OSPO and legal pack

This page is written for the person who has to write “approved” or “denied” next to a licence they have not seen before. It answers the questions in the order review checklists ask them, and it states the costs rather than waiting for you to find them.

1. Classification

This is not an open source licence. It is a source-available licence with a commercial-use condition above a revenue-and-headcount threshold. It fails the Open Source Definition, it is not OSI-approved, and we never claim otherwise. If your policy is “OSI-approved licences only”, the correct answer for new releases is denied, and the four-year conversion below is the mechanism that changes that answer over time rather than an argument against your policy.

A one-line classification for a policy table:

Source-available, non-OSI, commercial-use condition above a published threshold, unconditional conversion to Apache-2.0 on each version’s fourth anniversary, no copyleft, no network clause, no audit right.

2. Identifiers, scanners, and the “unknown licence” flag

Expect an unknown-licence flag. An SPDX identifier is filed at 1.0 final, with the founding cohort’s adoption attached; a realistic listing lag for a new licence is one to two years. The status published on the licence page says exactly where the request stands, and not requested yet is a permitted value there.

What to do in the meantime:

In SPDX documents, use a LicenseRef- custom identifier — for example LicenseRef-PurposeSource-1.0 — with the canonical text URL in licenseText or seeAlso. Do not map it onto a similar-looking listed identifier: a wrong identifier is worse than an unknown one, because it will be trusted downstream.
In CycloneDX, use the licence name plus a url pointing at the canonical text endpoint; leave id unset until a listing exists.
In a composition-analysis tool, add a policy rule keyed on the canonical text hash rather than on a name string. The hash is published on the version page and served in the metadata endpoint, and it cannot drift: the build fails if the served bytes and the pin disagree.
Policy exception, not policy violation. The clean configuration is an explicit exception keyed to (a) the licence’s canonical text hash and (b) your organisation’s signed entitlement record. Both are static documents; neither needs a key or an account.
Detection. The LICENSE file is byte-identical across every adopting repository, so a content hash is a reliable detector. The optional PURPOSE.yml manifest is non-authoritative and must not be used for licence detection — the LICENSE file governs.

3. Does my organisation owe anything?

Only if it is above the threshold, which is a dual test measured across the consolidated group — the entity plus every organisation that controls it, is controlled by it, or is under common control with it, whether by ownership, votes, contract, or otherwise:

fewer than 100 total people (employees plus contractors); and
less than the published revenue figure for the prior tax year, converted at that year’s average official rate, indexed to consumer prices.

Below both, the licence is functionally permissive: nothing to pay, nothing to register, no account, and the coverage answer is no-entitlement-required-under-threshold.

Crossing the threshold does not create a violation on day one — there is a 60-day cure window. Self-certification is one binding tick with a timestamp; there is no audit right and no inspection clause, and their permanent exclusion is a never-reopen item (what we can never do) rather than a current forbearance.

4. What exactly is conditioned?

Use of versions published after the point at which your organisation was above the threshold.

Not conditioned: reading, forking, modifying, redistributing, self-hosting, or patching. Not conditioned: versions you already vested. Not conditioned: any version older than four years, which is plain Apache-2.0 by then.

Explicitly absent from the licence — the three questions asked first in every review:

No obligation on your own software. The condition attaches to the covered software and travels no further: nothing about what you write, link, host, or ship alongside it.
No disclosure duty. No source, architecture, deployment, or customer information.
No network clause. Making the software’s functionality available over a network triggers nothing, and there is no source-offer duty of any kind.
No share-alike, and no reporting duty.

5. Term certainty (the procurement question)

Per-version vesting. A version is vested if and only if its publication date falls on or before the end of the paid term. Vesting is permanent.
Nothing can strip a vested version — not project exit, not delisting, not steward failure, not waiver revocation.
Unconditional four-year conversion to Apache-2.0, in the licence text, per version, on each version’s own anniversary.
Steward-lapse backstop: if the Association ceases to exist, or stops issuing entitlements for twelve consecutive months with no publicly designated successor, the condition lapses and the licence continues on permissive terms for everyone.
Kill protocol: the wind-down sequence is published in advance and leaves payers whole by construction.

