How Seatlock protects your software, what it stores, and what we do not claim.
What protects a licence
- Digitally signed licences. Your shop signs every licence with its own private key (Ed25519). Your plugin accepts only licences with a valid signature from your shop, so a licence cannot be forged or edited.
- Your keys stay with you. The signing keys are created on your own server and kept outside its web folder. They never reach us, and we cannot see them.
- Encrypted DSP constants. The values your sound engine depends on are encrypted in your build. They can be used only while a valid licence is present.
- Machine seats. Each licence is bound to a limited number of machines. Your customers can free a machine themselves.
- Time-limited offline use. A licence works offline for up to 14 days, then needs a short online renewal. A licence you revoke stops working at the next renewal.
- Refunds close licences. A refund or a lost payment dispute ends the licence automatically.
What your shop stores and what the plugin sends
Everything stays on your server. Seatlock sends nothing to us.
- On activation, the plugin sends your shop the licence key, the product, the plugin version, the operating system, a machine label the customer can see in their account, and a hashed machine identifier. The identifier is a one-way hash, so the real hardware ID never leaves the computer.
- Your shop stores licences (keys are stored only as hashes), machines, and an audit log of activations and administrative actions.
- Your customers’ personal data is whatever your WooCommerce shop already holds. Seatlock adds no tracking and no analytics.
What we do not claim
No licensing system can make software impossible to crack. Software that runs on a computer the attacker controls can eventually be taken apart. Seatlock is built to make sharing a licence pointless, to make cracking expensive, and to keep honest customers working, also offline.
How we build it
- Every release runs 1,708 automated checks, including an attack suite that tries to break into every screen and every public function.
- The release process refuses to build a package that contains a key, a password or an unfinished document.
- Every copy we deliver carries its own licence ID.
Report a security problem
If you have found a way to defeat Seatlock’s licensing, to read something you should not, or to break a site that runs it, please tell us before anyone else: security@seatlocklicense.com.
- We reply within three working days, and send an assessment within ten.
- Please give us reasonable time to fix a problem before you publish it; 90 days is the usual figure.
- Test only against your own installation. Within those limits, we will not pursue you for the research.
The full policy is in SECURITY.md in every package. Security teams can also find us through security.txt.