You can read the code. That is not the same as permission to use it any way you like. Source available is not open source.
On this page
What it does
Source available is a family rather than a single license, and its members share one habit: they publish the code and then restrict what you may do with it. Four shapes cover nearly all of them. Time-delayed licenses convert to an open license later (BUSL-1.1 after about four years, the Functional Source License after two, to MIT or Apache-2.0). Competing-service prohibitions never convert (Elastic-2.0, Confluent Community). One takes network copyleft to an extreme (SSPL-1.0). Scope-of-use grants put the permitted scope in the license name itself, which is the PolyForm family: Noncommercial, Small Business, Internal Use, Perimeter, Shield, Strict and Free Trial.
Details
None of these licenses is open source, and the reason is precise rather than political. The Open Source Definition allows no restriction on the field of use, and every license here has one. What that means for you depends on how you ship. Internal use is permitted by most of them, so most of these dependencies are fine where they sit. The noncommercial PolyForm variants are the exception: there, a commercial company's internal use is the prohibited case. Offering the software itself to third parties as a service is the restriction they nearly all share. A library or SDK you hand to other developers is usually the blocker, because your customers inherit a restriction they never agreed to.
Pros
- You can read the code, trace bugs, and often use it for non-production work under the published terms.
- Some licenses convert to OSI terms after a delay, which is a planned path rather than a surprise.
Cons
- A SaaS or competing-product clause can make the "free" download unusable for the exact product you are building.
- Procurement will not treat it as open source. Your attestation page should say so plainly.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Modify
You can usually read and change the source. Production use after the change date, or in a competing service, is where these licenses bite.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Production use
Source-available licenses often delay or restrict production use, especially as a competing hosted service.
Obligations
Include license
Keep the license text with the source you received.
What source-available requires when you ship
source-available is readable source with use limits. The work is to match your use to the written grant, then keep the text on the record so procurement can read it. Do not treat a source-available identifier as OSI-style open source because the code is on GitHub.
You have read that project's actual text rather than the family name. Most of these licenses have fill-in fields, so two projects under one identifier can grant different things.
You use the software inside your own systems. Internal production use is permitted by most of these licenses, but not by the noncommercial ones: under PolyForm Noncommercial, a commercial company's internal use is the prohibited case.
You are not offering the software itself to third parties as a hosted or managed service, which is the restriction almost every license in this family shares.
You have checked whether your customers would inherit the restriction before putting one of these in a library or an SDK you hand to other developers.
You have recorded the version and the terms you read. An upstream license change does not reach the version you already have, but your next upgrade is a new decision.
The duties named in source-available
The written grant is the source of the limits. These rows are the usual conditions teams have to match against their actual use, then keep on the record.
Include license
Keep the license text with the source you received.
Things to be aware of
- Teams call it open source because the source sits on GitHub. Published source and an open-source license are different things, and buyers increasingly know the difference.
- Teams assume a relicensing announcement applies to the version already in their lockfile. It does not. The upgrade is where the decision actually happens.
- Teams expect every license in this family to be flagged for them. Coverage is uneven, and the FSL and Confluent Community identifiers raise nothing at all.
- Teams treat the family as uniform. A BUSL project converts to an open license on a date, while an Elastic-2.0 project never converts at all.
What the Source available licenses does not do
Search results often flatten Source available licenses into a slogan. These are the usual misreads. source-available is a grant with conditions, not a permission to skip the paperwork below.
- a source-available license is not an OSI-approved open source license. Readable source is not the same as permission to run a competing service or to use it in production without the paid terms.
- It does not become permissive because the SPDX id looks familiar. Read the field-of-use, production, or conversion clauses.
How source-available differs from nearby licenses
These licenses are often confused with source-available, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- source-available
- You can read the code. That is not the same as permission to use it any way you like. Source available is not open source.
- BUSL-1.1
- Source available, not open source. Each version converts to an open license on its own Change Date, usually four years after release.
- Elastic-2.0
- Source available with three prohibitions: no offering it as a managed service, no defeating the license keys, no removing notices.
- SSPL-1.0
- SSPL is MongoDB's rewrite of the AGPL. Offer the software as a service and its section 13 asks for the source of your whole service stack.
Common questions about Source available licenses
Answers to common questions about what Source available licenses requires, when its duties apply, and what evidence belongs with a release.
What is the Source available licenses?
Source available is a family rather than a single license, and its members share one habit: they publish the code and then restrict what you may do with it. Four shapes cover nearly all of them. Time-delayed licenses convert to an open license later (BUSL-1.1 after about four years, the Functional Source License after two, to MIT or Apache-2.0). Competing-service prohibitions never convert (Elastic-2.0, Confluent Community). One takes network copyleft to an extreme (SSPL-1.0). Scope-of-use grants put the permitted scope in the license name itself, which is the PolyForm family: Noncommercial, Small Business, Internal Use, Perimeter, Shield, Strict and Free Trial.
What does source-available require when you ship a product?
You have read that project's actual text rather than the family name. Most of these licenses have fill-in fields, so two projects under one identifier can grant different things. You use the software inside your own systems. Internal production use is permitted by most of these licenses, but not by the noncommercial ones: under PolyForm Noncommercial, a commercial company's internal use is the prohibited case. You are not offering the software itself to third parties as a hosted or managed service, which is the restriction almost every license in this family shares. You have checked whether your customers would inherit the restriction before putting one of these in a library or an SDK you hand to other developers. You have recorded the version and the terms you read. An upstream license change does not reach the version you already have, but your next upgrade is a new decision.
Is source-available open source?
Not in the OSI sense. source-available is source-available: you can read the code, but the grant restricts how you may use it. Read the actual text.
How is source-available different from Business Source License 1.1?
source-available asks this: You can read the code. That is not the same as permission to use it any way you like. Source available is not open source. Business Source License 1.1 asks this: Source available, not open source. Each version converts to an open license on its own Change Date, usually four years after release. Open the Business Source License 1.1 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record source-available for a buyer?
No license in this family ever lands on confirmed. The verifier refuses that outcome for all of them, so each one reaches a person with the extracted text attached. A filled-in template is labelled as the license with package-specific parameters rather than as a modification. Coverage past that point is uneven. BUSL-1.1, Elastic-2.0, SSPL-1.0 and two PolyForm variants have catalog rows, so a network distribution review item can appear on the checklist. The FSL and Confluent Community identifiers have none.
Where do I record source-available for a buyer?
No license in this family ever lands on confirmed. The verifier refuses that outcome for all of them, so each one reaches a person with the extracted text attached.
A filled-in template is labelled as the license with package-specific parameters rather than as a modification. Coverage past that point is uneven.
BUSL-1.1, Elastic-2.0, SSPL-1.0 and two PolyForm variants have catalog rows, so a network distribution review item can appear on the checklist. The FSL and Confluent Community identifiers have none.
Read /docs/inventory-compliance.
- Every templated identifier, from BUSL-1.1 and SSPL-1.0 through Elastic-2.0, Confluent Community and the FSL and PolyForm families, is kept out of the auto-fill lane on purpose.
- No external obligation exists for a use restriction as such. The one checklist item that can fire here is the network distribution review, and only for a license the catalog marks as one a network deployment does not clear. The PolyForm, CC-BY-NC and CC-BY-ND identifiers do raise a restricted-use compatibility warning on the component page, in every deployment context.
- Nothing in this family is decided for you. The review is yours, and the text stored on the component is what your attestation page carries.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.