For companies and their compliance teams

The easiest compliance yes in your queue.

The easiest compliance yes in your queue: one flat annual Pass, every purpose-source product covered, machine-readable proof, 60-day cure, amnesty covenants on purchase.

For a large organisation the Pass is deliberately boring: one flat annual credential, cheaper than the meeting held to discuss it. We don't ask big tech to be generous — we ask them to be compliant. Priced so the cost per payer is tiny and the benefit is distributed — a design, not a result: no figure appears on this site before a ledger row backs it.

Fee schedule and thresholds The company guide Talk to us

Do you owe anything at all?

Only if your organisation is above the threshold, which is a dual test measured across the whole consolidated group: fewer than 100 people (employees and contractors together) and less than the published revenue figure in the prior tax year — one million US dollars in 2026 terms, indexed to consumer prices and converted at that year's average official rate. Below both, the licence behaves permissively: nothing to pay, nothing to register, nothing to sign.

"Group" uses the control language of the PolyForm Small Business licence verbatim — direct or indirect control by ownership, vote, contract or otherwise — so a small subsidiary of a large parent is inside the parent's group. Crossing the threshold is not a violation on day one: there is a 60-day cure window, so growth never creates an overnight infringer. The operative wording is the licence text, and where this paragraph and the text differ, the text wins.

Three lanes, one registry, one answer

One canonical licence; three Entitlement types plus a donate-direct lane, all recorded in one registry and all answered by one verification query — "is organisation X covered for repository Y?" — with one of six answers: yes via Pass, Project, Portfolio, Waiver or Donation, or no.

Project

One registered repository.

The first lane to open. For "the one thing we use".

Portfolio

Every registered repository of one administrator or organisation.

Flat regardless of repository count — splitting a repository buys nothing. Built when the first organisation with five or more registered repositories asks.

the Pass

Every repository in the registry.

One flat annual credential; always dominates at scale by constitutional ordering rule. Early Project buyers upgrade automatically when it opens.

Donation Entitlement

A compliance lane, not a priced product.

Recorded in the same registry upon a documented direct donation of the tier amount to a listed partner fund. The money never touches the Association. For organisations whose policy forbids a licence fee but permits a charitable payment.

Bands, lanes and the published fee stack, every figure labelled illustrative until the first transaction settles: the fee schedule.

Band self-certification: one binding tick

At checkout your organisation certifies its consolidated-group revenue band with one binding tick, timestamped. That is the whole of it. The model is reliance, in the PolyForm tradition: we ask you to be honest once, in writing, rather than reserving a right to inspect your books — because after the era of enterprise licence audits, an audit clause is a categorical procurement veto and we know it.

Under-certification is designed as an ordinary contract matter with a true-up remedy, voiding the Entitlement only on bad faith — a drafting position confirmed by counsel in the Entitlement terms, not a discretion we hold.

Vesting and renewal — the certainty clause

Every Entitlement is annual, and every lane — and every waiver — behaves the same way. At activation you vest the entire back catalogue plus everything published during the term; renewal extends the term end into the next year's releases. Vesting is permanent: nothing — project exit, delisting, steward failure, waiver revocation, non-renewal — ever strips a payer of a version already vested. If you stop renewing, you keep everything you vested and simply stop accruing new releases.

A lapsed Entitlement has a published grace window during which the coverage answer is "lapsed, in grace" rather than "no", so a late invoice is not an instant compliance incident. This is the answer to the vendor-risk review, and the reason the credential can be trusted by an organisation that has never heard of us.

Machine-readable proof

The Entitlement record

A signed JSON document (ES256) carrying subject, type, band, period and identifier, with a verification URL and a QR code. Verifiable in a browser against the published key set and the transparency log, and pluggable into a policy engine.

Verify a certificate →

The coverage answer

The registry API answers coverage for an organisation and a repository with one of six answers, ETagged, cacheable and documented. At this phase the signed Entitlement record plus the verification page is the proof; the computed endpoint follows.