The practical summary for a risk register: worst case, you pin what you have and wait for the conversion. Your exposure does not depend on this organisation surviving — which is the one property a small steward can actually offer a large payer.

6. Contribution policy

No copyright assignment, ever. Contributors keep their copyright.
The designed default instrument is a one-line sign-off, the same ceremony as a developer-certificate-of-origin sign-off. The final form of the instrument is confirmed by counsel; we do not pre-guarantee the ceremony, only the copyright position.
Inbound equals outbound: contributions are licensed under the project’s own licence, with no separate grant to the Association.
The sign-off carries a bounded forward delegation to materially consistent successor versions, with an enumerated immutable core it can never reach — the free-tier threshold may only widen, the conversion delay may only shorten, and the fund destination, the no-private-profit rule, the registrar-never-licensor character, and the administrator’s gratis waiver power cannot be touched (Art. 11 of the statutes).

If your policy bars contribution to non-OSI licences, that policy is not wrong and we do not argue with it. It is listed as a real, unpriced cost on the comparison page.

7. Evidence a review can attach

Artifact	What it proves	Where
Canonical licence text	The exact terms, byte-exact, hash-published	`/license/{versionId}.txt`
Licence metadata	Version, dates, conversion date, SPDX status, text hash	`/license/{versionId}.json`
Signed entitlement record	That a named organisation holds a current entitlement	`/v1/entitlements/{companyId}.jws`
Certificate record	Status, period, scope of an issued certificate	`/v1/verify/{certId}`
Public key set	The keys the above verify against	`/jwks.json`
Waiver list	That a repository granted a named organisation a gratis waiver	`/v1/waivers/{nodeId}.json`
Registry record	A repository’s adoption state and licence version	`/v1/registry/repo/{nodeId}.json`
Bulk registry export	Every registered repository, one document	`/v1/registry/export.json`
Compliance export	Your own credentials as CSV, for the internal register	companies guide

Every one of those is a static, cacheable, unauthenticated document. There is no key to request, no contract to sign to read them, and no rate limit a normal review would notice.

The entitlement record, in shape

GET /v1/entitlements/{companyId}.jws returns a compact JWS with Content-Type: application/jose — three base64url segments, ES256. Decoded, the payload is the machine-readable coverage fact a policy engine needs:

{
  "schemaVersion": 1,
  "iss": "https://purposesource.org",
  "sub": "co_01j0000000000000000000002",
  "org": { "name": "Example Industries AG", "domains": ["example.invalid"] },
  "lane": "pass",
  "scope": { "kind": "pass", "repos": ["*"] },
  "period": { "validFrom": "2027-01-01", "validUntil": "2027-12-31" },
  "graceUntil": "2028-01-30",
  "vesting": { "rule": "version.publishedAt <= period.validUntil" },
  "iat": 1767225600,
  "cid": "cert_01j0000000000000000000001"
}

Header: { "alg": "ES256", "kid": "psn-prod-2026-1" }. Verify it against /jwks.json — the procedure, with WebCrypto and OpenSSL, is verify a certificate offline. The record is the proof; a screenshot of a page is not.

The registry API a review can script

All GET, all keyless, all ETag-honouring, all served from published artifacts with no database behind them:

# Is this repository registered, and under which licence version?
curl -s https://api.purposesource.org/v1/registry/repo/R_kgDOEXAMPLE01.json | jq '{state, licenseVersion}'

# Does this repository have waivers, and for whom?
curl -s https://api.purposesource.org/v1/waivers/R_kgDOEXAMPLE01.json | jq '.waivers[].organisation'

# What does the deployment say about itself, including the coverage algorithm version?
curl -s https://api.purposesource.org/v1/meta | jq '{coverage, contracts}'

Note the honest gap: there is no computed coverage endpoint at this phase. The proof of coverage is the signed entitlement record plus the verification page; the computed endpoint activates later with no schema change, and the eight coverage answers are frozen now so a client written today needs no change then. Full route set, cache behaviour, error envelope, and rate limits: public API reference.

