Licensing Payload Disclosure

1. Heartbeat Request Payload Fields

In heartbeat mode, license validation requests are sent to https://api.zimmerapp.co/v1/license/verify approximately every 7 days (with up to 6 hours of jitter). Each request contains exactly six metadata fields, and the server rejects any request carrying a field not on this list:

• licenseKeyId: The customer's activation key identifier (e.g. lic_live_..., or lic_pilot_... on a free pilot).
• instanceId: A randomly generated UUID identifying the server installation instance (e.g. inst_...).
• nonce: A single-use cryptographic token generated per-request to prevent replay attacks.
• appVersion: The release version of the running Zimmer Server (e.g. 0.3.51).
• platform: The host operating system and architecture tuple (e.g. darwin-arm64).
• seatsUsed: A single integer — how many seats the licence currently occupies, so seat entitlement can be enforced and renewals sized correctly. A count only. It carries no names, no email addresses, and no per-user records of any kind, and it is never broken down by individual.

The response is a short-lived signed entitlement token, valid for 14 days. If a server cannot reach the licensing service, it continues operating on the cached token until that window elapses.

2. Pilot Registration (One Time)

Zimmer Server includes a free 3-seat pilot. Activating it during first-run setup sends a single request to https://api.zimmerapp.co/v1/pilot/register containing exactly the details entered on that screen, plus the same two technical fields the heartbeat reports:

• org: The company or workspace name you type.
• adminName: The name of the administrator registering the server.
• adminEmail: That administrator's work email, used to support the deployment and to contact you about the pilot.
• appVersion and platform: As described in section 1.

This is the only point at which Zimmer Server transmits a name or an email address, and it happens once, at setup. Nothing about the people who later enrol devices against your server reaches us — their names, emails, and devices exist only in your own server's directory. Registering also opts that administrator into product update emails, as stated on the registration screen.

Purchased licences carry the organisation name and billing email supplied at checkout instead, which we receive from Stripe.

3. What Is Never Transmitted

Beyond the one-time registration details in section 2 and the six heartbeat fields in section 1, Zimmer Server transmits nothing. No request ever contains:

• Identities, names, or email addresses of your end users — only the registering administrator's own details, once, at setup
• Document, prompt, chat, or index content
• Model names, weights, or inference parameters
• File paths, directory structures, or file names
• Hostnames, IP configurations, or internal network topology
• Per-user activity, session metrics, or any breakdown of who used what — seat reporting is a single aggregate integer and nothing more

4. Air-Gapped Enterprise Deployments

For regulated environments and high-security air-gapped deployments, Zimmer Enterprise supports offline signed license files. In offline mode, licensing verification is performed 100% locally with Ed25519 public key verification and makes zero outbound network calls.

Licensing is only one part of the boundary. The air-gapped AI deployment review separates a signed offline licence from network isolation, model transfer, software updates, retrieval controls, and the evidence a reviewer should request.