Questions Regarding online license validation

[expeditelaw]

Good afternoon,

We have some concerns and queries about the Online License validation calls made to your endpoints. Please can you confirm the following information:

-If the License file (licenseinfo.lic.bin) is present in the install location - why are calls made to the IP address 121.40.240.162?

-Please can you confirm the exact payload contents of the calls made to 121.40.240.162

-If connections to this IP Address are blocked, will Spire's PDF conversion continue to function and if so, for how long?

-Is it possible to have a copy of the License which does not make external License calls, i.e an offline license? If not, is it possible for the license calls to hit a european server instead.

Thank you and kind regards.

[amy.zhao]

Hello,

Thank you for reaching out and for your detailed questions regarding the license validation process. We appreciate you bringing these concerns to our attention and would like to provide the following clarifications:

1. Purpose of calls to 121.40.240.162 when a license file is present:

Our licensing system differentiates between licenses that have a limit on the number of deployment addresses and those that are unlimited. When an internet connection is available, a background service asynchronously and intermittently checks the number of machines bound to your license. This is done to verify that the license is not being used on more machines than permitted by its terms.

2. Payload contents of the calls:

The service detects and records a "usage count" based on the unique identifiers of the machine.

3. Impact on product functionality:

The license validation service is completely independent of the Spire.PDF product. It operates as a separate background process. Therefore, it will not affect the functionality, performance, or stability of Spire's PDF in any way. Your tasks with Spire.PDF will continue to run smoothly regardless of this service's status.

4. Offline usage and alternative licensing:

If the connection to this IP address is blocked, or if you are operating in an offline environment, the validation service will simply be unable to function. In this scenario, Spire.PDF product will continue to work normally without any interruption or degradation in service. You can use the Spire.PDF with confidence.

We hope this addresses all your concerns. Please do not hesitate to let us know if you have any further questions.

Sincerely,
Amy
E-iceblue support team

[expeditelaw]

Hi,

Thank you for the reply and confirmation on those questions.

Would it be possible to get an example of the payload that is being sent, even if the data is obfuscated, so we can get a clear understanding of what is and isn't being used.

Also, is there a way we can specify the Spire service to run in offline mode and not make these calls? We know we can block the IP to prevent it, however, if there's a way to prevent the call in the first place we'd prefer to do this.

Thanks

[amy.zhao]

Hello,

Thank you for your further inquiry.

Regarding your two requests-providing an example of the payload being sent (even if obfuscated), and the ability to run the Spire service in offline mode, we regret to inform you that we are currently unable to support either of these options. We apologize for any inconvenience this may cause.

If you have any further questions or need assistance with other aspects of the service, please feel free to reach out.

Thank you again for your understanding.

Sincerely,
Amy
E-iceblue support team

[expeditelaw]

Hi,

Are you at least able to send the data structure of the payload, without any data in it, so we know what the content could look like. The fact that these checks are happening has caused great concern for us and our users and is making us reconsider our continued use of the software.

Regarding your point about not being able to do an offline version - can you confirm that the software will continue to function by us blocking the IP and that the license check call not receiving a response will not render the software unusable?

Can I also ask why these checks are being done, when our license allows for an unlimited number of deployment locations?

Thanks,

[amy.zhao]

Hello,

Thank you for your continued feedback. We fully understand your concerns regarding data security and compliance, and we sincerely apologize for the anxiety this has caused. We value your business and want to provide complete transparency to address these issues.

Here are the answers to your specific questions:

1. Payload Data Structure and Privacy
We understand your need to know exactly what is being transmitted. Here is the explanation of the process:

How it works: When the client is online, it sends requests to our license verification service. The service differentiates clients by these information and creates a unique machine ID, which serves as the foundation for license verification.
Privacy Guarantee: We do not record, store, or track the actual address of your machines. The ID generated is random and cannot be reverse-engineered to reveal hardware information. This mechanism is solely to ensure the license is not abused beyond its scope.


2. Validation Logic for "Unlimited" Licenses

Regarding your question on why checks occur even with an "unlimited number of deployment locations" license:

While the client application is programmed to trigger a request by default (as part of the standard library code), our server is configured to recognize your specific license type.
Once recognized, our service performs no validation checks for your license. The request is essentially a "handshake" that is ignored on our end, ensuring your unlimited rights are respected without interference.

We hope this clarifies the situation. Our goal is to protect the software's integrity while fully respecting your privacy and operational requirements.

Please let us know if you need any further technical details.

Sincerely,
Amy
E-iceblue support team

[expeditelaw]

Hi,

Thanks for the reply and confirmation.

Would you be to let us know how often the license check is supposed to take place? We've noticed on one of our deployment locations, there have been over 3300 attempts since the 2nd May, which is a lot more than we'd expect for an intermittent check.

Are you also able to point us to the published documentation that details this check happening? We haven't been able to find this ourselves yet.

Thanks

[amy.zhao]

Hi,

Thank you for your follow-up questions.

Regarding the frequency of the license check, please note that the client sends a request to the license verification service whenever you execute the Save or Convert functions.

Regarding your request for documentation detailing this process, I apologize, but we do not have any public documentation available to share at this time.

Sincerely,
Amy
E-iceblue support team

[expeditelaw]

Hi,

One of our team emailed your support to ask a similar question and was told: "Thank you for your message. Here we confirm that IP address 121.40.240.162 is used by our server to validate licenses. We only use it to validate the license by collecting the machine counts and won’t collet any other information. Blocking it may cause a license validation error.".

I need assurances that blocking this IP WILL NOT cause any deprecation of functionality within the PDF Conversion routine that we're running.

Thanks,

[amy.zhao]

Hi,

Thank you for your feadback.

Upon further consultation with our Development Manager, we have determined that blocking this may have some impacts. As such, we advise against proceeding with this action.

Please rest assured that, we will not access any other information on your server. We appreciate your understanding.

Sincerely,
Amy
E-iceblue support team

[expeditelaw]

Hi,

I'm afraid we can't do this, as our clients are not comfortable with the address being hit. Equally, your support colleague has now advised that blocking the IP WON'T cause any issue, so we're getting conflicting information.

We selected this product under the belief that it worked offline, as there is no indication anywhere that it requires online connectivity. We need full documentation on how this work, can you please provide this. Can you also explain what impact we could see from blocking the IP.

Thanks,

[amy.zhao]

Hi,

Thank you for your feedback.

We completely understand your concerns regarding the IP address and the conflicting information you received.

To clarify, our product allows offline use in a fully internal network environment.

Regarding the IP address, our support colleague was correct: blocking this IP will not cause the application to crash or malfunction. However, allowing connectivity is recommended as it ensures the stability of your license. Blocking it simply means the software cannot perform these periodic checks, which is why we generally advise against it if possible.

I hope this clears up the confusion. Please let us know if you have any further questions.

Sincerely,
Amy
E-iceblue support team