# Licensing

> Apache-2.0 plus an ethical use clause. Source-available, not OSI-approved. For almost every commercial use there is no restriction at all.

- Page: https://granularity.tech/legal/licensing
- Last reviewed: 2026-09-23

## The short answer

Granularity is distributed under the **Apache License 2.0 with an additional ethical use
clause**. It is a source-available licence and it is **not OSI-approved**.

For the overwhelming majority of commercial uses there is no restriction: you may use it
in a closed-source product, you do not have to publish your code, and you do not have to
pay. The clause prohibits use by a specific and narrow set of actors, listed verbatim
below.

There is one situation where the licence genuinely blocks you, and it is stated plainly
rather than buried: **Granularity cannot be a dependency of an OSI-licensed library**,
because the restriction travels to derivative works.

## What is added to Apache-2.0

Three things, in plain language.

**A prohibition on use by particular actors.** Nazi and fascist movements, organisations
practising genocide or systemic persecution, and those who materially support them. The
full list is quoted below, because a paraphrase of a prohibition is worth nothing.

**Automatic termination.** Rights end by themselves upon prohibited use — no notice, no
procedure.

**The author's choice of forum.** Disputes are heard under the law of the author's
domicile, at the author's election.

Everything else is ordinary Apache-2.0: patent grant, no copyleft, no attribution beyond
the usual notice.

## Who the prohibition covers

Quoted verbatim from paragraph 1 of the clause. The Software must not be used, in whole or
in part, by:

> **(a)** Any individual, group, organization, regime, movement, political party,
> paramilitary or military formation, or state actor that professes, promotes, endorses, or
> practices Nazi, neo-Nazi, fascist, white-supremacist, or any other ideology that
> classifies human beings into hierarchies of worth, dignity, or rights based on ethnicity,
> race, nationality, national origin, skin color, language, religion or absence thereof,
> caste, gender, sexual orientation, gender identity, disability, or any other inherent
> human characteristic;
>
> **(b)** Any person or entity engaged in genocide, ethnic cleansing, forced deportation,
> apartheid, systemic persecution, incitement to hatred or violence against any of the
> groups described in (a), or any other act recognized as a crime against humanity under
> international law;
>
> **(c)** Any person or entity acting on behalf of, providing material support to, or
> operating infrastructure for, the parties described in (a) or (b).

Paragraph 4 states the counterpart explicitly: academic research, journalism, education,
historical documentation and human-rights advocacy that critically examine these
ideologies are not restricted.

## What changed

On 2026-08-31 the author accepted a revision of the clause, and the version you install
today ships it: the `LICENSE` file of core 0.53.1 no longer contains two paragraphs of the
earlier text:

- **the mandatory compensation** of at least 10% of a violator's gross revenue;
- **the non-severability** of the clause from the licence.

The prohibition itself (paragraph 1) stays, and so do automatic termination (paragraph 3),
the carve-out for research and journalism (paragraph 4) and the author's choice of forum
(paragraph 5). The reason was practical: in a legal review, a prohibition on use by Nazis
rarely draws an objection, while a disproportionate monetary penalty draws one every time.
Most refusals came from the two removed paragraphs, not from the position the licence
exists to express.

**The operative text is always the `LICENSE` file of the version you installed.** Versions
published before the revision carry the earlier text, compensation paragraph included; this
page describes the current one, and the build checks that the description matches the
installed file byte for byte.

## Frequently asked

**Can I use it in a closed commercial product?** Yes.

**Do I have to publish my source?** No. There is no copyleft of any kind.

**Do I have to pay?** No.

**Does an ordinary company fall under the restriction?** No. Read paragraph 1 above: it
describes ideological and criminal actors, not industries, countries or company sizes.

**I have read about a 10% compensation paragraph. Where is it?** It was in the earlier
revision and is gone from the current text. If the version you installed still carries the
old `LICENSE`, that paragraph applies only to the actors in paragraph 1 — nobody else.

**What do I put in our licence register?** The package declares
`SEE LICENSE IN LICENSE` in `package.json`; there is no SPDX expression on npm to copy.
For an internal register use the custom identifier:

```
LicenseRef-Granularity-EUC-1.1
```

Versions with the earlier text keep `LicenseRef-Granularity-EUC-1.0`.

**Is it compatible with MIT, Apache or GPL when I distribute derivatives?** For your own
product, yes — you are distributing your product, not relicensing ours. But you cannot
make Granularity a dependency of a library you publish under an OSI licence: the
restriction travels to derivative works, and that is incompatible with the OSI definition.
This is the real cost of the licence, and it is not softened by the revision.

**Why not plain Apache-2.0?** Because the author does not wish to grant the freedoms of
the licence to those described in paragraph 1. That is a value judgement, not an oversight,
and it is stated here rather than explained away.

**Where is the authoritative text?** In the `LICENSE` file of the repository and of every
published package. This page explains it; it does not replace it, and it deliberately does
not reproduce it. Two copies of a licence text are two texts that can drift apart, and the
one people install must win.

## For vendor questionnaires

Copy-paste answers:

- **Licence:** Apache License 2.0 with an Ethical Use Addendum (source-available, not
  OSI-approved).
- **Register identifier:** `LicenseRef-Granularity-EUC-1.1` (`-1.0` for versions with the earlier text).
- **Copyleft:** none. No obligation to disclose source.
- **Cost:** none. No royalties, no per-seat fees.
- **Patent grant:** yes, per Apache-2.0 §3.
- **Runtime dependencies:** none. The core ships zero runtime dependencies, so the
  transitive licence audit is empty.
- **Restrictions:** use is prohibited for the actors listed in paragraph 1 of the
  addendum; not applicable to ordinary commercial use.
- **Known incompatibility:** cannot be a dependency of an OSI-licensed library.

Machine-readable versions of the last two rows, generated on every build rather than
maintained by hand:

- [`/api/v1/sbom.json`](/api/v1/sbom.json) — CycloneDX 1.6 inventory of what the portal
  installs.
- [`/api/v1/licenses.json`](/api/v1/licenses.json) — the same, grouped by licence.

Note the scope stated in those files: they cover the portal's own dependency closure, most
of which is build tooling. The library itself brings none of it — the core declares zero
runtime dependencies, and you can see that in the same file.

## Materials on this site

The licence above covers the library's code. The site's own materials do not:

| What | Terms |
|---|---|
| Code examples on this site | **CC0 1.0** — public domain. Copy them without attribution or conditions. |
| Documentation prose | CC BY 4.0 — reuse with a credit. |
| Logo and wordmark | All rights reserved. See [Brand](/design/brand). |
| Fonts and icons | Under their own owners' licences. |

The first row matters practically. Without it, copying an example would formally inherit
the library's licence with the whole clause attached — obviously not the intent, so it is
written down.

## Contact

Questions from legal and compliance teams:
[legal@granularity.tech](mailto:legal@granularity.tech). We aim to reply within five
working days.