Licensing
Ironflow ships under a use-case proprietary license based on the Functional Source License v1.1 with an Apache-2.0 future grant. The legal text lives in LICENSE on the public release mirror; this page is the plain-English summary. If the two disagree, the LICENSE file wins.
The model has three properties worth understanding before you read further:
- Free for most uses you’d actually do. Local development, internal tools, education, personal projects, evaluation — all permitted. The license never asks you for a key.
- Paid for one specific case. If you ship Ironflow as part of a commercial product or service that competes with a paid Ironflow offering, that’s a Competing Use and requires a commercial license.
- Honor system, not phone-home. No license keys. No telemetry. No lockouts. The engine never calls home, never collects a logbook, never gates a feature on a server response. We trust users to read this page and email if they’re uncertain.
What does free actually cover?
Section titled “What does free actually cover?”Permitted Purpose under the LICENSE explicitly includes:
- Internal use and access — your team, your servers, your customers’ workflows running on infra you operate
- Non-commercial education — teaching, courses, university materials
- Non-commercial research — academic, pre-commercial R&D
- Professional services — you can use Ironflow while delivering services to a client who’s also a licensee
In Ironflow’s specific framing, that translates to:
| Use case | Free? | Why |
|---|---|---|
| Solo developer building on a laptop | Yes | Internal use; no externally-facing commercial product |
| Internal company tool, 50 employees, no external customers | Yes | Internal use; not a commercial product feature |
| University research project, published paper | Yes | Non-commercial research |
| Evaluation at a Fortune 500 ahead of a procurement decision | Yes | Internal evaluation; commercial license kicks in only when production rollout begins |
| Open-source CLI you maintain that uses Ironflow internally | Yes | Internal use; downstream users are not buying a commercial product feature |
| Class taught at a coding bootcamp | Yes | Non-commercial education |
What requires a commercial license?
Section titled “What requires a commercial license?”Anything that meets the LICENSE’s “Competing Use” definition — a commercial product or service that:
- substitutes for Ironflow,
- substitutes for any other paid Ironflow offering, or
- offers the same or substantially similar functionality.
In practice:
| Use case | Free? | Why |
|---|---|---|
| SaaS product where Ironflow runs your customers’ production workflows | No | Externally-facing commercial product feature |
| Hosted Ironflow re-sold as a managed service | No | Substitutes for our paid offering — Competing Use |
| Embedded in a commercial product as the durable execution engine | No | Externally-facing commercial product feature |
| White-label workflow service built on Ironflow | No | Competing Use |
If your case isn’t on either table, see What if I’m unsure? below.
Hobby tier
Section titled “Hobby tier”We also sell a $29/month managed convenience tier on Ironflow Cloud — single-tenant cluster, dashboard, no setup. The Hobby tier is not a competitor to free local self-host. Self-hosting Ironflow on your laptop or your VPS for personal projects is free under the LICENSE; the Hobby tier exists for people who’d rather not run infra at all. Pick whichever path you prefer.
Honor system: no telemetry, no logbook
Section titled “Honor system: no telemetry, no logbook”Ironflow’s binary makes zero outbound HTTP calls at startup and ships no analytics package. We removed the prior opt-in internal/analytics/ package in v0.20 and added two regression tests (TestServeCommandConstructionNoOutboundHTTP and TestServeStartupNoForbiddenHTTPCalls) so any future PR that re-introduces phone-home fails CI before merge.
There is no engine-side telemetry, and no logbook collected by software. If we ever discover misuse signals — a competitor reselling Ironflow Cloud as their own — we follow up by hand, not via instrumentation.
Verifying release integrity
Section titled “Verifying release integrity”Every public release artifact (binary, image, signed blob) is signed via Sigstore cosign keyless. The signing identity is the release.yml workflow on a versioned tag in sahina/ironflow. Verify a binary you downloaded with:
cosign verify-blob \ --certificate-identity-regexp 'https://github.com/sahina/ironflow-releases/.github/workflows/release.yml@refs/tags/v.*' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --signature ironflow_linux_amd64.tar.gz.sig \ --certificate ironflow_linux_amd64.tar.gz.pem \ ironflow_linux_amd64.tar.gzFor the docker image:
cosign verify ghcr.io/sahina/ironflow:vX.Y.Z \ --certificate-identity-regexp 'https://github.com/sahina/ironflow-releases/.github/workflows/release.yml@refs/tags/v.*' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'If either command fails on an artifact you downloaded, do not run it.
What if I’m unsure?
Section titled “What if I’m unsure?”Email the contact listed in LICENSE with a one-paragraph description of your use case. We answer within 3 business days. Most “is this free?” answers are yes; for the few that aren’t, a commercial license conversation is straightforward.
Versioning
Section titled “Versioning”The LICENSE in this repository is version 1.0 as of 2026-05-08. Revised terms apply on next install — using a previously installed version under its prior terms remains permitted. Each release ships the LICENSE that was effective at the time the artifact was built.
Future Apache-2.0 grant
Section titled “Future Apache-2.0 grant”The Functional Source License automatically converts to Apache-2.0 on the second anniversary of each release. So Ironflow v0.20 (released 2026) becomes Apache-2.0 in 2028. This is the FSL’s “delayed open source publication” model — closed today, open in two years, by construction.