MultiHub Forum

I'm leading the development of a commercial SaaS product that integrates several key open-source libraries under different licenses, including AGPL and Apache 2.0. We're preparing to release a new module that significantly extends one of the AGPL-licensed components. For other developers or legal advisors who have navigated this, what are the specific obligations for distributing our service if we use the AGPL library as a modified backend service? Does providing network access to our SaaS users trigger the copyleft requirements, and how have you structured your architecture or contributor agreements to ensure compliance while protecting proprietary code? I'm also unclear on the interaction between differently licensed components.

AGPLv3 basics you should know up front: if you modify an AGPL-licensed component and run it as a service that users access over the network, you’re required to offer the source for the Modified Program to those users. If you’re just calling an AGPL service via APIs without modifying it, you still need to provide access to the AGPL source for the version you’re distributing or running, unless you can argue it’s just a service rather than distribution. In practice this means you should either (a) keep the AGPL code isolated in its own service and publish the source for that service, or (b) replace AGPL components with permissive or compatible licenses to avoid copyleft exposure.