Open core, self-hosted relay, and the licensing logic

A lot of companies say they are open core. Most of them mean: the useful parts are closed; here is a free demo of a stripped-down version. When we say it, we mean something more specific. This post explains where the open-source line is in Aplexica, why it is where it is, and what the practical implication is for customers — especially the part that surprises people: every paid tier ships a self-hosted relay artifact, no contract negotiation required.

What is open source

These pieces are AGPL-3.0:

• The Aplexica daemon. The local-first software that watches each agent’s files, normalizes them into the canonical format, and writes them back into each agent’s native files. This is the value of Aplexica. It is open source and free, today, forever.
• The Aplexica portal. The web UI that manages your namespaces, devices, and team membership. It is the same code in self-host mode and Cloud mode; we build it from one repo.
• The self-hosted relay artifacts. The Docker images, Helm charts, and docker-compose files needed to stand up a relay in your own infrastructure. Customers on Personal, Pro, Team, and Enterprise can download and run them.

These pieces are commercial, source-available where it makes sense, private otherwise:

• The Aplexica Cloud control plane. The multi-tenant orchestration layer that runs the managed-SaaS service. This is what your subscription pays for: billing, identity, account lifecycle, audit logging at scale, SLA delivery.
• The Cloud-only adapters. Adapters that explicitly require Cloud features — SCIM, SAML, DLP — sit here.

Why AGPL-3.0

There were two real choices: MIT and AGPL-3.0. We picked AGPL.

MIT would mean a cloud provider could fork the daemon, host it as a SaaS, and never give anything back. We watched that pattern play out in the database market in the 2010s and we did not want a re-run with our project.

AGPL is the strongest copyleft that still survives a normal commercial adoption pattern. If you run Aplexica internally inside your company, the AGPL is the same as the GPL — you do what you want. If you offer Aplexica to others as a service, AGPL requires you to make your modifications available on the same terms. That is the deal.

Practically, AGPL means:

• Developers can fork, modify, and self-host the daemon and relay without asking us. The license already permits everything they reasonably need.
• Companies that want to build a competing managed SaaS on top of Aplexica have to keep their modifications open. That is fine. We expect a few. The control plane is the moat, not the daemon.
• Aplexica’s own customers get the strongest possible portability guarantee. If we go away, the daemon, the portal, and the relay are all open source and AGPL-licensed. You can keep running.

Self-hosted relay at every paid tier

The piece that is unusual: every paid tier — from Personal up through Enterprise — includes the option to self-host the relay artifacts. (Current prices are on the pricing page.)

We made this call deliberately. Three reasons:

1. The product is portability. A managed-SaaS-only product would be a worse version of the value we are selling. The whole pitch is that your state is yours and travels with you. That has to include the option to take the entire data plane in-house.
2. The technical work is the same. We already build the relay as a deployable artifact for our own Cloud. Packaging it as a Docker image and a Helm chart and shipping it to customers is a marginal-cost decision, not a strategic one.
3. It changes the economics of trust. A customer who is willing to self-host but has not yet pulled the trigger is far more relaxed about adopting Aplexica Cloud. The exit ramp is real, not a marketing claim.

What you do not get on Personal and Pro is enterprise SSO, SCIM, DLP, or BYOK. Those features rely on integration surface that is part of the commercial control plane.

What this means in practice

If you are on the Personal tier and Aplexica’s cloud goes down — or goes away entirely — you can run the relay yourself in an afternoon. Your namespace keys stay on your devices, your encrypted artifacts re-route to your local relay, and your agents continue to sync.

If you are an Enterprise customer, self-host is the default recommendation for regulated workloads. The relay runs in your VPC, the control plane stays in Aplexica Cloud, and audit events stream to your SIEM. No customer data passes through Aplexica-managed infrastructure at all.

If you are a developer who wants to inspect what is going on inside the daemon, the code is on GitHub and you can build it yourself.

The licensing line we drew, in one sentence

The valuable software is open source. The work of running it for you reliably, at scale, with the controls security teams need is what you pay for.

We think that is the honest version of open core.

Try Aplexica on the free Open Source edition. When you are ready, pricing is here.