Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2

Editions

jCustos — the open-core security framework behind jSentinel — ships in two editions. The line between them is simple: build and secure is free; operate and prove is commercial.

Community · EUPL 1.2 Enterprise · commercial Identical wire formats Nothing removed from the free core
Open source · EUPL 1.2
Community
Free, forever. Not time-limited, feature-gated or nagware.
  • Security core plus Vaadin, REST and Standalone adapters
  • DX layer and the compile-time @Secured processor
  • Argon2id password hashing, Eclipse-Store persistence
  • The signed security event bus
  • Full OIDC relying-party stack, six vendor profiles
  • DPoP, token propagation, four testkits, 15 demos
Community details On Maven Central →
Commercial licence
Enterprise
Operate and prove. Commercial terms on request.
  • Everything in Community, and on top of it:
  • Monitoring — metrics SPI and health indicators
  • Tamper-evident, independently verifiable audit hash chain
  • SIEM exporters — CEF, LEEF 2.0, NDJSON
  • OpenTelemetry, webhook and REST/SSE event export
  • Durable event and replay persistence
Enterprise details Talk to us →

Feature comparison

Everything needed to build and secure an application is in the free Community edition. The Enterprise edition adds the operate-and-prove layer on top.

Capability
Community
Enterprise
Build & secure
Security core — Vaadin, REST and Standalone adapters
✓
✓
DX layer and compile-time @Secured processor
✓
✓
Argon2id password hashing · Eclipse-Store persistence
✓
✓
Signed security event bus
✓
✓
OIDC relying-party (six vendor profiles) · DPoP · token propagation
✓
✓
Operate & prove
Runtime metrics and health indicators
—
✓
Tamper-evident, verifiable audit hash chain
—
✓
SIEM export — CEF, LEEF 2.0, NDJSON
—
✓
OpenTelemetry and webhook event export
—
✓
REST/SSE event bridge · durable event and replay persistence
—
✓
Nothing was removed from the free edition. The Enterprise modules attach to the core purely through SPIs, so the split is a publishing boundary, not a rewrite. The signed event bus itself stays in the Community edition — only the operational exporters over it, together with monitoring and the tamper-evident audit chain, are commercial. Wire formats, EventType values, metric names and audit-chain hashes are identical across both editions.

Not sure which fits? If you are building and securing an application, Community is complete — and stays that way. Choose Enterprise when you must demonstrate your security posture to an auditor, a regulator or a SOC. Questions and commercial terms: sven@jsentinel.eu.