Skip to content
OpaqueVault Docs

License

OpaqueVault is licensed under the Business Source License 1.1 (BSL 1.1), with an Additional Use Grant that permits free use for non-production environments and for organizations of five or fewer individuals.

This page answers the practical questions developers and teams have about what they can and cannot do. The legal authority is the LICENSE text (also included in every OpaqueVault release archive); this page is a plain-language guide and not a substitute for it.

The short version

Section titled “The short version”
Use case Permitted under the free grant?
Solo developer using OpaqueVault for personal projects Yes
Solo developer using OpaqueVault for their own commercial work Yes
Company with ≤ 5 individuals using OpaqueVault in production Yes
Company with > 5 individuals using OpaqueVault in production No — needs a commercial license
Any team using OpaqueVault in development, staging, CI, or testing Yes
Running a hosted “OpaqueVault as a Service” competing with our SaaS No — needs a commercial license
Embedding OpaqueVault in a product you sell or distribute No — needs a commercial license
Use after the Change Date (April 28, 2030) Yes — converts to Apache 2.0
Any organization using opaquev/ov-scan-action in CI to scan repos under their control Yes — the action has a broader CI grant; see below

Why BSL 1.1 instead of MIT or Apache?

Section titled “Why BSL 1.1 instead of MIT or Apache?”

If OpaqueVault shipped under MIT or Apache, a cloud provider could launch a hosted version on Day 2 and undercut the project’s ability to fund continued development of the core zero-knowledge and post-quantum work.

BSL 1.1 prevents that narrow class of abuse — large-scale commercial use without a license, or a competing managed-OpaqueVault service — while everything else stays free. After four years, every version automatically converts to Apache 2.0, so nothing is permanently encumbered.

This is the same model used by HashiCorp (Terraform, Vault), Sentry, MariaDB, CockroachDB, and Couchbase.

What does “production” mean?

Section titled “What does “production” mean?”

A “production environment” is one where OpaqueVault is being used to process real secrets in a live system that supports end users, paying customers, or any commercial offering. If you are storing actual API keys, database credentials, or tokens that are used to access live systems, you are in production.

The following are NOT production:

  • Local development on your laptop
  • CI test runs
  • Staging or QA environments processing test data
  • Internal demos and proof-of-concept work
  • Personal projects, hobby projects, side projects with no users
  • Educational use (classes, workshops, tutorials)

If you are not sure whether your use is production, email [email protected] before assuming.

What does “five or fewer individuals” mean?

Section titled “What does “five or fewer individuals” mean?”

We count any individual at your organization who uses, runs, configures, or has access to OpaqueVault in any environment, production or otherwise. Contractors who interact with OpaqueVault on your behalf count, and so do read-only auditors and security reviewers — the grant’s counting unit is anyone “using or accessing” the Licensed Work.

Examples:

  • A 4-person startup using OpaqueVault in production: free
  • A 6-person startup using OpaqueVault in production: needs a commercial license
  • A 50-person company where only 3 engineers actually touch OpaqueVault: free (only 3 individuals are using it)
  • A 50-person company where 8 engineers touch OpaqueVault, even rarely: needs a commercial license

The counting unit is “individuals using or accessing the Licensed Work,” not “company headcount.”

What is the Change Date?

Section titled “What is the Change Date?”

The Change Date for the current version of OpaqueVault is April 28, 2030. On that date, the codebase as it exists today (and every version released between now and then) automatically becomes available under the Apache License, Version 2.0.

(Note: the companion opaquev/ov-scan-action repo has its own Change Date for v1.0.3 and later — May 6, 2030 — eight days later. See the GitHub Action section below.)

This is a one-way conversion. Once the Change Date passes for a given version, the BSL restrictions on that version are gone forever. Future releases continue to be published under fresh BSL 1.1 terms with their own Change Dates, on a rolling four-year window.

Can I use OpaqueVault in my company without buying a license?

Section titled “Can I use OpaqueVault in my company without buying a license?”

Yes, if your company has five or fewer individuals using or accessing OpaqueVault in any capacity. The license grant itself is free — no charge, no key activation, nothing to sign. Self-hosted use requires no registration at all. (The hosted OpaqueVault cloud service is a separate product with its own plans and limits; creating an account there is a product signup, not a license requirement.)

