Polliog · Oct 19, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -18,6 +18,10 @@ or background job (see `docs/security/tenant-isolation-audit.md`):
 
 <!-- If a change is intentionally cross-tenant (admin / platform), say so here. -->
 
+## Contributor License Agreement
+
+- [ ] I have signed the CLA (<https://cla-assistant.io/logtide-dev/logtide>) and my commits use an email linked to my GitHub account.
+
 ## Testing
 
 <!-- how this was verified -->
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -42,6 +42,14 @@ For larger changes (new storage engine methods, schema changes, changes to the i
 
 Keep each pull request focused on one problem: no unrelated refactors, dependency upgrades or formatting churn in the same PR.
 
+#### Contributor License Agreement
+
+Before your first pull request can be merged you need to sign the Contributor License Agreement (CLA). A bot posts a comment on your first PR with a link; read the agreement text it shows, then sign by commenting as the bot asks. You sign once, for all your future contributions. You can also sign ahead of time at <https://cla-assistant.io/logtide-dev/logtide>.
+
+The bot recognises you through the email address on your commits, so **commit with an email address that is linked to your GitHub account** (check it under GitHub Settings, Emails). Commits made with an unlinked email cannot be matched to your account and the CLA check will stay pending.
+
+Contributions to the core are licensed under the AGPLv3 like the rest of the code. LogTide is open core, and the CLA also allows the maintainer to use contributions in commercial editions. See the agreement text shown by the bot for the exact terms.
+
 ## Development Setup
 
 ### Prerequisites

diff --git a/README.md b/README.md
@@ -6,7 +6,7 @@
   </p>
 
   <p>
-    <a href="https://logtide.dev"><strong>☁️ Try Cloud (Free Beta)</strong></a> •
+    <a href="https://logtide.dev"><strong>☁️ Try Cloud</strong></a> •
     <a href="#self-hosting">Self-Host</a> •
     <a href="#sdks--integrations">SDKs</a> •
     <a href="https://logtide.dev/docs">Docs</a>
@@ -16,14 +16,14 @@
   <a href="https://codecov.io/gh/logtide-dev/logtide"><img src="https://codecov.io/gh/logtide-dev/logtide/branch/main/graph/badge.svg" alt="Coverage"></a>
   <a href="https://hub.docker.com/r/logtide/backend"><img src="https://img.shields.io/docker/v/logtide/backend?label=docker&logo=docker" alt="Docker"></a>
   <a href="https://artifacthub.io/packages/helm/logtide/logtide"><img src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/logtide" alt="Artifact Hub"></a>
-  <img src="https://img.shields.io/badge/version-1.3.2-blue.svg" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.4.0-blue.svg" alt="Version">
   <img src="https://img.shields.io/badge/license-AGPLv3-blue.svg" alt="License">
-  <img src="https://img.shields.io/badge/status-beta-success.svg" alt="Status">
+  <img src="https://img.shields.io/badge/status-stable-success.svg" alt="Status">
 </div>
 
 <br />
 
-> **🌊 LogTide 1.3.2 (public beta):** unified **Logs, Traces & Metrics** with a built-in **SIEM**, multi-engine storage (TimescaleDB / ClickHouse / MongoDB), uptime monitoring, parsing pipelines, and custom dashboards.
+> **🌊 LogTide 1.4.0:** unified **Logs, Traces & Metrics** with a built-in **SIEM**, multi-engine storage (TimescaleDB / ClickHouse / MongoDB), uptime monitoring, parsing pipelines, and custom dashboards.
 
 ---
 
@@ -128,7 +128,7 @@ We host it for you. Perfect for testing. [**Sign up at logtide.dev**](https://lo
 
 ---
 
-## ✨ Core Features (v1.3.2)
+## ✨ Core Features (v1.4.0)
 
 ### Monitoring, Pipelines & Dashboards
 * 🩺 **Uptime Monitoring & Status Pages:** HTTP/TCP/heartbeat monitors with configurable thresholds, auto-created SIEM incidents on failure, scheduled maintenances, and public Uptime-Kuma-style status pages per project.
@@ -182,6 +182,8 @@ Ready-to-use SDKs with auto-instrumentation and distributed tracing.
 
 Distributed under the **GNU AGPLv3** License. See `LICENSE` for more information.
 
