Short answer: the Affero GPL (AGPL) closes the “SaaS loophole” in the GPL. If you use AGPL’d code in a service users reach over a network, you must make the source code available, even though you never “distribute” the software.
You may have heard of this open source license. If not, here are a few things every SaaS company needs to know about the Affero GPL (AGPL), from the perspective of an open source attorney.
1. AGPL Code in Your SaaS Means You Must Offer the Source.
The AGPL requires that if you provide the AGPL’d code over a network, you must make the corresponding source code available. This is unlike the ordinary GPL, where if you modify code but do not provide it externally (do not distribute it), you do not trigger the source-code requirement.
2. What Does the GPL Say Again?
It is generally accepted that SaaS companies serving their software over the Internet (without making users download the code) are not distributing it. So using ordinary GPL’d code in a SaaS offering does not necessarily require source disclosure. This is often called the ASP exception, or the SaaS loophole.
3. Where Does the AGPL Actually Say This?
Section 13 of the AGPL is what closes the loophole. If you offer AGPL’d software to users interacting with it over a network, you must offer those users the source code. Network use is the trigger, which is exactly what the GPL’s distribution test misses.
4. Why This Scares Acquirers and Investors.
Here is where it gets real for a vendor. The first thing a serious acquirer or investor does is run an open source scan of your codebase. If that scan turns up AGPL’d code buried in your service, with no compliance and no license, it can stall a deal or cut your valuation, because the buyer now inherits a source-disclosure obligation on the very product they are buying. I have seen AGPL findings turn a clean diligence into a renegotiation. The license is not “bad,” but undocumented AGPL in a proprietary SaaS stack is exactly the kind of surprise that costs money. This is the diligence side of having a real open source policy.
5. What a SaaS Vendor Should Actually Do.
Treat AGPL like a tripwire in your dependency list. Two moves: first, scan your build so you know whether any AGPL’d component is in your service (a lot of vendors are surprised). Second, decide deliberately whether to comply with the source-availability obligation, replace the component, or negotiate a commercial license from the author. The one thing you cannot do is ignore it, because the network-use trigger means there is no “we never shipped it” defense.
Frequently Asked Questions.
Does the GPL require me to publish my SaaS source code? Usually no. Serving software over a network is generally not “distribution,” so the ordinary GPL’s source obligation is not triggered. The AGPL is the version that changes that.
What exactly triggers the AGPL’s source requirement? Network interaction. Under Section 13, if users interact with AGPL’d software remotely, you must offer them the corresponding source, even though you never distributed a copy.
How do I find AGPL code in my product? Run an open source / license scan of your build and dependencies. Many vendors only discover AGPL components during acquisition diligence, which is the worst time to find out.
If you use AGPL code in your SaaS offering, take the source-disclosure requirements seriously. The rules are very different from the GPL.
For the technical-legal analysis of how copyleft attaches to different linking patterns, see Linking and the GPL (Technical and Legal Analysis), and for the broader program, see 3 Things You Need in Your Open Source Policy.
Resources:
Disclaimer:
This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.
Discover more from Aber Law Firm
Subscribe to get the latest posts sent to your email.