Licensing

Ironflow ships under a use-case proprietary license based on the Functional Source License v1.1 with an Apache-2.0 future grant. The legal text lives in LICENSE on the public release mirror; this page is the plain-English summary. If the two disagree, the LICENSE file wins.

The model has three properties worth understanding before you read further:

1. Free for most uses you’d actually do. Local development, internal tools, education, personal projects, evaluation — all permitted. The license never asks you for a key.
2. Paid for one specific case. If you ship Ironflow as part of a commercial product or service that competes with a paid Ironflow offering, that’s a Competing Use and requires a commercial license.
3. Honor system, not phone-home. No license keys. No telemetry. No lockouts. The engine never calls home, never collects a logbook, never gates a feature on a server response. We trust users to read this page and email if they’re uncertain.

What does free actually cover?

Permitted Purpose under the LICENSE explicitly includes:

• Internal use and access — your team, your servers, your customers’ workflows running on infra you operate
• Non-commercial education — teaching, courses, university materials
• Non-commercial research — academic, pre-commercial R&D
• Professional services — you can use Ironflow while delivering services to a client who’s also a licensee

In Ironflow’s specific framing, that translates to:

Use case	Free?	Why
Solo developer building on a laptop	Yes	Internal use; no externally-facing commercial product
Internal company tool, 50 employees, no external customers	Yes	Internal use; not a commercial product feature
University research project, published paper	Yes	Non-commercial research
Evaluation at a Fortune 500 ahead of a procurement decision	Yes	Internal evaluation; explicit carve-out for up to 90 days from first install; commercial license kicks in only when production rollout begins
Open-source CLI you maintain that uses Ironflow internally	Yes	Internal use; downstream users are not buying a commercial product feature
Class taught at a coding bootcamp	Yes	Non-commercial education

What requires a commercial license?

Anything that meets the LICENSE’s “Competing Use” definition — a commercial product or service that:

1. substitutes for Ironflow,
2. substitutes for any other paid Ironflow offering, or
3. offers the same or substantially similar functionality.

In practice:

Use case	Free?	Why
SaaS product where Ironflow runs your customers’ production workflows	No	Externally-facing commercial product feature
Hosted Ironflow re-sold as a managed service	No	Substitutes for our paid offering — Competing Use
Embedded in a commercial product as the durable execution engine	No	Externally-facing commercial product feature
White-label workflow service built on Ironflow	No	Competing Use

If your case isn’t on either table, see What if I’m unsure? below.

Hobby tier

We also sell a $29/month managed convenience tier on Ironflow Cloud — single-tenant cluster, dashboard, no setup. The Hobby tier is not a competitor to free local self-host. Self-hosting Ironflow on your laptop or your VPS for personal projects is free under the LICENSE; the Hobby tier exists for people who’d rather not run infra at all. Pick whichever path you prefer.

Honor system: no telemetry, no logbook

Ironflow’s binary makes zero outbound HTTP calls at startup and ships no analytics package. We removed the prior opt-in internal/analytics/ package in v0.20 and added two regression tests (TestServeCommandConstructionNoOutboundHTTP and TestServeStartupNoForbiddenHTTPCalls) so any future PR that re-introduces phone-home fails CI before merge.

There is no engine-side telemetry, and no logbook collected by software. If we ever discover misuse signals — a competitor reselling Ironflow Cloud as their own — we follow up by hand, not via instrumentation.

Verifying release integrity

Every public release artifact (binary, image, signed blob) is signed via Sigstore cosign keyless. The signing identity is the release.yml workflow on a versioned tag in sahina/ironflow. Verify a binary you downloaded with:

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/sahina/ironflow/\.github/workflows/release\.yml@(refs/heads/main|refs/tags/v.*)$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --new-bundle-format \
  --bundle ironflow_linux_amd64.tar.gz.bundle \
  ironflow_linux_amd64.tar.gz

For the docker image:

cosign verify ghcr.io/sahina/ironflow-releases:vX.Y.Z \
  --certificate-identity-regexp '^https://github\.com/sahina/ironflow/\.github/workflows/release\.yml@(refs/heads/main|refs/tags/v.*)$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

If either command fails on an artifact you downloaded, do not run it.

What if I’m unsure?

Email the contact listed in LICENSE with a one-paragraph description of your use case. We answer within 3 business days. Most “is this free?” answers are yes; for the few that aren’t, a commercial license conversation is straightforward.

Versioning

The LICENSE in this repository is version 1.0 as of 2026-05-08. Revised terms apply on next install — using a previously installed version under its prior terms remains permitted. Each release ships the LICENSE that was effective at the time the artifact was built.

Future Apache-2.0 grant

The Functional Source License automatically converts to Apache-2.0 on the second anniversary of each release. So Ironflow v0.20 (released 2026) becomes Apache-2.0 in 2028. This is the FSL’s “delayed open source publication” model — closed today, open in two years, by construction.