Essential frameworks for the modern decision-maker. Deep dives on licensing, deployment standards, and security to secure your digital stack.
The MIT License is a short, permissive open-source license. It allows you to use, copy, modify, merge, publish, distribute, sublicense, and sell the software. The only requirement is that you include the original copyright notice in your copy.
The Apache 2.0 is a modern permissive license. Like MIT, it allows full commercial use. Crucially, it includes an explicit patent grant, protecting you from patent lawsuits from the contributors.
AFL-3.0 is a permissive, OSI-approved license with a patent retaliation clause. No copyleft, no network trigger, but attribution is required.
The BSD 2-Clause License ("Simplified BSD" or "FreeBSD License") is a permissive free software license. It allows use, modification, and distribution for any purpose, including in proprietary products, with two conditions: keep the copyright notice and the warranty disclaimer.
The BSD 3-Clause License (also known as "New BSD" or "Modified BSD") is a permissive free software license. It is very similar to the MIT License, allowing you to use, modify, and distribute the software for any purpose. The key difference is an added clause that prohibits using the nam...
The ISC License is a permissive free software license functionally equivalent to MIT and BSD 2-Clause. It allows use, modification, and distribution for any purpose, including in proprietary products, with one condition: keep the copyright and permission notice.
The Mozilla Public License 2.0 (MPL-2.0) is the "middle ground" of open source licenses. It is a weak copyleft license.
The EPL-2.0 is a business-friendly, weak copyleft license. It allows for proprietary integration while ensuring that modifications to the original files remain open source.
The LGPL v2.1 is a weak-copyleft license that lets proprietary code link to an LGPL component without becoming open source. Modifications to the component itself must be shared, but there is no network clause, so self-hosting and internal network use trigger nothing.
The LGPL (Lesser General Public License) is a compromise between the permissive Apache/MIT and the strict GPL. It allows you to link your proprietary software to an LGPL library (dynamically) without forcing your proprietary code to become open source. However, if you modify the LGPL li...
The GPL v2 is the classic "Copyleft" license (Linux Kernel). It ensures that if you distribute the software, you must provide the source code. Unlike v3, it does not explicitly address "Tivoization" (locking hardware) or patent grants as aggressively.
The GPL v3 is a "Copyleft" license. It guarantees freedom for the end-user, not the developer. If you distribute software that links to GPL code, your entire application must also be released as open source under GPL.
The Affero GPL (AGPL) is designed to close the "SaaS Loophole." Unlike standard GPL, if you run AGPL software on a server and users interact with it over a network (e.g., a website), you MUST share your source code with them if you modified the software.
The European Union Public Licence is the EU's official OSI-approved copyleft licence. Its copyleft reaches network and SaaS use like the AGPL, but a compatibility clause lets combined works move to the GPL, AGPL, LGPL or MPL.
The Open Software License 3.0 (OSL-3.0) is a network copyleft license, often compared to the AGPL but with distinct legal mechanisms.
The Server Side Public License (SSPL) is not an official Open Source license. Created by MongoDB, it allows you to use the software freely, but if you offer it to others as a service, you must publish the source code of your whole service stack under the SSPL.
The Functional Source License (FSL) is a "Source Available" license: you may use, copy, modify and redistribute the code for any purpose except a Competing Use. Each version becomes available under MIT or Apache 2.0 two years after its release.
The Business Source License 1.1 (BSL or BUSL) is a "Source Available" license, NOT an Open Source license. It allows copying, modification, redistribution and non-production use; production use only as far as the licensor's Additional Use Grant permits.
The Elastic License 2.0 (ELv2) is a "Source Available" license created by Elastic. It is NOT an Open Source license by the OSI definition. It is free to use, except to provide the software to others as a hosted or managed service.
The Sustainable Use License (often associated with the "Fair Code" movement) is a "Source Available" license, not an Open Source license by the OSI definition. It grants broad rights to view, modify, and use the software for free, but only for internal business, non-commercial or personal use.
A custom license is a non-standard license a vendor writes or modifies itself, often a standard license with added clauses on branding or trademarks. Its terms have to be read one by one.
Browser-Based (Local-First) solutions run entirely inside your web browser. There is no server installation, no login, and often no backend database. The application code is downloaded once, but all data creation and processing happen locally on your device.
Managed SaaS means the Open Source creator hosts the software for you. You pay a monthly subscription fee instead of managing servers. This is the "Easy Button" for enterprises who have budget but no time.
Extensions (or Plugins) are small software modules that live inside another host application, most commonly a Web Browser (Chrome/Firefox/Edge) or an IDE (VS Code).
Mobile Applications are native software installed on smartphones (iOS/Android). In Open Source, these are distributed via standard App Stores or privacy-focused repositories like F-Droid.
Strategic intelligence entry regarding Desktop Application. Part of the OpenTechHub Strategic Playbook.
Runtime Deployment means installing the application as a library or package using a language-specific manager (like Pip for Python, NPM for Node.js, or Composer for PHP).
Native Deployment involves running the software directly on the Operating System, either as a Single Binary (common in Go/Rust) or via a system package manager (DEB/RPM). This is the "Bare Metal" approach.
In a Docker deployment, the software ships as a container image with all its dependencies included, so it runs the same way on any server with a container engine and the platform the image is built for, without conflicting with what else is installed.
