Licensing, governance and community

Recommendation: license the OpenDPDP public core under Apache License 2.0 with Developer Certificate of Origin (DCO) contributions. It is OSI-approved, permissive and includes an express patent licence/termination structure that helps enterprise and bank procurement.

This is a project strategy recommendation, not legal advice to a copyright owner. Before accepting external code, counsel should confirm ownership, notices, third-party licences and trademark rules.

Licence comparison

Model	Adoption/procurement	Contribution / competition	Monetisation
Apache-2.0	familiar, permissive, easiest embedding/procurement	cloud competitors can offer modified service without publishing changes; broad contribution potential	support, managed service, enterprise modules, packs/connectors
AGPL-3.0	OSI-approved but network copyleft often triggers enterprise legal review	hosted modified version must offer corresponding source under AGPL conditions; can deter proprietary forks and some adopters	commercial exceptions/dual licensing requires clean ownership
dual/open core	can combine open adoption with paid capabilities	boundary disputes and contributor licensing complexity if dual licensing	clear enterprise security/operations/support value

BSL, SSPL and similar source-available terms are not described as open source unless OSI approves the exact licence at the relevant time. “Source visible” is not “open source.”

Public core

• legal/source/control schemas, research and Starlight docs;
• tenant/entity/applicability, inventory and processing register;
• purpose/notice/consent receipt/withdrawal;
• rights/grievance case and manual tasks;
• retention/hold/deletion orchestration;
• breach case/clocks/templates;
• processor/vendor register;
• audit/evidence and export;
• OpenAPI/events, TypeScript client and connector SDK;
• Docker Compose evaluation, Kubernetes/Helm and community connectors.

Paid boundary

Managed cloud and operations; dedicated/VPC/air-gap lifecycle; enterprise SSO/SCIM/JIT/support controls; advanced KMS/HSM/WORM; high-scale retention/consent; certified connector/sector packs; continuous evidence; LTS/regulated release train; premium support/SLAs; implementation/migration.

The paid boundary must not remove a Principal’s ability to withdraw or a community user’s ability to export and leave. Security fixes for supported public core remain public.

Governance

Maintainers own components; technical steering sets architecture/release; legal research reviewers approve source/status; security response team handles private reports; release managers sign. Material decisions use public RFCs; architecture decisions use ADRs. Conflicts are declared and recused. No vendor can convert the public core to source-available terms without respecting existing Apache releases and governance.

Contributor ladder: user → issue/translation contributor → code/docs contributor → reviewer → maintainer → steering member. Promotion uses sustained quality, security judgement and community conduct, not employer.

DCO, not CLA initially

Every commit carries Signed-off-by under DCO 1.1. A broad copyright assignment/dual-licensing CLA would add friction and is unnecessary for the Apache-first plan. Revisit only if a genuine relicensing/dual-licensing requirement arises; do not retroactively assume rights.

Releases

Semantic versioning for code/API; legal configuration versions have source/effective dates and may release independently. Monthly feature train, urgent security/config releases, six-month LTS candidate after production maturity, documented deprecation (normally two minor releases and at least six months), forward/rollback migrations and signed SBOM/provenance.

Community operation

Issue/PR templates, good first issue, public roadmap, monthly community call/notes, translation reviewers, security/private route and RFC period. No customer PII, private regulator correspondence, licence keys or vulnerability detail in public issues.

Telemetry

Self-hosted telemetry is off by default. Opt-in is explicit, documented, minimised, inspectable and revocable. The product works without it. No subject, consent, request, incident, vendor, system or legal-config content is collected.

Repository promises

README, Apache LICENSE, NOTICE, contribution/code/security/governance/trademark/support/ compatibility policies, changelog, ADR/RFC templates, CI, SBOM/signature workflow, deploy examples, SDK/connector examples and synthetic demo. Legal research accepts changes only with primary sources and status fields.