Licensing and engagement
What the licence allows, and the two ways to get it for your business.
Secure File Transfer is source-available. Anyone can read the code and the design and learn from them. Running it in a business takes one of two routes: a custom build for your company, or a commercial licence with setup.
What the public licence allows
The code is published under the PolyForm Noncommercial License 1.0.0. It is not an open-source licence, and it isn't meant to be.
| Without asking | Needs a commercial licence |
|---|---|
| Read and study the code, the requirements, the ADRs and the infrastructure | Running it, or a changed version of it, for a company, its customers or its staff, even internally |
| Clone it, run it on your own machine and change it to see how it works | Offering it as a hosted service, or selling or bundling it in a product |
| Personal study, research, experiments and hobby projects | Copying its code, Terraform, Helm charts or pipelines into a commercial project or paid client work |
| Use at a school, university, charity, public research body or government institution | Paid courses, paid training or paid consulting built on it |
| Write about it, teach from it or make videos about it, with a link back | Training or tuning an AI model that is sold or used commercially |
If you share a copy or a fork, keep its LICENSE and NOTICE files. If you aren't sure whether your use counts as commercial, ask before you start. The project's licensing guide has the details, and the licence text itself is the final word.
Option A: built for your business
I design and build the service in your own AWS account, starting from this design and adapting it to your company.
- Your regions. The reference design keeps all data in two AWS regions in Japan, with a guard that denies the rest. A build for you follows the regions your data has to stay in.
- Your sign-in. Members sign in through your own identity provider with OIDC or SAML, with MFA enforced.
- Your rules. Data loss prevention rules, trusted domains, expiry and retention limits set to your policies.
- Your brand and languages. The recipient and uploader pages and every email in the languages your partners read.
You get the code, the infrastructure as code, the runbooks and a handover to your team.
Option B: licence plus setup
A commercial licence to use this codebase in your business, with deployment into your AWS account and support while your team takes it over. This suits a company with its own platform team that wants a head start rather than a project.
How an engagement runs
- A free 30-minute call. We go through what you send and receive today, who your partners are, and the rules your data falls under.
- Design review. I map the reference design onto your accounts, regions, identity provider and policies, and write down what changes and why.
- Build in slices. Thin vertical slices, each one deployed and demonstrated, so you see the service working early rather than at the end.
- Handover. Runbooks, dashboards and alerts, a recovery drill with its measured result, and time with your team until they are comfortable running it.
Contact
- Email: contact@codewithmuh.com
- Website: codewithmuh.com
- LinkedIn: Muhammad Rashid
- Free session: book a 30-minute call
Tell me what you need to send, to whom, and under which rules. You'll get an honest answer on whether this design fits.
Source: LICENSE · Licensing guide