By Buğra Ömer Aydemir · Updated 15 October 2026
Moving from Thales Sentinel LDK to Carcha Seal
This guide maps the concepts of Thales Sentinel LDK and Sentinel EMS to Carcha Seal, for vendors of Electron and Node.js apps who are considering a move. It follows Sentinel's own glossary and says plainly what has no equivalent, so you can rule it out early.
Concept map
| Sentinel LDK / EMS | Carcha Seal |
|---|---|
| Vendor Code (access to your protection keys) | The server's Ed25519 signing key. Apps ship only the public key (current and next), published as a JWKS at /v1/keys. |
| Product and Feature | Product (its code is what the SDK sends) and features listed on a license. Seal.hasFeature(state, feature) checks one. |
| Entitlement | A license: key, policy, seats, expiry, end of updates and features. Payment providers create one through the HMAC-signed order webhook. |
| Protection key: SL key on the customer's computer | A lease: a signed statement bound to one computer by a hash of its machine ID, stored encrypted with Electron safeStorage. |
| Protection key: HL key (USB dongle) | No equivalent. Carcha Seal has no hardware key. |
| License Manager / Admin Control Center on the customer's side | None to install. The SDK in your app verifies the lease itself; the admin console is on your side. |
| C2V and V2C files | Offline request file and license file (offlineRequest, activateOffline); a deactivation file frees the seat. |
| Rehost (customer moves an SL key) | deactivate() on the old computer, then activate() on the new one, without contacting you. |
| Concurrency, network seats (floating) | Not in version 1. Seats count computers, not running instances. |
| Envelope (wrap the application) | Different mechanism: encrypt feature code or data at build time and open it with decrypt or requireEncrypted, using a key the lease carries for that computer. |
What does not carry over
- Hardware keys. Customers who rely on HL dongles, for example to move a license between computers by hand, have no direct replacement.
- Network seats. Floating licenses served by a License Manager on the customer's network are not in version 1.
- Native applications. The SDK is for Electron and Node.js. Sentinel protects native executables with the Envelope and its Licensing API.
- Data files. Sentinel can assign a Feature to data files. Carcha Seal can encrypt data for a feature, which opens only on a licensed computer, but your app must call
decrypt.
A migration in steps
- List what you use. Products, Features, license terms (perpetual, expiry, maintenance), whether customers use HL keys, network seats or C2V/V2C, and which order system creates entitlements.
- Model products and policies. One Carcha Seal product per marketable product; one policy per kind of license term; features with the same names as your Sentinel Features.
- Connect the order system. Point it at the order webhook, so a new order creates a Carcha Seal license as it created an entitlement before.
- Ship an app version that accepts both. It checks Carcha Seal first and falls back to the Sentinel check, so customers move when they enter a new key.
- Issue keys for existing customers. Create licenses with the same features and dates through the admin API and send each customer a key.
- Remove the Sentinel check in a later version, after the customers you care about have activated.