License guide · Source-available
Business Source License 1.1 (BSL), in plain English
The Business Source License 1.1 is source-available, not open source — and that one distinction causes most of the confusion. In practice it’s close to open source with a single guardrail: you can read, use, modify, and self-host the code commercially, but you can’t turn around and offer it as a competing service — and every version becomes fully open source on its Change Date.
Updated 26 Jul 2026 · by the depproof team
General information, not legal advice. The controlling text is the specific work’s license file and its parameters. Primary source: the Business Source License 1.1.
Is BSL open source? No — and that’s the key
The source is public and you may use, copy, modify, and redistribute it — which feels like open source. But BSL adds a use restriction that the Open Source Definition doesn’t permit, so it is not OSI-approved. The honest label is source-available. That matters the moment a policy, procurement checklist, or scanner asks “is this an approved open-source license?” — for BSL, the answer is no, even though you can see and change the code.
What BSL actually lets you do
BSL-1.1 is a template with four parameters the licensor fills in: Licensed Work, Additional Use Grant, Change Date, and Change License. Read in order, the deal is:
- Broad rights by default. You may copy, modify, create derivative works of, redistribute, and make non-production use of the source without restriction.
- Production use is granted too — except the carve-out. The Additional Use Grant is where the licensor states what production use is permitted; anything outside it needs a commercial license. In real BSL works this restriction is almost always “you may not offer the Licensed Work to third parties as a hosted or managed commercial service.”
- It converts to open source. On the Change Date (at most four years after that version ships), the version relicenses under the Change License — a GPL-compatible open-source license (MariaDB’s default is GPL-2.0-or-later).
Is BSL safe for commercial and SaaS use?
Mostly yes — the restriction is narrow and specific. Here’s the decision at a glance:
| Can you… | Under BSL-1.1? |
|---|---|
| Use it inside your company / internally | Yes |
| Self-host it for your own commercial operations | Yes (unless the Additional Use Grant says otherwise) |
| Modify the source and build on it | Yes |
| Redistribute the source | Yes (restriction rides along) |
| Bundle it as a component of your own distinct product | Usually yes — read the Additional Use Grant |
| Offer it to others as a competing hosted/managed service | No — needs a commercial license |
| Use a version whose Change Date has passed | Yes, as open source (Change License applies) |
So “is BSL safe for commercial use?” is really “am I building my own product with it, or am I reselling it as a service?” The former is fine; the latter is the one thing BSL exists to stop.
Where BSL trips up dependency and license policies
Most license policy is written around a binary — OSI-approved open source, or proprietary. Source-available licenses like BSL sit in the gap, so a transitive BSL dependency can get flagged as unknown or non-compliant, or slip through entirely, depending on the tool. If your policy only allows OSI-approved licenses, an unnoticed BSL component can surface at the worst time — a release gate, an audit, or due diligence.
The practical move is to make source-available licenses visible in your dependency inventory and decide on them deliberately, rather than assuming every readable-source component is open source.
- Check your Maven dependency licenses — surface BSL, Elastic, and other source-available licenses across the full transitive tree.
- Elastic License 2.0 explained — the other source-available license teams meet most often.
Frequently asked questions
Is the Business Source License (BSL) open source?
No. The BSL is “source-available”: the source is public and you can read, use, modify, and redistribute it, but it carries a use restriction that the Open Source Definition and the OSI do not allow, so it is not an OSI-approved open-source license. The important nuance is temporal — each released version of a BSL work automatically converts to a genuinely open-source license (the “Change License”) on its “Change Date.” So a given version is source-available now and open source later.
Is BSL-1.1 safe for commercial use?
For most commercial uses, yes. You can use a BSL-licensed product inside your company, build on it, modify it, and self-host it commercially — the license explicitly permits use, copying, modification, and redistribution. The single carve-out is the “Additional Use Grant”: the licensor defines a production use you may NOT make without a commercial license, which is almost always “offering the software as a competing commercial/hosted service.” If your use isn’t that, BSL is generally safe commercially; if it is, you need a commercial license from the vendor.
What is the BSL Change Date and Change License?
Every BSL-1.1 work names a Change Date and a Change License. On the Change Date — which the license requires to be no more than four years after that version was first published — that specific version is automatically relicensed under the Change License, which must be GPL-compatible (MariaDB’s default is GPL-2.0-or-later). So BSL is time-delayed open source: newer versions are source-available with the use restriction, while versions past their Change Date are fully open source.
Can I use a BSL project in my SaaS product?
It depends on what the SaaS does. If you use a BSL-licensed component as part of your own distinct product — not to resell the BSL software itself as a service — you are typically fine, because the Additional Use Grant restriction targets offering the licensed work as a competing service. If your SaaS essentially is a hosted version of the BSL product (the classic reason vendors like MariaDB, CockroachDB, and Sentry adopted BSL), that is the restricted use and needs a commercial license. Read the specific work’s Additional Use Grant — it defines the exact line.
Who uses the Business Source License?
The BSL was created by MariaDB and has been adopted by a number of infrastructure and developer-tooling vendors as a middle ground between fully open source and closed. HashiCorp moved most of its products (including Terraform) to BSL in 2023; CockroachDB, Sentry, and others use it too. The common motivation is to keep the source open and eventually open-source it, while preventing large cloud providers from reselling the software as a managed service.
Why does BSL matter for my dependency and license policy?
Because many license policies and compliance tools are built around the binary “open source vs proprietary,” and source-available licenses like BSL fall in between — a scan may flag them as unknown or non-compliant even when your use is permitted. If your policy only allows OSI-approved licenses, a transitive BSL dependency can fail an audit or block a release. The practical step is to detect BSL (and other source-available licenses) explicitly in your dependency inventory and decide per-project, rather than being surprised by it later.
General information, not legal advice; confirm specific decisions with counsel. “Business Source License” and “BSL” refer to the license published by MariaDB Corporation and are used nominatively.