8. The procurement pack

What to attach to a vendor-risk file, in the order a reviewer will want it:

The licence text and its hash — /license/{versionId}.txt and the SHA-256 from /license/{versionId}.json.
The plain-English companion, marked non-operative, which answers ambush, disappearance, and change with clause pointers: annotated licence.
The classification line from section 1, verbatim.
The term-certainty summary from section 5 — the four clauses, with the conversion date.
The steward’s own documents: statutes (with the never-reopen articles marked), Trust Center, documents register, security and subprocessors and residency.
The money mechanics, if your file asks where fees go: where the money goes — the fee stack, the cap, the ledger methodology.
The exit plan: kill criteria and the wind-down protocol.
Your own credential, once purchased: the signed entitlement record, the certificate id, and the compliance CSV.
The stated costs and open questions — sections 10 and 11 below, and the comparison page. A vendor file that contains no downsides is a vendor file nobody believes.

9. The claim-language kit

A certificate is a regulated claim in the European Union and the United Kingdom, so the permitted wording ships with it rather than being left to a marketing team.

The permitted pattern — the shape, with your values substituted:

holds [Entitlement]; contribution amount: [$X]; categories: [list]

Worked example, with the period made explicit as the pattern allows:

Example Industries AG holds a Purpose Source Pass Entitlement for 2027; contribution amount: [$X]; categories: education, research, health. Verify at purposesource.org/verify.

What the pattern requires: the specific Entitlement held, the amount, the period, and the categories — each of them a fact on the certificate and in the public record, checkable by the reader.

What is contractually excluded, because none of it is backed by the record:

generic social-impact or sustainability framing — “we support charities”, “we give back”, “committed to a better world”, “carbon-conscious”, “sustainable by design”;
any claimed outcome — beneficiaries reached, lives improved, projects funded — that the ledger does not show;
describing the fee as a donation, or the organisation as a donor, on the paid lane;
any impact claim by an organisation covered by a waiver. A waived organisation receives a licence-status certificate only; it funded nothing, so an impact claim would be false rather than merely vague;
any use of the marks implying endorsement, partnership, certification of your products, or membership;
any verification address other than the one on the certificate. The fixed wording is: verify only at purposesource.org/verify.

The binding statement is printed on the certificate itself, so the permitted wording travels with the artifact and cannot be lost in a hand-off between teams.

The regulatory note

Directive (EU) 2024/825 (Empowering Consumers) prohibits generic environmental and social claims that are not substantiated by a recognised scheme; the UK’s competition authority takes the same line on green claims, and Swiss unfair-competition law aligns. A certificate that named a verifiable fee, period, and category set is substantiated. A certificate that said “supports good causes” would be the exact claim those rules exist to stop — which is why the exclusion list above is contractual rather than advisory, and why the certificate types differ by what was actually funded.

10. Tax and accounting note

The Purpose Fee is structured and invoiced as a software-licensing business fee, not as a donation, and it is sold through a merchant of record which is the supplier to you for indirect tax purposes.

A licence fee is typically better-treated than a cross-border charitable payment, which is capped or non-deductible in many jurisdictions — that is a qualified comparison, not a guarantee: treatment depends on your jurisdiction and circumstances, and you should obtain your own advice. A direct-donation lane is preserved for organisations whose policy prefers it, and on that lane the money never passes through the Association at all.

11. Costs and open questions we have not closed

Costs, stated by us:

Some employers and programme offices bar contribution to non-OSI licences. Real, not zero.
Package registries and distributions will not ship a conditionally licensed project; this licence is not intended for libraries.
Scanner and allowlist friction until an identifier is listed.
Adding a steward adds a failure mode a permissive licence does not have. Mitigations: the lapse backstop, an independent-majority board, an append-only ledger, and a published kill protocol.
Legal certainty is thinner than decades of litigated permissive practice. The condition’s characterisation is the load-bearing question, three-jurisdiction memos precede launch, and payers are insulated by vesting regardless of the outcome.

Open questions, published rather than hidden: the final identifier string; the operating-cost cap percentage; the investment prong in the threshold; the evidentiary standard for the direct-donation lane; the governing-law choice in the licence text; and the enumeration policy on the public coverage endpoint. Each is listed with its owner and resolution phase in the specification repository, and each is on algorithms and schedule versions or the documents register where a date exists.

Companies: buying and complying — the mechanics of the purchase
Entitlement terms — what the credential is, and is not
Verify a certificate offline · Public API reference
Comparison page — the three-part honest table, including part (c)