Not open source. The agreement you signed sets the terms, so the text you attach and the limits you record are the whole record.
On this page
What it does
A proprietary component is covered by a contract rather than by a public license. That contract can be a vendor EULA, which is the agreement you accept when you install the software. It can also be an order form, a subscription agreement, or a deal your legal team negotiated line by line. Oracle Database, Microsoft SQL Server, Highcharts, AG Grid Enterprise, FontAwesome Pro and commercial API terms all sit here. There is no public text to look up, so nothing about the terms can be inferred from the name of the product.
Details
The question your customer's procurement team asks is simple: are you allowed to hand this to us? For an open-source package the answer sits in a text anyone can read. Here it sits in your contract, and only the people holding the contract can answer it. Four clauses usually decide it: whether you may redistribute, how many named users are covered, which environments the software may run in, and whether your customers need a license of their own. Write those four down once, and the question stops being a fire drill.
Pros
- Commercial terms can match the product you actually bought. Those vendor limits stay with that vendor, not here.
- Putting the component on the attestation page still shows buyers you inventoried it.
Cons
- Nothing here can be fetched from a public license file. Someone has to attach the real agreement or a summary counsel accepts.
- Redistribution, SaaS, and OEM rights are whatever the order form says. Guessing from an SPDX-shaped id is the failure mode.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Use under the EULA
You may use the software only as the vendor's agreement allows. There is no general right to modify or sublicense.
Limits
Modify
EULAs typically forbid reverse engineering and unauthorized modification.
Redistribute
You usually cannot give copies to others except as the agreement spells out (for example a runtime you ship with your product).
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Obligations
Include license
Keep the vendor agreement and any required notices with the software you ship.
Follow the EULA
How many people may use it, territory, and field-of-use limits live in that agreement, not in an SPDX grant.
What proprietary requires when you ship
The limits that matter for proprietary sit in the agreement you signed, not in a public license text. This page tells you what cannot be looked up, and what still belongs on the record so a buyer sees the commercial component in the inventory.
You know which document governs: the EULA, the order form, or a signed amendment. A marketing page and a pricing table are not the agreement.
You have recorded the limits that decide your use: redistribution, the number of named users, permitted environments, and any region or audit clause.
You have read the redistribution clause before putting the component inside anything you hand to a customer. Most vendor agreements forbid that outright.
You have checked whether hosting the component for your own customers counts as prohibited service bureau use, if you run a hosted product.
You bring in counsel for any component whose terms limit how you ship or host your product. That wording is usually negotiable, and this is where the money is.
The duties named in proprietary
Public SPDX pages cannot list the commercial terms. What belongs on the record is the identifier and the text from the agreement you signed.
Include license
Keep the vendor agreement and any required notices with the software you ship.
Follow the EULA
How many people may use it, territory, and field-of-use limits live in that agreement, not in an SPDX grant.
Things to be aware of
- Teams record the vendor name and stop there. Record the governing document and its date instead, because a renewal can quietly replace the terms you reviewed.
- Teams assume that paying for a component buys the right to pass it on. A license to use is not a license to redistribute, and the two are priced separately.
- Teams look for an obligation checklist on a proprietary component and find nothing. There is none by design, so the contract limits belong in Team notes on the component.
- Teams paste a link to the vendor's terms page and call it done. Pages change without notice, so store the wording that applied on the day you agreed to it.
What the Proprietary and commercial licenses does not do
Search results often flatten Proprietary and commercial licenses into a slogan. These are the usual misreads. proprietary is a grant with conditions, not a permission to skip the paperwork below.
- a proprietary EULA is not a public license text you can look up. The limits are in the agreement you signed.
- A catalog row labelled proprietary does not invent terms. It only records that the component is not under a public SPDX grant.
How proprietary differs from nearby licenses
These licenses are often confused with proprietary, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- proprietary
- Not open source. The agreement you signed sets the terms, so the text you attach and the limits you record are the whole record.
- source-available
- You can read the code. That is not the same as permission to use it any way you like. Source available is not open source.
- licenseref
- A LicenseRef id is a pointer, not a license. It says the text lives elsewhere in the document, so somebody has to go and read it.
- no-license
- Code published without a license is not free to use. Copyright applies by default and the author keeps every right they did not give away.
Common questions about Proprietary and commercial licenses
Answers to common questions about what Proprietary and commercial licenses requires, when its duties apply, and what evidence belongs with a release.
What is the Proprietary and commercial licenses?
A proprietary component is covered by a contract rather than by a public license. That contract can be a vendor EULA, which is the agreement you accept when you install the software. It can also be an order form, a subscription agreement, or a deal your legal team negotiated line by line. Oracle Database, Microsoft SQL Server, Highcharts, AG Grid Enterprise, FontAwesome Pro and commercial API terms all sit here. There is no public text to look up, so nothing about the terms can be inferred from the name of the product.
What does proprietary require when you ship a product?
You know which document governs: the EULA, the order form, or a signed amendment. A marketing page and a pricing table are not the agreement. You have recorded the limits that decide your use: redistribution, the number of named users, permitted environments, and any region or audit clause. You have read the redistribution clause before putting the component inside anything you hand to a customer. Most vendor agreements forbid that outright. You have checked whether hosting the component for your own customers counts as prohibited service bureau use, if you run a hosted product. You bring in counsel for any component whose terms limit how you ship or host your product. That wording is usually negotiable, and this is where the money is.
Can I look up the Proprietary and commercial licenses terms on this page?
No. Proprietary and commercial terms come from the agreement you signed, not from a public license text. The limits that matter are in your order form.
How is proprietary different from Source available licenses?
proprietary asks this: Not open source. The agreement you signed sets the terms, so the text you attach and the limits you record are the whole record. Source available licenses asks this: You can read the code. That is not the same as permission to use it any way you like. Source available is not open source. Open the Source available licenses page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record proprietary for a buyer?
SourceTrust does not read a vendor agreement and cannot tell you what it permits. A proprietary component is a manual one. Auto-fetch lands on the proprietary state when a package declares no license and no license file is found. That state never fills in text on its own. You paste the agreement text or an authoritative extract onto the component, record the limits in Team notes, and approve it yourself. It is then listed on your public attestation page and in every export like any other component.
Where do I record proprietary for a buyer?
SourceTrust does not read a vendor agreement and cannot tell you what it permits. A proprietary component is a manual one.
Auto-fetch lands on the proprietary state when a package declares no license and no license file is found. That state never fills in text on its own.
You paste the agreement text or an authoritative extract onto the component, record the limits in Team notes, and approve it yourself. It is then listed on your public attestation page and in every export like any other component.
Read /docs/reviewing-component.
- None of the six external obligations applies to a component with no SPDX id, so a proprietary component carries no checklist item at all.
- Team notes stay internal to the people who can open the project inventory. They never appear on the public page, so that is the place for contract detail.
- The license text you attach is exactly what the public page and the export files carry. Paste the wording you are willing to let a buyer read.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.