Licensing

Ironflow ships under a use-case proprietary license based on the Functional Source License v1.1 with an Apache-2.0 future grant. The legal text lives in LICENSE on the public release mirror; this page is the plain-English summary. If the two disagree, the LICENSE file wins.

The model has three properties worth understanding before you read further:

1. Free for most uses you’d actually do. Local development, internal tools, education, personal projects, evaluation — all permitted. The license never asks you for a key.
2. Paid for one specific case. If you ship Ironflow as part of a commercial product or service that substitutes for Ironflow, substitutes for another Ironflow product or service that existed when your version was released, or offers substantially similar functionality, that’s a Competing Use and requires a commercial license.
3. Honor system, not phone-home. No license keys. No telemetry. No lockouts. The engine never calls home, never collects a logbook, never gates a feature on a server response. We trust users to read this page and email if they’re uncertain.

What does free actually cover?

Permitted Purpose under the LICENSE explicitly includes:

• Internal use and access — your team, your servers, your customers’ workflows running on infra you operate
• Non-commercial education — teaching, courses, university materials
• Non-commercial research — academic, pre-commercial R&D
• Professional services — you can use Ironflow while delivering services to a client who’s also a licensee

The LICENSE also grants two carve-outs in addition to the Permitted Purposes above:

• Personal use — use by a natural person for personal, non-commercial purposes, including hobby projects, self-education, and side projects that generate no revenue
• Evaluation — use by any individual or organization to evaluate Ironflow ahead of a purchase decision, for up to 90 days from first install, with no notification required

Both carve-outs are non-transferable and do not extend to redistribution, sublicensing, or any Competing Use.

In Ironflow’s specific framing, that translates to:

Use case	Free?	Why
Solo developer building on a laptop	Yes	Internal use; no externally-facing commercial product
Internal company tool, 50 employees, no external customers	Yes	Internal use; not a commercial product feature
University research project, published paper	Yes	Non-commercial research
Evaluation at a Fortune 500 ahead of a procurement decision	Yes	Internal evaluation; explicit carve-out for up to 90 days from first install, and internal use remains free beyond it
Open-source CLI you maintain that uses Ironflow internally	Yes	Internal use; downstream users are not buying a commercial product feature
Class taught at a coding bootcamp	Yes	Non-commercial education

What requires a commercial license?

Anything that meets the LICENSE’s “Competing Use” definition — a commercial product or service that:

1. substitutes for Ironflow,
2. substitutes for any other Ironflow product or service that existed as of the date that version was released, or
3. offers the same or substantially similar functionality.

In practice:

Use case	Free?	Why
SaaS product where Ironflow runs your customers’ production workflows	No	Externally-facing commercial product feature
Hosted Ironflow re-sold as a managed service	No	Substitutes for our paid offering — Competing Use
Embedded in a commercial product as the durable execution engine	No	Externally-facing commercial product feature
White-label workflow service built on Ironflow	No	Competing Use

If your case isn’t on either table, see What if I’m unsure? below.

Hobby tier

We also plan a managed convenience tier on Ironflow Cloud — single-tenant cluster, dashboard, no setup. Cloud is in private beta; pricing is planned, not live. The Hobby tier is not a competitor to free local self-host. Self-hosting Ironflow on your laptop or your VPS for personal projects is free under the LICENSE; the Hobby tier exists for people who’d rather not run infra at all. Pick whichever path you prefer.

Honor system: no telemetry, no logbook

Ironflow’s binary makes zero outbound HTTP calls at startup and ships no analytics package. We removed the prior opt-in internal/analytics/ package in v0.20 and added two regression tests (TestServeCommandConstructionNoOutboundHTTP and TestServeStartupNoForbiddenHTTPCalls) so any change that re-introduces phone-home fails CI on the nightly main run and in the release pipeline.

There is no engine-side telemetry, and no logbook collected by software. If we ever discover misuse signals — a competitor reselling Ironflow Cloud as their own — we follow up by hand, not via instrumentation.

Verifying release integrity

Every public release artifact (binary, image, signed blob) is signed via Sigstore cosign keyless. The signing identity is the release.yml workflow on a versioned tag in sahina/ironflow. Verify a binary you downloaded with:

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/sahina/ironflow/\.github/workflows/release\.yml@(refs/heads/main|refs/tags/v.*)$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --new-bundle-format \
  --bundle ironflow_linux_amd64.tar.gz.bundle \
  ironflow_linux_amd64.tar.gz

For the docker image:

cosign verify ghcr.io/sahina/ironflow-releases:vX.Y.Z \
  --certificate-identity-regexp '^https://github\.com/sahina/ironflow/\.github/workflows/release\.yml@(refs/heads/main|refs/tags/v.*)$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

If either command fails on an artifact you downloaded, do not run it.

What if I’m unsure?

Email license@ironflow.run with a one-paragraph description of your use case. We answer within 3 business days. Most “is this free?” answers are yes; for the few that aren’t, a commercial license conversation is straightforward.

Versioning

The LICENSE in this repository is version 1.0 as of 2026-05-08. Revised terms apply on next install — using a previously installed version under its prior terms remains permitted. Each release ships the LICENSE that was effective at the time the artifact was built.

Future Apache-2.0 grant

The Functional Source License automatically converts to Apache-2.0 on the second anniversary of each release. So Ironflow v0.20 (released 2026) becomes Apache-2.0 in 2028. This is the FSL’s “delayed open source publication” model — closed today, open in two years, by construction.