Coverage semantics →

The review pack

Written for the person who has to write "approved" or "denied" next to a licence they have not seen before: classification stated plainly, the condition, term certainty, the contribution position, and the published counsel memos as they exist.

OSPO and legal pack →

What an Entitlement includes

A compliance credential: The Entitlement itself: one record in a public registry, one signed document, one verification page. The base credential is sold as compliance, and that is what it is.
Invoices: Structured and invoiced as a software-licensing business fee, through a merchant of record that handles indirect tax on cross-border sales. Receipt history stays available for as long as the record exists.
Usage declarations: Pick the registered projects your organisation actually uses. Declarations are load-bearing for allocation — they steer where the Pass's flow goes between projects — and are re-declared annually.
An annual impact statement — within the claim-language kit: Every certificate ships with the exact wording you may use: "holds [Entitlement]; contribution amount: $X; categories: …". Generic "we support charity" framing is contractually excluded, which is what keeps your statement defensible under the EU consumer-claims rules.
An optional public badge: Opt in to the public registry listing and the badge; opt out and the coverage answer still works — coverage is machine-answered regardless.
Impact multipliers: 2×, 5×, 10×: Voluntary tiers for an organisation that wants a creditable story. Badge prominence scales with the multiplier and the base fee earns none — a real giving story costs a real multiplier.

Organisations covered by a gratis waiver receive a licence-status certificate only — never a supporter or impact certificate — because they funded nothing.

Tax treatment, stated carefully

A qualified comparison, never a guarantee

The Purpose Fee is structured and invoiced as a software-licensing business fee; tax treatment depends on the payer's jurisdiction and circumstances — purchasers should obtain their own advice. A licence fee is typically better-treated than a cross-border donation, which is capped or non-deductible in many jurisdictions; that is a comparison, not a promise about your return. The donate-direct lane exists so that an organisation whose policy prefers a charitable payment keeps that choice.

Procurement answers

The questions a vendor-risk review asks, answered in the order it asks them.

What if the steward disappears?: The licence text carries a steward-lapse backstop: if the Steward Organization ceases to exist or to issue Entitlements for twelve consecutive months with no publicly designated successor, the Purpose Condition lapses and the licence degrades to permissive. Your exposure does not depend on our survival.
What if you decide to stop?: The kill protocol is a standing, pre-published page. It leaves every payer whole by construction: vested versions stay usable forever, the four-year conversion keeps running, the registry is archived at permanent URLs, and retired keys remain valid for verification.
Is there an audit clause?: No. Band certification is one binding tick, timestamped. There is no audit right and no inspection clause anywhere in the licence or the Entitlement terms.
How fast does coverage propagate?: The published design bound is five minutes from a settled purchase to the registry answering "yes". Stated as a bound the system is built to, not as a service-level guarantee; the propagation bounds and their measurement are documented with the public API.
Does the Pass warrant that registered code is non-infringing?: No, expressly. The Entitlement sells the steward covenant and the registry credential; it is not a warranty of third-party rights in any registered project. We state the blind spot rather than papering over it.
What does "amnesty covenants on purchase" cover?: Purchase triggers covenants not to sue for past use from the Steward Organization and from the project's steward-of-record, automatically, to the extent grantable. A total release of every contributor's past-use claim would need an opt-in enforcement-mandate pool that does not exist yet, so it is never implied. Cure windows cover the rest — friendly compliance, never ambush.
What do we sign?: Nothing beyond checkout. The Entitlement is an ordinary bilateral contract — offer, payment, invoice, tax — under published terms. The licence itself contains no payment obligation at all: it is a scope-of-use condition satisfied by the registry record.
Can our engineers contribute?: That is your programme office's policy to set. This licence is not OSI-approved and we say so plainly in the review pack; versions four years old and older are Apache-2.0.

Standing pages: the kill protocol · what we can never do · Entitlement terms · public API and propagation bounds.

Where next

Large users are participants, not adversaries. Licensing stops being purely transactional the day your annual statement can say, in kit wording and backed by a ledger row, what your organisation's use of this software directed to public benefit.

Fee schedule and thresholds Read the company guide Ask a procurement question