The LAMP Stack is a classic architecture for web applications: Linux (OS), Apache (Web Server), MySQL (Database), and PHP (Language).
Kubernetes is an orchestration system designed for high availability and massive scale. It manages multiple containers that talk to each other. It is designed to ensure the software never crashes, even if a server fails.
Single Sign-On (SSO) allows your employees to log in using their existing company credentials (Google Workspace, Microsoft Entra ID/Azure, Okta) instead of creating a new username and password. It ties access to your central employee directory.
Data Residency refers to the physical geographic location where your data is stored. Laws like GDPR (Europe) and CCPA (California) often mandate that citizen data must strictly be stored/processed within their borders or in countries with adequate protection.
A Backup Strategy is the protocol for copying and archiving data so it can be restored in case of data loss (hack, corruption, or accidental deletion). The "3-2-1 Rule" sets a baseline: 3 copies of data, on 2 different media, with 1 offsite.
Community Support means there is no help desk to call. Support is provided by volunteers or other users on platforms like GitHub Issues, Discord, or StackOverflow. Responses are voluntary, not guaranteed.
Enterprise Support is a paid contract in which a Service Level Agreement (SLA) sets how fast the vendor responds. It can include a direct line to the engineers who maintain the software and priority for the bugs you report.
Total Cost of Ownership (TCO) is the full cost of software over its life: adopting it, running it and leaving it. Open source usually removes the license fee; it never removes the infrastructure or the engineering time, nor, where the tool stores data, the work of moving it.
Every Solution Profile rates three things from 1 to 5: Complexity, what it takes to stand the software up; Maintenance, the work of keeping it running; and User Management, how far its free self-hosted build manages many users centrally.
Self-hosting moves the security and compliance duties of running the software to you. Which duties move, which stay with the software's maker, and what a certificate covers.
The "Bus Factor" is a risk metric that asks: "If the lead maintainer gets hit by a bus (or gets hired by a competitor) tomorrow, will this project survive?" It measures how dependent a project is on a single individual versus a diverse group of contributors.
Data Portability refers to the ability to easily export your data from a system in a standard, usable format (CSV, JSON, SQL Dump) and import it into another tool. It is your "Emergency Exit" strategy.
"Open Core" is a business model where the core functionality of the software is free (Open Source), but critical "Enterprise" features (SSO, Audit Logs, High Availability) are proprietary and locked behind a paid license.
This software is owned by a neutral non-profit organization (like The Linux Foundation, CNCF, or Apache), not a single for-profit company. The Intellectual Property (IP) is held in trust for the public.
The project is open source, but one for-profit company controls it: it holds the copyright or the right to relicense contributions, and it sets the roadmap. It effectively decides the future of the software.
SOC 2 Type 2 is a report in which an independent CPA firm examines a service organization's controls over a stated period, against the AICPA's Trust Services Criteria.
ISO/IEC 27001:2022 specifies the requirements for an Information Security Management System (ISMS). Cloud security (ISO/IEC 27017) and privacy information management (ISO/IEC 27701) are covered by separate standards.
The General Data Protection Regulation (GDPR) is the EU's strict privacy framework, mandating data protection by design and giving individuals the right to receive the data they provided in a portable, machine-readable format.
HIPAA sets the US standard for protecting patient health data. It binds healthcare organizations and their business associates, not software; tools can support the safeguards those organizations must put in place.
eIDAS is the EU regulation establishing a cross-border legal framework for electronic signatures, seals, and trust services across all 27 member states.
The ESIGN Act is the US federal law granting electronic signatures the same legal validity as handwritten signatures across interstate and foreign commerce.
FERPA is the US federal law governing student education record privacy. It binds schools and universities that receive US Department of Education funds, not software; no FERPA eligibility status or certification exists for tools.
PCI DSS v4.0.1 is the mandatory security standard for any organization handling card payments. Self-hosting payment infrastructure can radically reduce your compliance scope, or expand it.
FedRAMP certifies cloud service offerings for US federal use. Under the 2026 rules an offering is FedRAMP Certified in a class from A to D, through the 20x or the legacy Rev5 certification type.
CMMC 2.0 is the US Department of Defense's mandatory cybersecurity certification framework for defense contractors and suppliers handling Federal Contract Information or Controlled Unclassified Information.
Cyber Essentials Plus is the UK government's independently verified cybersecurity certification, required for MOD contracts at cyber risk Levels 2 and 3; central government contracts that handle personal data require Cyber Essentials, Plus or equivalent controls.
Germany's voluntary federal IT security label, issued by the BSI. A manufacturer or service provider declares that one named product meets the security requirements set for its product category, backed by BSI monitoring.
FIPS 140-3 is the NIST standard validating cryptographic modules for US federal use. Software handling sensitive government data must use FIPS-validated cryptography, not just claim encryption.
WCAG 2.1 and 2.2 Level AA are the W3C web accessibility standards that laws and procurement rules reference. WCAG 2.2, the current version, adds criteria for authentication, mobile interaction, and cognitive accessibility.
The EU CRA mandates security requirements for software products in the EU market, focusing on SBOMs and rapid vulnerability reporting.
DORA sets uniform ICT risk-management, incident-reporting, and third-party oversight rules for EU financial entities and the tech vendors that serve them.