+Contributions require signing the [Contributor License Agreement](https://cla-assistant.io/logtide-dev/logtide); see `CONTRIBUTING.md`.
+
 ---
 
 <div align="center">

diff --git a/docker/.env.example b/docker/.env.example
@@ -102,3 +102,52 @@ DB_USER=logtide
 #   docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d --scale backend=3
 #
 # See docs: https://logtide.dev/docs/deployment#horizontal-scaling
+
+# =============================================================================
+# External billing handoff (optional, for hosted deployments)
+# =============================================================================
+# When BOTH are set, owners/admins see Upgrade / Manage billing buttons on the
+# usage page. Clicking one redirects to LOGTIDE_UPGRADE_URL with a short-lived
+# (10 minute) HMAC-SHA256 signed token (?t=...). The token never contains
+# LogTide session credentials. Setting only one of the two aborts startup.
+# URL must be https (http is allowed only for localhost / 127.0.0.1).
+# LOGTIDE_UPGRADE_URL=https://billing.example.com/portal
+# Min 32 characters. Generate with: openssl rand -base64 48
+# LOGTIDE_UPGRADE_SIGNING_SECRET=
+
+# =============================================================================
+# Hosting seams (optional, for operators hosting LogTide for others)
+# =============================================================================
+# Full reference: docs/cloud-seams.md. Everything below is off when unset.
+# (LOGTIDE_UPGRADE_URL and LOGTIDE_UPGRADE_SIGNING_SECRET are in the section above.)
+
+# JSON object overriding capability defaults for every org (entitlement rows
+# still win). Values: boolean, integer >= 0, or null for unlimited.
+# Invalid JSON, unknown capability or wrong type aborts startup.
+# CAPABILITY_DEFAULTS_JSON={"projects.max": 3, "quota.grace_percent": 10}
+
+# Static bearer (min 32 characters) letting an external billing service call the
+# org entitlements and retention admin endpoints. Generate: openssl rand -base64 48
+# LOGTIDE_ADMIN_SERVICE_TOKEN=
+
+# Max organizations one user may own (positive integer, unset = unlimited).
+# MAX_ORGANIZATIONS_PER_USER=3
+
+# Max organizations one user may create per UTC calendar month, even if they
+# delete them again (positive integer, unset = unlimited).
+# MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH=2
+
+# Make new local users confirm their email before creating projects or API keys.
+# Requires SMTP_HOST, otherwise startup fails.
+# REQUIRE_EMAIL_VERIFICATION=false
+
+# Extra per-IP cap on POST /auth/register per hour (positive integer, unset = off).
+# REGISTRATION_RATE_LIMIT_PER_HOUR=10
+
+# Require Terms of Service and Privacy Policy acceptance at registration (and
+# again whenever LOGTIDE_TERMS_VERSION changes). Set all three or none: a
+# partial set aborts startup. URLs must be https (http only for localhost).
+# Ingestion with existing API keys is never blocked.
+# LOGTIDE_TERMS_URL=https://example.com/terms
+# LOGTIDE_PRIVACY_URL=https://example.com/privacy
+# LOGTIDE_TERMS_VERSION=2026-10-19
diff --git a/docker/docker-compose.build.yml b/docker/docker-compose.build.yml
@@ -106,6 +106,18 @@ services:
       INTERNAL_DSN: ${INTERNAL_DSN:-}
       DOCKER_CONTAINER: "true"
       SERVICE_NAME: logtide-backend
+      # Hosting seams: empty = inert (see docs/cloud-seams.md)
+      CAPABILITY_DEFAULTS_JSON: ${CAPABILITY_DEFAULTS_JSON:-}
+      LOGTIDE_ADMIN_SERVICE_TOKEN: ${LOGTIDE_ADMIN_SERVICE_TOKEN:-}
+      LOGTIDE_UPGRADE_URL: ${LOGTIDE_UPGRADE_URL:-}
+      LOGTIDE_UPGRADE_SIGNING_SECRET: ${LOGTIDE_UPGRADE_SIGNING_SECRET:-}
+      MAX_ORGANIZATIONS_PER_USER: ${MAX_ORGANIZATIONS_PER_USER:-}
+      MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH: ${MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH:-}
+      REQUIRE_EMAIL_VERIFICATION: ${REQUIRE_EMAIL_VERIFICATION:-}
+      REGISTRATION_RATE_LIMIT_PER_HOUR: ${REGISTRATION_RATE_LIMIT_PER_HOUR:-}
+      LOGTIDE_TERMS_URL: ${LOGTIDE_TERMS_URL:-}
+      LOGTIDE_PRIVACY_URL: ${LOGTIDE_PRIVACY_URL:-}
+      LOGTIDE_TERMS_VERSION: ${LOGTIDE_TERMS_VERSION:-}
       STORAGE_ENGINE: ${STORAGE_ENGINE:-timescale}
       CLICKHOUSE_HOST: ${CLICKHOUSE_HOST:-clickhouse}
       CLICKHOUSE_PORT: ${CLICKHOUSE_PORT:-8123}
@@ -162,6 +174,18 @@ services:
       INTERNAL_DSN: ${INTERNAL_DSN:-}
       DOCKER_CONTAINER: "true"
       SERVICE_NAME: logtide-worker
+      # Hosting seams: empty = inert (see docs/cloud-seams.md)
+      CAPABILITY_DEFAULTS_JSON: ${CAPABILITY_DEFAULTS_JSON:-}
+      LOGTIDE_ADMIN_SERVICE_TOKEN: ${LOGTIDE_ADMIN_SERVICE_TOKEN:-}
+      LOGTIDE_UPGRADE_URL: ${LOGTIDE_UPGRADE_URL:-}
+      LOGTIDE_UPGRADE_SIGNING_SECRET: ${LOGTIDE_UPGRADE_SIGNING_SECRET:-}
+      MAX_ORGANIZATIONS_PER_USER: ${MAX_ORGANIZATIONS_PER_USER:-}
+      MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH: ${MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH:-}
+      REQUIRE_EMAIL_VERIFICATION: ${REQUIRE_EMAIL_VERIFICATION:-}
+      REGISTRATION_RATE_LIMIT_PER_HOUR: ${REGISTRATION_RATE_LIMIT_PER_HOUR:-}
+      LOGTIDE_TERMS_URL: ${LOGTIDE_TERMS_URL:-}
+      LOGTIDE_PRIVACY_URL: ${LOGTIDE_PRIVACY_URL:-}
+      LOGTIDE_TERMS_VERSION: ${LOGTIDE_TERMS_VERSION:-}
       STORAGE_ENGINE: ${STORAGE_ENGINE:-timescale}
       CLICKHOUSE_HOST: ${CLICKHOUSE_HOST:-clickhouse}
       CLICKHOUSE_PORT: ${CLICKHOUSE_PORT:-8123}

