Source-available vs open source: what the difference means when you're buying AI for a regulated environment

The label sounds like a downgrade. For a regulated buyer, it is the opposite.

TL;DR — EpicStaff is not open source. It is source-available under the PolyForm Perimeter 1.0.0 licence. You can read every line, run it, and modify it for your own use. The main restriction is on using it to provide a product that competes with EpicStaff — the licence has a couple of other standard terms too, which you can read in full. For a regulated buyer, that answers the question that actually matters — can I read the code before I trust it? — and the answer is yes.

The single most common thing we hear is "oh, you're open source." We are not, and the difference is not pedantic. It changes what you are allowed to do with the code, and it changes what you should ask us before you sign anything.

So here is the honest version, in plain words.

There are really only three postures a software vendor can take toward its own source code. Most buying confusion comes from mixing them up.

Open source (OSI). The code is public, and the licence puts no restriction on how you use it. You can read it, run it, change it, and — this is the defining part — you can use it for anything, including building a business that competes with the people who wrote it. That "any field of use" freedom is what makes a licence "open source" in the formal sense the Open Source Initiative defines. It is a real and valuable thing. It is also not the only useful thing.

Source-available. The code is public and you can read all of it, run it, and modify it. But the licence keeps one narrow restriction: usually, that you cannot use it to compete with the original vendor. Everything else you would want from open source, you have.

Closed / proprietary. You get a binary or a hosted service. You cannot read the code at all. You trust the vendor's description of what the software does, because that description is all you are given.

EpicStaff sits in the middle box. Here is the same idea as a table.

	Read the code?	Run & self-host it?	Modify it for your own use?	Use it to build a competing product?
Open source (OSI)	Yes	Yes	Yes	Yes
Source-available (EpicStaff, PolyForm Perimeter 1.0.0)	Yes	Yes	Yes	No
Closed / proprietary	No	Usually no	No	No

Look at the first three columns. For everything a buyer of a self-hosted platform actually does — inspect it, deploy it inside your own walls, adapt it to your environment — source-available and open source are the same. The only column where they differ is the last one: selling a rival product. That column matters to your legal team's read of the licence. It does not touch how you use the software.

Read that last column again, because this is the point.

The main restriction in PolyForm Perimeter is on competing use. You may not use EpicStaff to provide a product or service that competes with EpicStaff. The licence has a couple of other standard terms too, which you can read in full before you talk to us. What it does not do is restrict which industry you are in. It does not restrict deploying it in a classified environment. It does not restrict modifying it to fit your infrastructure. It does not restrict how many agents you run or what you build with them internally.

If you are a government body, a defence supplier, a bank, or a hospital, you are not our competitor. The one restriction in the licence was never pointed at you. So framing source-available as "open source with a catch" gets it backwards. For you, there is no catch. You get to read it, run it, and change it — which is exactly the list you cared about.

Strip away the licence vocabulary and a regulated or sovereignty-conscious buyer is asking one question about any software that will touch sensitive data:

Can I read the code before I trust it?

That question separates the three boxes cleanly. Closed software says no — you trust the description. Open source says yes. Source-available also says yes. In the way that decides whether your security reviewer can actually do their job, source-available and open source give you the same answer.

This is why "is it open source?" is the wrong question to lead with, even though it is the one everybody asks. The question that protects you is narrower and more useful: can I inspect the thing I am about to run inside my network? If a vendor cannot say yes to that, no amount of the right licence label would help you. If they can say yes — as we can — the exact licence family matters to your lawyers and almost nobody else.

You can point a reviewer at our source and let them read the parts that matter to you: what the platform connects out to, how access is handled, what gets written to the audit record. You do not have to accept our word for any of it. You can check. That is the whole value of being source-available, and it is a value you do not lose by our not being OSI open source.

We would rather you not take our word for the distinction either. PolyForm Perimeter 1.0.0 is a short, plain licence. Read it. Read our source while you are there — it is at github.com/EpicStaff/EpicStaff.

Then, when you talk to us, you will already know the one thing that matters: you can see exactly what you would be running, before you trust it with anything.