You ship software. License logic is not your core product.
Homegrown checkers become a second product that blocks your roadmap.
Axix Hawk
Software licensing & deployment security
Your software. Your rules.
Machine-locked licensing. Tamper-proof deployment. Remote kill-switch. One platform.
Ship on-prem software with hardware-locked licenses, signed Docker images, and a remote kill-switch — so every copy runs on your terms.
- RSA-2048 signed licenses
- AES-256-GCM key encryption at rest
- Row-level security — zero cross-tenant leakage
- SOC 2-ready audit trails
Trusted by software teams at
- RSA-2048 signed licenses
- AES-256-GCM key encryption at rest
- Row-level security — zero cross-tenant leakage
- SOC 2-ready audit trails
- OT-ready air-gapped mode
License enforcement is harder than it looks.
SaaS enforcement fails on-prem.
Desktop, appliance, factory floor, and air-gapped sites cannot rely on cloud-only checks.
One leaked key destroys revenue.
Without RSA signing + machine binding, one key unlocks infinite installs.
No remote control after ship.
You need revoke, renew, and audit without a site visit.
How Hawk works
From SDK embed to licensed deployment in three steps — no fragile license keys, no honor system.
- 01
Register & embed SDK
Define your product in the Hawk console and embed our lightweight client libraries. Most teams ship in under 15 minutes.
- 02
Deploy to client hardware
Push a signed, distroless Docker image. Each license is cryptographically bound to the client machine fingerprint — not a reusable key.
- 03
Control from one dashboard
Renew, revoke, and monitor every deployment. Heartbeats every ~30 minutes; revoke takes effect within one cycle. Full audit trail.
Five layers of enforcement
Defense in depth — from silicon to signed container to live revocation. Each layer independent; all required.
Real-time heartbeat & revoke
Products phone home. Revoke once — every instance stops within one heartbeat cycle. Grace period for offline clients.
Distroless Docker + seccomp
No shell, no package manager, syscall whitelist. Images signed with cosign; unsigned containers refuse to start.
JWT / Keycloak auth
SSO for end users. Tokens bound to machineId — valid JWT on the wrong hardware is rejected.
RSA-signed license file
Signed blobs with org, product, tier, features, expiry. Embedded public key — no server needed to verify offline.
Hardware fingerprint lock
SHA-256 of stable host signals. Licenses cannot be copied to another machine without re-issuance.
Everything ISVs need to ship with confidence
Machine-locked licensing
Hardware fingerprint — not a reusable serial key.
Remote kill-switch
Revoke from the console — enforcement within one heartbeat.
Tamper-proof images
Distroless runtime, signed images, no shell to strip licensing.
Unified auth
Keycloak SSO, JWT validation, org and tier claims.
Automated expiry
Reminders before cutoff — hard stop on SDK and server.
Full audit log
Append-only trail of generate, revoke, deploy, and anomalies.
On-prem agent
Lightweight daemon: offline verify, heartbeat, local status API.
Client SDKs
Embed feature gates, status callbacks, and machine ID helpers.
Webhooks
license.issued / revoked / expired / renewed — HMAC-signed.
White-label console
Branded vendor dashboard for seats, clients, products, licenses.
Air-gapped mode
Fully offline verification with offline TTL for plants and OT.
Falco runtime detection
Shell-in-container, ptrace, and license exfiltration alerts.
Built for how you sell software
Pick the motion that matches your go-to-market — Hawk adapts the same core controls.
Clients can't run unlicensed copies
Problem. You ship Docker images to customer servers. Without hardware binding, a single license key becomes a torrent.
Hawk. Binds each license to a fingerprint and ships obfuscated, distroless images. Revoke remotely; the product stops.
Explore solution →Coming soon · Pipeline
OT SECURITY OPERATIONS
World-class SIEM & SOAR — built for OT, included in Hawk's roadmap
Industrial plants need more than IT tools. Axix Hawk's upcoming OT SIEM and OT SOAR modules will collect ICS protocol events, correlate them with license and Falco signals, and automate safe response playbooks — aligned with IEC 62443 thinking.
- ICS protocol awareness (Modbus, DNP3, OPC-UA, S7comm — planned)
- Purdue-model oriented visibility
- Playbooks: license tamper → revoke + isolate (with human-in-the-loop for safety)
- Unified with Hawk licensing + runtime detection
SIEM and SOAR modules are in the development pipeline. Core licensing, agent, Falco, and audit are available today.
One platform for licensing control
Axix Hawk keeps every on-prem copy on your terms — from first bind to emergency revoke.
- Machine-locked licenses, not reusable serials
- Remote kill-switch with heartbeat enforcement
- Tamper-resistant delivery for field runtimes
Built for how ISVs actually ship
Whether you deliver appliances, private SaaS, or integrator packs, Hawk maps to the motion.
- Client orgs and products modeled in one console
- Webhooks into billing and support tools
- Honest pipeline labels for OT SIEM/SOAR
Security reviewers can verify
Give buyers evidence instead of slideware.
- Append-only audit of generate and revoke
- Runtime detection for hostile client environments
- Air-gap friendly offline verification
Start free — validate in days
Open a Hawk trial and run the bind / revoke checklist on your own workload.
- No credit card to begin
- Trial scoped to this product
- Talk to us when you need Enterprise controls
FAQ
Quick answers before you start.
ISVs, SaaS teams shipping on-prem runtimes, enterprises locking internal tools, system integrators, and industrial operators.
Ready to control your software?
Join ISVs who ship on-prem without losing control. Setup takes 15 minutes — we will send you access credentials.
No credit card required · Cancel anytime · Setup in 15 minutes
Product visuals
Three console views and three real-world moments for this page — each with a full caption.
Console view for Home: license inventory, bind status, and org filters in one workspace. Operators scan Active versus Revoked rows, confirm machine fingerprints, and jump into a client without leaving the grid. Search and column controls keep large fleets readable. This frame is unique to this page so the visual story matches the URL you opened.
Second dashboard for Home: heartbeat health, revoke timing, and anomaly hints sit side by side. Use it to brief security on what “one heartbeat” looks like before a PoC. Charts stay light-themed with navy accents for Axix Hawk. Nothing here is reused from another marketing route.
Third console moment for Home: deployment analytics and seat pressure across client orgs. Leaders see where licenses concentrate and where renewals are due. Export-friendly layout supports review packs. Paired with this page’s copy so buyers never see a generic stock screen.
People moment one for Home: practitioners reviewing Hawk controls in a real workspace. The scene grounds licensing talk in day-to-day operations instead of abstract icons. Lighting and wardrobe stay professional and brand-safe. Captured specifically for this page’s narrative so visitors never confuse it with another product route.
People moment two for Home: collaboration around ship-or-hold decisions after a revoke drill. Teams align on evidence — bind failure, kill-switch timing, audit export — before a customer demo. Atmosphere matches Axix Hawk’s light navy product language. Unique to this route’s gallery.
People moment three for Home: field or office context for how this capability lands with buyers. Use it to show human stakes behind machine-locked software. Composition avoids logos and keeps faces secondary to the work. Written and imaged only for the Home page experience.