diff --git a/docker/docker-compose.simple.yml b/docker/docker-compose.simple.yml
@@ -94,6 +94,18 @@ services:
       INTERNAL_DSN: ${INTERNAL_DSN:-}
       DOCKER_CONTAINER: "true"
       SERVICE_NAME: logtide-backend
+      # Hosting seams: empty = inert (see docs/cloud-seams.md)
+      CAPABILITY_DEFAULTS_JSON: ${CAPABILITY_DEFAULTS_JSON:-}
+      LOGTIDE_ADMIN_SERVICE_TOKEN: ${LOGTIDE_ADMIN_SERVICE_TOKEN:-}
+      LOGTIDE_UPGRADE_URL: ${LOGTIDE_UPGRADE_URL:-}
+      LOGTIDE_UPGRADE_SIGNING_SECRET: ${LOGTIDE_UPGRADE_SIGNING_SECRET:-}
+      MAX_ORGANIZATIONS_PER_USER: ${MAX_ORGANIZATIONS_PER_USER:-}
+      MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH: ${MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH:-}
+      REQUIRE_EMAIL_VERIFICATION: ${REQUIRE_EMAIL_VERIFICATION:-}
+      REGISTRATION_RATE_LIMIT_PER_HOUR: ${REGISTRATION_RATE_LIMIT_PER_HOUR:-}
+      LOGTIDE_TERMS_URL: ${LOGTIDE_TERMS_URL:-}
+      LOGTIDE_PRIVACY_URL: ${LOGTIDE_PRIVACY_URL:-}
+      LOGTIDE_TERMS_VERSION: ${LOGTIDE_TERMS_VERSION:-}
       STORAGE_ENGINE: timescale
     depends_on:
       postgres:
@@ -135,6 +147,18 @@ services:
       INTERNAL_DSN: ${INTERNAL_DSN:-}
       DOCKER_CONTAINER: "true"
       SERVICE_NAME: logtide-worker
+      # Hosting seams: empty = inert (see docs/cloud-seams.md)
+      CAPABILITY_DEFAULTS_JSON: ${CAPABILITY_DEFAULTS_JSON:-}
+      LOGTIDE_ADMIN_SERVICE_TOKEN: ${LOGTIDE_ADMIN_SERVICE_TOKEN:-}
+      LOGTIDE_UPGRADE_URL: ${LOGTIDE_UPGRADE_URL:-}
+      LOGTIDE_UPGRADE_SIGNING_SECRET: ${LOGTIDE_UPGRADE_SIGNING_SECRET:-}
+      MAX_ORGANIZATIONS_PER_USER: ${MAX_ORGANIZATIONS_PER_USER:-}
+      MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH: ${MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH:-}
+      REQUIRE_EMAIL_VERIFICATION: ${REQUIRE_EMAIL_VERIFICATION:-}
+      REGISTRATION_RATE_LIMIT_PER_HOUR: ${REGISTRATION_RATE_LIMIT_PER_HOUR:-}
+      LOGTIDE_TERMS_URL: ${LOGTIDE_TERMS_URL:-}
+      LOGTIDE_PRIVACY_URL: ${LOGTIDE_PRIVACY_URL:-}
+      LOGTIDE_TERMS_VERSION: ${LOGTIDE_TERMS_VERSION:-}
       STORAGE_ENGINE: timescale
     depends_on:
       backend:

diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
@@ -121,6 +121,18 @@ services:
       INTERNAL_DSN: ${INTERNAL_DSN:-}
       DOCKER_CONTAINER: "true"
       SERVICE_NAME: logtide-backend
+      # Hosting seams: empty = inert (see docs/cloud-seams.md)
+      CAPABILITY_DEFAULTS_JSON: ${CAPABILITY_DEFAULTS_JSON:-}
+      LOGTIDE_ADMIN_SERVICE_TOKEN: ${LOGTIDE_ADMIN_SERVICE_TOKEN:-}
+      LOGTIDE_UPGRADE_URL: ${LOGTIDE_UPGRADE_URL:-}
+      LOGTIDE_UPGRADE_SIGNING_SECRET: ${LOGTIDE_UPGRADE_SIGNING_SECRET:-}
+      MAX_ORGANIZATIONS_PER_USER: ${MAX_ORGANIZATIONS_PER_USER:-}
+      MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH: ${MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH:-}
+      REQUIRE_EMAIL_VERIFICATION: ${REQUIRE_EMAIL_VERIFICATION:-}
+      REGISTRATION_RATE_LIMIT_PER_HOUR: ${REGISTRATION_RATE_LIMIT_PER_HOUR:-}
+      LOGTIDE_TERMS_URL: ${LOGTIDE_TERMS_URL:-}
+      LOGTIDE_PRIVACY_URL: ${LOGTIDE_PRIVACY_URL:-}
+      LOGTIDE_TERMS_VERSION: ${LOGTIDE_TERMS_VERSION:-}
       STORAGE_ENGINE: ${STORAGE_ENGINE:-timescale}
       CLICKHOUSE_HOST: ${CLICKHOUSE_HOST:-clickhouse}
       CLICKHOUSE_PORT: ${CLICKHOUSE_PORT:-8123}
@@ -175,6 +187,18 @@ services:
       INTERNAL_DSN: ${INTERNAL_DSN:-}
       DOCKER_CONTAINER: "true"
       SERVICE_NAME: logtide-worker
+      # Hosting seams: empty = inert (see docs/cloud-seams.md)
+      CAPABILITY_DEFAULTS_JSON: ${CAPABILITY_DEFAULTS_JSON:-}
+      LOGTIDE_ADMIN_SERVICE_TOKEN: ${LOGTIDE_ADMIN_SERVICE_TOKEN:-}
+      LOGTIDE_UPGRADE_URL: ${LOGTIDE_UPGRADE_URL:-}
+      LOGTIDE_UPGRADE_SIGNING_SECRET: ${LOGTIDE_UPGRADE_SIGNING_SECRET:-}
+      MAX_ORGANIZATIONS_PER_USER: ${MAX_ORGANIZATIONS_PER_USER:-}
+      MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH: ${MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH:-}
+      REQUIRE_EMAIL_VERIFICATION: ${REQUIRE_EMAIL_VERIFICATION:-}
+      REGISTRATION_RATE_LIMIT_PER_HOUR: ${REGISTRATION_RATE_LIMIT_PER_HOUR:-}
+      LOGTIDE_TERMS_URL: ${LOGTIDE_TERMS_URL:-}
+      LOGTIDE_PRIVACY_URL: ${LOGTIDE_PRIVACY_URL:-}
+      LOGTIDE_TERMS_VERSION: ${LOGTIDE_TERMS_VERSION:-}
       STORAGE_ENGINE: ${STORAGE_ENGINE:-timescale}
       CLICKHOUSE_HOST: ${CLICKHOUSE_HOST:-clickhouse}
       CLICKHOUSE_PORT: ${CLICKHOUSE_PORT:-8123}