excess and limits charges to evidenced sustained excess at the agreed rate. No deletion of customer data is authorised to enforce an Asset Band.
2.6 Asset-band enforcement, project enforcement and contracted permission are distinct. Technical ability to run a function is not permission to use it beyond the agreement. Conversely, a technical licence-file error does not reduce contracted rights; request correction.
3. Examples of permitted use
- A retailer’s IT, finance and logistics departments share its Free installation within ten active projects: permitted if they form one legal entity.
- A separate sister company uses that same Free installation: not covered. It can obtain its own Free licence for its own installation, or be named under a Professional Internal Order.
- A consultant operates a retailer’s installation solely for that retailer’s internal estate under the retailer’s licence: permitted. The consultant receives no right to reuse it for other customers.
- A consultancy uses Free to secure its own office estate: permitted. It uses TRISTRA to assess Client A’s estate as a service: requires a Contract Licence.
- A Contract Licence serves Client A under the named engagement and its agreed extensions, using a dedicated installation: permitted. Client B needs another licence and installation.
- The consultancy’s own office is assessed on its Client A installation: not permitted; use a separate qualifying Free or Internal installation.
- The named client reads and exports its reports through authorised accounts: permitted. Other client operating rights require the Order to specify them.
- A cloud provider hosts infrastructure for a licensed dedicated deployment: permitted. A supplier offers a shared TRISTRA portal to multiple clients: not included.
4. Capabilities
4.1 Both editions. The complete core matching engine; inventory from Elastic and osquery documents, CSV, offline bundles and agents with manual enrolment; findings, triage and statuses; coverage statements and remediation guidance; current CycloneDX SBOMs; basic 12-check hardening overview; findings CSV and JSON exports and basic PDF summary; manual sends and manual CTI imports; automatic delivery to configured destinations after runs; automatic CTI synchronisation and polling; integrations catalogue; and local, LDAP, Keycloak, generic OIDC and SAML sign-in with TOTP MFA. Assessment accuracy and security controls are the same in both editions. These are capabilities of the supplied supported product, not promises that external integrations or feeds never change.
4.2 Professional additionally includes:
| Capability | Free retains |
|---|---|
| Cross-project risk overview | Each project’s exposure summary |
| History views beyond 30 days and comparisons | Current state and 30-day history views, including 7-day changes and transitions |
| Deadline policies and tracking | KEV due dates as factual context |
| Full PDF/DOCX report pack with appendices | CSV/JSON exports and basic PDF summary |
| Assigned hardening baselines, per-host results, drift and export | Basic 12-check overview |
| CMDB owners, service links, dependencies and impact | Hosts, findings and triage |
| Historical host SBOMs and differences | Current host/project SBOM |
| Twenty-five active projects | Ten active projects |
4.3 Planned, not included until released and expressly included in a supplied Schedule or Order: scheduled collection and connector automation for both editions; remediation assignment, risk-acceptance workflow and agent fleet management for Professional. No commitment to a delivery date arises from this list.
4.4 Enterprise, MSSP, shared multi-client services, customer branding, service roll-ups across client instances, retention-policy/legal-hold management and SCIM are not included. Future availability requires separately agreed rights. Describing a feature here does not license prohibited service-provider use.
5. Licence files, reports and expiry
5.1 The Professional licence file records the edition, customer, installation identity, Asset Band, tolerance, dates and grace period. The Order controls the licence type, additional entities and client engagement even if a descriptive field is not shown in the Software. Vendor signing keys are bundled; verification does not require contacting us.
5.2 Professional usage reports are generated locally, signed and chained. Their intended fields are licence and installation identifiers, counts of active assets, ingestion runs and open findings, enforcement state and keyed pseudonymous asset identifiers. They are designed not to include host names, addresses, credentials or finding text. The Licensor must supply the actual field specification and secure delivery instructions before the first report-delivery obligation becomes due; the delivery deadline is extended as reasonably necessary if those materials are late. No additional data fields may be required by a unilateral format change without the customer’s agreement. Report handling and permitted purposes are governed by Professional clause 7. Pseudonymisation is not a promise that all data-protection obligations disappear. Free produces no usage report.
5.3 At ordinary subscription expiry, Professional functionality continues for 30 days as a grace period; no renewal fee or new term is created by grace alone. Grace permits the previously licensed purpose, except that a client engagement which has ended does not authorise new assessments. Grace does not apply following termination for breach unless agreed in writing. A scheduled licence-file end date is not evidence of a continuing contractual right after termination.
5.4 After grace, Professional-only capabilities stop and Free technical limits apply. Stored results remain readable and exportable, no data is deleted because of expiry, and the newest active projects exceeding five are paused for new runs/imports until capacity is available or a valid paid licence is installed. Limiting history views must not prevent export of existing stored customer data during an agreed exit period; access to existing data does not require generating new premium reports.
5.5 Contractual read/export permission lasts 90 days from paid expiry or termination, with no automatic extension of the subscription. After that period, continued use requires eligible Free rights or a renewed paid licence. A client’s installation does not acquire lawful assessment rights merely because it technically falls back to Free. Lawful generated reports and independently held customer data may be retained under the agreement.
5.6 Licence-page expiry warnings are expected 30, 14 and 7 days before the file end date, with capacity warnings at the Asset Band and tolerance threshold. These technical notices do not replace contractual renewal, billing or breach notices. A warning failure does not automatically create a renewed subscription or waive a contractual correction period.