11

I am working in the healthcare reimbursement ("mutuelle") in belgium and I wrote a network application that use an AGPL package.

So, this application will be just used internally to provide the possibility to the insured peapol to digitally sign some forms in our agencies.

So in other word, the software will not be be sold but it will be used to achieve our business cases if I can say like that.

I am a little bit lost with the license terms.

What have I to do exactly to be in order legally? Is our situation considered like a commercial usage ?

Improve this question
1
  • Thanks for the answers. I have no problem to share the source code; A last question, to share the source code with the users of the application is enough or I have to put it on a public repository as github for instance?
    – Nicolas Cop
    May 10, 2022 at 12:11

1 Answer 1

Reset to default
10

It depends.

It depends on the architecture of your software. If the AGPL-licensed package is just used in an back-end application on a server, and not exposed to 3rd party interaction (through a proxy or not does not matter), then this back-end application can be considered as 'internal use' and you will not have to provide the source code. You mentioned 'internal use only' but it is unclear from your description which criterion you chose to determine that. If the AGPL-licensed package is running on the frontend of a customer-facing server, then you would be required to provide the source code.

It depends also on the legal structure of your 'agencies'. If the agencies are wholy-owned subsidiaries of the insurance, then the interaction of their PCs with the server-application can be considered internal use, and thus you won't have to provide the source code. That is true even if consumers, who come to the agency's office, interact with the agency's PC to for example sign a form. It would be different, however, if the agencies are not owned by the insurance, independent legal entities, in this case, if the AGPL-licensed app is running on the frontend of a server and the agency is interacting with that, then you would have to provide the source code to them.

I assume your insurance has a law department. They will anyhow want to know if you are using strong-copyleft software. Consult them. And consult your company's OSS Policy.

Edit: W.r.t. the question if AGPL requires the delivery of source code to the users (especially company-internal users), 2 things have to be considered.

a) The Preamble of AGPL v3.0 emphasizes the word ‘public’ in the sentence “Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.” I believe that the intention is that running AGPL-licensed software on a company intranet should have the same effect as running the same software on an employee’s computer. And there it would clearly be considered as ‘Internal Distribution’.

b) The other item is that §13 only refers to ‘modified versions’. If the AGPL-licensed software runs without modifications (and without combining/linking it with other code) there is no need to offer the source code.

Improve this answer
12
  • Many thanks for your answer. - all the agencies are owned by our insurance (we are a kind of public insurance, it's pretty special in belgium). - When I said "internal usage", I means that the application is used by the employees only.
    – Nicolas Cop
    May 10, 2022 at 12:23
  • Note that those employees will have a right to request copies of the source code, under AGPL. I doubt they will, but they do have the right to do so, and you have to tell them about it.
    – MadHatter ♦
    May 10, 2022 at 12:53
  • Yes I see. In reality, I have no problem to publish the source code. But, it's a very specific software that do a lot of different stuffs. And it will be a very strange repository on GitHub :)
    – Nicolas Cop
    May 10, 2022 at 13:05
  • 2
    @NicolasCop I strongly recommend that you talk to your legal department. Using strong-copyleft software is usually strongly regulated by company policies, and it is usually not up to the developer to decide on its use. Half of my time I currently spend on helping developers with compiling license and attribution notices, and then helping legal departments understanding it and checking if it is in line with their OSS policy.
    – Martin_in_AUT
    May 10, 2022 at 13:19
  • 2
    @Martin_in_AUT I entirely agree that company-internal usage is not distribution ("conveying", within the language of the licence). But AGPLv3 s13 rights extend to "all users interacting with it remotely through a computer", which is wholly different language to ss4-6 (and which is neither mentioned in, nor covered by, the FAQ entry to which you link).
    – MadHatter ♦
    May 10, 2022 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.