Short version. AGPL-3.0 Section 13 triggers on two conditions together: you modified the program, and you let others use it over a network. Running it unmodified, or modifying it for internal use only, obliges you to nothing. Your own systems that call its API are unaffected.
AGPL has a reputation as the licence that infects everything it touches. That reputation costs good software adoption it should have had, and it comes from one clause that most people have never read. Here is what it does, what it does not, and when to buy your way out of it.
Not legal advice. A working summary from people who publish under it, with the text linked. Your counsel decides.
The one clause that makes AGPL different
GPL says: distribute the software, and you must offer the source of your version.
The gap that opened in the 2000s was that running software as a service is not distribution. A company could take GPL code, modify it heavily, run it as a web application, and never distribute a byte — so the obligation never triggered.
AGPL-3.0 Section 13 closes that. If you modify the program and let users interact with it remotely over a network, you must offer those users the corresponding source of your modified version, under the same licence.
Two conditions, and both must hold.
What does not trigger it
Most real usage does not. Specifically:
Running it unmodified. No changes, no obligation, however you use it and however commercially. Deploy it for a fleet of ten thousand and sell the service — as long as you have not modified the program, Section 13 has nothing to say.
Modifying it for internal use only. Your own staff on your own network are not “users interacting remotely” in the sense that triggers disclosure to the public. Fork it, rewrite half of it, run it for your own fleet: no obligation.
Configuration. Settings, environment variables, branding assets, report templates. Not modifications of the program.
Your own separate systems. Your ERP that calls the API is not a derivative work. Communicating with a program over a documented network interface does not make your program part of it.
What does trigger it
Modifying it and offering it to third parties over a network. This is the reselling case. You add an integration or change a screen, your customers log in over the internet, and those customers are entitled to the source of your modified version under AGPL.
Note who is entitled: the users of your instance, not the world. The practical difference is smaller than it sounds, because any one of them can then publish it, but the obligation as written runs to your users.
The four situations where you buy a commercial licence
Once the trigger is clear, the cases are easy to identify.
1. You resell or host it for customers, with modifications. The integration work you consider your competitive advantage is exactly what Section 13 would have you publish. A commercial licence removes the disclosure obligation. This is the common case, and it is the whole white-label discussion.
2. Procurement or security policy forbids AGPL outright. Plenty of large organisations maintain a licence blocklist with AGPL on it, applied without reference to whether the trigger conditions could ever occur. Arguing with a policy is a bad use of a quarter; buying the alternative licence is a purchase order.
3. You need warranty and indemnity. AGPL, like most open-source licences, disclaims warranty entirely in Sections 15 and 16. If your own contract with your customer requires you to stand behind the software, you need somebody standing behind it for you. A licence that includes warranty, indemnity and a support agreement is the mechanism.
4. You are being acquired, or raising. Due diligence asks what your stack is licensed under and what obligations attach. “AGPL, and here is our commercial licence” is a two-line answer. “AGPL, and we believe we do not trigger Section 13” is a diligence thread.
Why publish under AGPL at all
A fair question from someone deciding whether to depend on us.
It answers the question the whole product is about. “Self-hosted, and your data is yours” is a claim; a licence that guarantees you receive the source and may modify it is that claim in enforceable form. A proprietary self-hosted licence would leave you dependent on us in exactly the way the product says you should not be dependent on a vendor.
And it makes the commercial licence honest. It is not paying for access to something otherwise hidden — the software is there either way. It is paying to be released from an obligation, and to receive commitments the free licence explicitly disclaims.
Practical questions procurement will ask
Does using it make our own software open source?
No, and this is the misconception that does the most damage. Your ERP, your billing, your internal tools that talk to the API over HTTP are separate programs. AGPL reaches the modified program itself, not everything that speaks to it.
If we modify it internally, do we have to publish?
Not while it stays internal. The obligation runs to remote users of a modified instance.
What counts as a modification?
Changing the program’s source. Configuration, branding, data and separately-deployed adjacent services are not modifications.
Who enforces this?
The copyright holder — here, the publisher. Enforcement in practice is overwhelmingly a request to comply rather than litigation. That is not a reason to be casual about it if you are reselling.
Can the licence be revoked?
No. AGPL grants are irrevocable for the version you received. That is a large part of why a self-hosted deployment under it is safer than one under a proprietary licence with a termination clause.
Is AGPL OSI-approved?
Yes. It is a recognised open-source licence, not a source-available one — a distinction worth making if your policy treats the two differently.
Where that leaves you
If you run it as shipped, or modify it for yourself, AGPL asks nothing of you. If you modify it and serve it to customers over a network, it asks for those modifications. If that is your business, the commercial licence exists and is quoted per case — and comes with the warranty and indemnity the free licence explicitly does not.
The licence text is not long. If you are about to build a business on it, read Section 13 yourself rather than taking anyone’s summary, including this one.
