Vaultr's public repository is licensed under the GNU Affero General Public License, version 3. For a firm's IT and risk teams, that licence is a fact to evaluate — and, handled correctly, an advantage no closed vendor can offer: the ability to read the code behind the claims.

What you can do today

Internal use is the simple case. A firm can obtain, run and evaluate the software inside its own organisation; AGPL's obligations centre on distribution and network interaction, not on using the tool for its purpose. Your lawyers can read the licence text itself — we link it from the research desk rather than paraphrasing it, because paraphrase is where licence mistakes are born.

Diligence is the other quiet advantage. Lockfiles are committed, so dependency versions are pinned and reviewable. The repository carries the upstream attribution of the fork and the history of what we changed and why. Claims on this site that say "verifiable in the repository" are links, not assertions.

Where obligations begin

AGPL's distinctive clause concerns network interaction: if a modified version of the software is made available for others to interact with over a network, source obligations can attach. For most firm-internal evaluation and use, that clause is not triggered. For a deployment where third parties interact with a modified instance — a client-facing portal built on the code, for example — it matters, and the security brief states this scope in exactly those terms.

We are not your lawyers and this post is not legal advice; the licence text is the authority, and your own counsel should confirm fit for your deployment shape. What we commit to is the honest part: the licence that governs the code is public, the fork's provenance is documented, and nothing about the source story changes between the sales conversation and the repository.