Answer from facts, not from the license name. Say which license families you allow, how copyleft components are reviewed before use, and whether any are present in what the customer receives or accesses. Check with counsel before stating legal conclusions.
Why customers ask
Copyleft licenses attach conditions to distribution or network use. A customer buying software, or building on yours, wants to know those conditions will not reach their own code or products. This is a licensing question, not a vulnerability question, so the evidence differs.
What the licenses say, in short
According to the license summaries at choosealicense.com, GPL 3.0 is a strong copyleft license: permissions are conditioned on making complete source code of licensed works and modifications available under the same license, including larger works that use the licensed work. AGPL 3.0 adds that when a modified version is used to provide a service over a network, the source must be made available to its users. By contrast, the MIT license requires just preserving copyright and license notices, and larger works may be distributed under different terms.
These are summaries. The license texts and your lawyer decide the outcome for your case.
Questions to settle before you reply
- Do any GPL or AGPL components appear in the inventory?
- Is the component shipped to customers, hosted by you, or used in internal tooling alone?
- Is it modified?
- Is it linked into your product or run as a separate program?
- Is there a written rule on which licenses need review?
Your answers decide which statement is true. A build tool under GPL that never ships is a different situation from an AGPL library inside a hosted service.
Reply templates
No copyleft in the shipped product: "Our shipped product does not include GPL or AGPL licensed components, based on our license review of the release inventory. Build and test tooling is excluded from distribution."
Some copyleft present: "We use components under copyleft licenses in specific places. Each was reviewed before adoption, and we can describe how they are used on request."
Unsure: "We are completing a license review of the current inventory and will confirm by a date."
Never say "we have no copyleft" unless the inventory says so.
Evidence worth offering
- License field from the component inventory.
- The policy section on allowed and review-required licenses.
- A record of past reviews and decisions.
See also copyleft vs permissive licenses for the background.
Keep legal and engineering in the loop
License answers are statements customers may rely on, so have someone with legal responsibility review the wording before it goes out. Engineering supplies the facts: what is in the inventory, how components are used and whether anything is modified. Legal decides how to describe the consequences.
Store the approved wording with the date so sales and support can reuse it. A single reviewed answer prevents the quiet drift that happens when each reply is written from scratch.
Quick check
Does using a GPL tool in our build make our product GPL?
Not automatically. It depends on whether the tool's code becomes part of what you distribute. Ask counsel for a specific case.
Is AGPL always banned for SaaS companies?
No. Some allow it for internal use and prohibit it in hosted products. The point is to have a stated rule.
Sources
Last reviewed: 19 October 2026.