If your company exceeds the five-individual threshold, please contact [email protected] for a commercial license. Commercial licenses include:

  • No usage limits
  • Production use rights
  • Priority support
  • Optional access to OpaqueVault Enterprise (organizations, RBAC, SSO/SAML, approval workflows, audit access controls)
  • Optional managed cloud hosting

What if I am not sure whether I need a commercial license?

Section titled “What if I am not sure whether I need a commercial license?”

Email [email protected] with a brief description of your use case. We respond within 5 business days. Common situations we have answered:

  • “We’re a 4-person startup but we have 2 contractors who occasionally touch infra — do they count?”
  • “We use OpaqueVault in our CI pipeline that runs for our SaaS product — is the CI ‘production’?”
  • “We want to embed OpaqueVault in a vertical SaaS we sell — what do we need?”

We would rather answer the question than have you guess wrong.

What about the trademark?

Section titled “What about the trademark?”

“OpaqueVault” and “ov” are trademarks of OpaqueVault LLC. The BSL 1.1 license grants you rights to use the licensed work; it does NOT grant trademark rights. You may not use the OpaqueVault name and logo in a way that suggests endorsement or affiliation. Questions: [email protected].

Can I get a copy of the commercial license terms before signing?

Section titled “Can I get a copy of the commercial license terms before signing?”

Yes — email [email protected] and we will send you the standard commercial license agreement for review.

What is the relationship between OpaqueVault (BSL 1.1) and OpaqueVault Enterprise?

Section titled “What is the relationship between OpaqueVault (BSL 1.1) and OpaqueVault Enterprise?”

The OpaqueVault core — the CLI, the agent, the MCP server, the API server, and the encryption stack — is the BSL 1.1 licensed work. It is everything you need to run OpaqueVault as a single user or small team.

OpaqueVault Enterprise is a separate, fully proprietary codebase (not BSL 1.1) that contains the team and enterprise features: organizations, role-based access control, SSO/SAML, approval workflows, audit access controls, and the management dashboard for those features. Enterprise is delivered as a binary or container image to commercial-license customers; its source code is not distributed.

The free core is fully functional for its intended audience; the enterprise tier adds team-scale features and is how the project is funded.

What about the GitHub Action opaquev/ov-scan-action?

Section titled “What about the GitHub Action opaquev/ov-scan-action?”

The action is also licensed under BSL 1.1, with an Additional Use Grant unusually broad for BSL: any organization, any size, may use the action in any Continuous Integration (CI) pipeline (including production CI) for the sole purpose of invoking ov scan against repositories under their control. The grant forecloses redistribution of the action as part of a competing CI/secret-scanning offering, a hosted scanning service, or any commercial product whose primary function overlaps with the action or with OpaqueVault.

Action versions from v1.0.3 onward carry Change Date 2030-05-06, on which they convert to Apache 2.0. Earlier tags (v1.0.0–v1.0.2) shipped under MIT and remain MIT — relicensing is not retroactive. Future major versions may carry a fresh Change Date if the action’s LICENSE file is re-issued.

Two grants apply, one per work:

  1. The action’s grant (above) covers your use of the action itself in any CI pipeline.
  2. The OpaqueVault grant (≤5 individuals using or accessing it, OR non-production — see “What does ‘production’ mean?” above) covers your use of the ov binary the action downloads at runtime. The action does not act as a sub-licensor of ov; the binary is licensed directly to you by OpaqueVault LLC.

CI test runs are explicitly non-production under the OpaqueVault grant, so most CI uses of ov scan are covered by both grants regardless of company size. However, teams using ov for active secret management or ov run injection in production must hold a commercial license for ov even if their CI use of ov scan is free. A team that needs a commercial license for production ov can still use the action freely in CI — the two grants operate independently.

Note: OpaqueVault’s Change Date (2030-04-28) is 8 days earlier than the action’s (2030-05-06). For about one week in early May 2030 the ov binary will be Apache 2.0 while the action is still BSL 1.1; both will be Apache 2.0 from May 6, 2030 onward.

The action’s LICENSE is the legal authority for the action; the OpaqueVault LICENSE file is the legal authority for ov. This page is a summary, not a substitute.

Where can I read more?

Section titled “Where can I read more?”