License & Open Source Policy

Burning Ash Protocol is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

Why AGPL-3.0

BAP is an encryption product that handles irrevocable, high-stakes data — digital wills. For this category of software, transparency is not a feature; it is a requirement.

The AGPL-3.0 was chosen for three reasons:

1. Auditability — Anyone can inspect the encryption implementation (AES-256-GCM, Shamir's Secret Sharing, Ed25519 signing) to verify security claims.
2. Network copyleft — If someone modifies BAP and offers it as a hosted service, they must share their modifications under the same license. This prevents proprietary forks from eroding the trust model.
3. Community protection — Contributors know their work will remain free and open, encouraging long-term participation.

What the AGPL Means for You

As a User (Self-Hosted)

• You can freely use, modify, and deploy BAP on your own infrastructure
• You do not need to share your configuration, data, or private modifications that you do not distribute
• If you modify BAP and make it available to others over a network (e.g., hosting it for your organization), you must provide access to the modified source code

As a User (SaaS)

• The hosted SaaS version runs the same AGPL-3.0 codebase
• The source code is always available on GitHub
• SaaS-specific features (platform connectors, billing) are part of the same open-source codebase, gated by deploy mode configuration

As a Contributor

• By submitting a pull request, you agree that your contribution is licensed under AGPL-3.0
• You retain copyright over your contributions
• Your work will be credited in the project's contributor list

As a Business

• You may use BAP internally without restriction
• If you modify BAP and offer it as a service to others, you must share your modifications
• Commercial support and managed hosting are available — contact the maintainers for enterprise arrangements
• The AGPL does not affect the license of documents you store in BAP — your data remains yours

Third-Party Dependencies

BAP uses third-party libraries with compatible licenses (MIT, Apache-2.0, BSD). These are listed in:

• api/go.mod (Go dependencies)
• web/package.json (Node.js dependencies)
• documentation/package.json (Documentation dependencies)

All dependencies are compatible with AGPL-3.0 distribution requirements.

SPDX Headers

Source files include SPDX license identifiers:

// SPDX-License-Identifier: AGPL-3.0-or-later
// Copyright (C) 2024-2026 Burning Ash Protocol contributors

Questions

If you have questions about the license or how it applies to your use case, open a GitHub Discussion or contact the maintainers.