AGPL-3.0 Compliance Notice

Effective Date: March 2026

License

Burning Ash Protocol is free software licensed under the GNU Affero General Public License, Version 3.0 or later (AGPL-3.0-or-later).

Full license text: gnu.org/licenses/agpl-3.0.html

All source files include the SPDX identifier: // SPDX-License-Identifier: AGPL-3.0-or-later

What This Means

For Users of the SaaS Service

You are interacting with AGPL-3.0 licensed software over a network. Under Section 13 of the AGPL-3.0, you have the right to receive the source code of the software you are using.

BAP's SaaS service runs the unmodified source code available at:

github.com/baprotocol/burning-ash-protocol

If we make modifications to the deployed version that are not yet in the public repository, they will be made available within 30 days of deployment.

For Self-Hosted Users

When you self-host BAP, the AGPL-3.0 applies to your deployment:

• Unmodified use: You may run BAP on your own infrastructure without additional obligations, as long as you do not offer it as a network service to third parties beyond your organization
• Modified use (internal only): You may modify BAP for internal use without sharing your modifications
• Modified use (network service to others): If you modify BAP and offer it as a service to users outside your organization, you must make your complete modified source code available to those users under AGPL-3.0

For Developers and Contributors

If you create a derivative work of BAP:

• You must license the derivative work under AGPL-3.0 (or a compatible later version)
• You must include the original copyright notice and license
• You must state your changes
• If your derivative work is offered as a network service, you must provide the Corresponding Source to all users who interact with it remotely

Corresponding Source

The "Corresponding Source" for BAP includes:

• All source code files (Go, TypeScript, configuration)
• Build scripts and tooling (Makefile, Docker configurations)
• Database migration files
• Dependencies are specified in go.mod, go.sum, package.json, and package-lock.json

The Corresponding Source does NOT include:

• Your private configuration files (.env, secrets, keys)
• Your user data or database contents
• Third-party proprietary services you integrate with (Stripe, Twilio, etc.)
• Operating system, runtime, or standard libraries

How to Obtain the Source Code

Public Repository

The source code is publicly available at:

github.com/baprotocol/burning-ash-protocol

Written Offer

In accordance with AGPL-3.0 Section 6, we provide a standing offer to deliver the Corresponding Source to any person who requests it.

Email: opensource@baprotocol.com

We will provide the source code within 30 days, in a commonly used format, at no charge.

Version Identification

The deployed SaaS version is identified by the git commit hash, accessible via the /api/health endpoint or the application footer.

Third-Party Licenses

BAP depends on third-party open-source libraries. A complete list of dependencies and their licenses is available in:

• api/go.mod and api/go.sum (Go dependencies)
• web/package.json (JavaScript/TypeScript dependencies)
• documentation/package.json (Documentation site dependencies)

All third-party licenses are compatible with AGPL-3.0 distribution.

Contact

AGPL compliance questions: opensource@baprotocol.com

Legal inquiries: legal@baprotocol.com

---

This compliance notice supplements but does not replace the full AGPL-3.0 license text.