1. Purpose

This document provides the public rationale for classification of software products supplied by X-Formation under the EU Cyber Resilience Act (CRA).

The document explains the intended purpose and high-level characteristics of the following products:

• License Statistics
• LM-X License Manager

This document’s objective is to provide customers, partners and auditors with transparent information regarding product categorization and applicability of CRA requirements.

This document intentionally excludes internal security architecture, implementation details, threat models and proprietary technical information.

3. Products Covered

3.1 License Statistics

Product Overview

License Statistics is an on-premise software product used to monitor software license consumption and provide operational visibility into software license utilization.

The product is installed and operated inside customer-managed infrastructure and enables collection, processing and reporting of license-related operational information.

Main Functional Capabilities

License Server Monitoring

• Connecting to customer license servers
• Importing license server logs

End-user Monitoring

License Statistics includes an optional endpoint component called License Statistics Agent, which may:

• Monitor application usage on end-user hosts
• Collect software utilization information
• Transfer collected information for reporting purposes

Reporting

• Collection and aggregation of license utilization information
• Historical and real-time reporting
• Statistical analysis of software usage

License Server Administration

For selected supported environments, License Statistics Agent may support operational actions, including:

• Starting supported supported license services
• Stopping supported supported license services
• Restarting

3.2 LM-X License Manager

Product Overview

LM-X License Manager is a software licensing platform intended to enable software vendors to manage licensing and authorization of their software products.

LM-X provides tools, libraries and services that allow software publishers to implement licensing policies, control software entitlement and protect software products against unauthorized usage.

LM-X is intended to be integrated into customer software and licensing workflows.

Main Functional Capabilities

Licensing Infrastructure

LM-X supports:

• Issuance and validation of software licenses
• Management of license policies
• Centralized license enforcement
• Software entitlement management

Platform Components

LM-X includes multiple software components, including:

• License server
• Client application components
• SDKs for supported programming languages
• License generation tools
• Web-based license administration functionality

Multi-Platform Support

LM-X supports deployment and integration across multiple operating systems and supported execution environments.

4. CRA Applicability Assessment

Assessment

Rationale

The products are:

• Software products placed on the market
• Capable of performing processing and operational functions after installation
• Distributed independently of customer-developed software
• Intended to operate within customer infrastructure

Both products include combinations of:

• Server-side components
• Administrative interfaces
• Client-side software
• Software integration interfaces
• Network communication capabilities

Operation within customer-managed environments does not exclude applicability of the CRA.

5. Product Criticality Assessment

Assessment

License Statistics and LM-X License Manager are considered Standard Products with Digital Elements (PDE) under the CRA

Rationale

License Statistics

The primary intended purpose is:

• Software usage monitoring
• Reporting and analytics
• Operational administration of supported license environments

License Statistics is not designed as a cybersecurity product and does not provide security functions as its principal intended purpose.

LM-X License Manager

LM-X provides licensing and entitlement functionality for software products, including:

• Validating licenses
• Enforcing licensing policies
• Providing software protection mechanisms
• Managing authorization logic

However, the principal purpose of LM-X is commercial software licensing and entitlement management.

The products are not intended to function as:

• Identity and access management infrastructure
• Operating system software
• Network security equipment
• Cryptographic trust infrastructure
• Cybersecurity monitoring or protection tooling

Security-related functionality supports licensing objectives and does not change the primary intended purpose.

6. Security-Relevant Characteristics

The products include functionality that may influence cybersecurity posture in customer environments; for example:

• Authenticated administrative interfaces
• Network communication
• Configuration management
• Integration with customer identity services
• Access to operational data
• Software update and deployment workflows
• Notification mechanisms

X-Formation designs and maintains products with consideration for secure operation and vulnerability handling.

Customers remain responsible for secure deployment, configuration, and operation in their environments.

7. Customer Responsibilities

Customers are responsible for:

• Infrastructure security
• Account and credential management
• Access authorization
• Installation and maintenance
• Backup and recovery procedures
• Secure configuration of integrations and notification channels

8. Final Classification Decision