Open source, eventually.

Honest answer: focus. We are a tiny team and our time goes into making the platform good enough that companies can move off American cloud providers now. We also learned something the first time: we open-sourced the CLI and MCP server, then let the public repos go stale while the real development happened privately. Half-open is worse than closed, because it looks like abandonment. When we open the platform, it will be maintained in the open, not mirrored into the open.

Competitive protection. MIT would let Amazon or any large provider take the entire codebase, host it, and compete without contributing anything back. AGPL prevents that — if you modify deploybase and offer it as a service, you have to share your changes. It's the same license Grafana, Cal.com, and Plausible use. We admire Cal.com's radical transparency and want to follow a similar path. AGPL is also OSI-approved, which means it's "real" open source — not the source-available-but-not-really licenses that have caused so much damage to trust in the industry.

No. Not blindly. Elastic promised Elasticsearch would stay Apache 2.0 — then switched to SSPL in 2021 (AWS forked it as OpenSearch). Redis was BSD-licensed for 15 years — then went SSPL in 2024 (the Linux Foundation forked it as Valkey). HashiCorp championed open source for a decade — then switched Terraform to BSL in 2023 (OpenTofu was forked within days). Every one of those companies said they were committed to open source. Judge us by actions, not words. And we already have a mark against our own name here: we open-sourced our CLI and MCP server, then moved development back into our private monorepo and let the public repos freeze. This page said "open source" for months while that was true. We have corrected it, and that correction is the only credibility we can offer: when reality changes, this page changes. Judge us by that.

We're not planning to sell. We're actually exploring steward-ownership structures — like a Dutch stichting (foundation) that holds a controlling share and prevents the company from being sold or its mission changed. Ghost does this through a nonprofit foundation. Plausible uses steward-ownership via the Purpose Foundation. We're new to this and still figuring out the right structure, but the intent is to make acquisition impossible by design, not just by promise.

If we run out of money, we will give customers a proper deadline to migrate (minimum 90 days) and open source everything — the full platform, infrastructure configs, all of it. Your data and your sites should never be held hostage by a company's financial situation.

We will strive for that. Having worked with open-core products ourselves, few things are more frustrating than basic security features locked behind enterprise pricing. SSO is a security baseline, not a luxury — we don't want deploybase to end up on sso.tax. The cloud version will always be more convenient (managed CDN, managed builds, automatic updates, support), but we don't want to artificially cripple the self-hosted version to force upgrades.

Enterprise features that don't exist yet (things like SAML SSO, audit logging, advanced RBAC) will live in a separate /ee directory under a commercial license. But we've seen too many open-core companies gate basic features behind enterprise tiers to extract maximum revenue. Our north star: if a feature improves security or is needed by small teams, it stays in the open core. The /ee tier is for features that genuinely only matter at organizational scale.

deploybase is built on the premise that European companies need European infrastructure. It would be hypocritical to host our source code on a Microsoft-owned platform in the US. Codeberg is a German non-profit running Forgejo (a community fork of Gitea). We may add a GitHub mirror for discoverability.

Not right now. The frozen Codeberg repos are not accepting contributions, and the platform repo is private. When we open the full repository we will have a CONTRIBUTING.md and a CLA that lets us maintain the /ee directory separately, but the CLA will not give us the right to relicense your contribution away from AGPL.

Legally? Nothing. That's the uncomfortable truth. No company can make a binding promise about future licensing decisions — anyone who tells you otherwise is either naive or lying. What we can do: (1) choose AGPL from day one so there's never a downgrade to justify, (2) explore steward-ownership to remove the financial incentive for license changes, and (3) build enough trust through actions that changing the license would be self-destructive. The AGPL also means that even if we did change the license, the last AGPL version can be forked freely.