Apache-2.0, all of it
Anyone may self-host, embed, resell, white-label and fork Latchyard. There is one codebase, one licence, and no enterprise edition.
The licence
- Apache-2.0, alone Not dual-licensed. Section 3 gives you a patent licence from every contributor, which ends for anyone who sues over the work.
-
DCO, no CLA
Every commit carries a
Signed-off-byline under the Developer Certificate of Origin, which certifies that its author has the right to submit the code. Nobody signs a CLA or assigns their copyright. - Permissive dependencies only A licence check on every commit stops AGPL, GPL, SSPL, BUSL and other copyleft or source-available libraries from being linked into or bundled with the product.
The no-open-core pledge
No feature in the open codebase moves behind a commercial licence, and there is no proprietary edition of the product.
There are no edition flags and no cloud-only features. Hosted tiers differ in capacity, retention and support, never in features.
The pledge allows two exceptions:
- abuse limits on free and trial accounts, such as no HTML responses and email only to the owner;
- limits a third-party provider imposes, such as narrower Google scopes on the hosted service.
Hosted-only services such as billing and the control plane fit the pledge, because they are operations, not product features.
Why you can hold us to it
Projects that left open terms could do so because one company held the copyright to every line. Under the DCO, we get no relicensing right that other contributors don't have.
So once outside contributions land, we can't relicense the whole codebase. That is intended, and it is what makes the pledge credible.