If your startup offers its own code under two licenses, record both license names, the SPDX expression joining them, proof that you hold the rights to offer both, and how outside contributions are covered. Investors want to see you can legally grant each license. This is general information, not legal advice.
Two meanings of dual license
People use the phrase in two ways. In your dependencies, a package may offer a choice of licenses and you pick one. That case is covered in dual licensed packages: choose and record. In your own product, you are the licensor, and you offer the same code under, for example, an open source license and a separate commercial license. This post is about the second case.
How to write it down
SPDX defines license expressions with operators. OR means the recipient can choose between licenses, AND means all of them apply, and WITH attaches an exception. A dual licensed package is written as two identifiers joined by OR. Your inventory entry for your own component should carry that expression, plus a note on where the commercial terms live. If a license is not on the SPDX list, the specification provides a LicenseRef form for user defined licenses, so a custom commercial license can still be referenced.
What investors will ask
| Question | What to have ready |
|---|---|
| Do you hold the rights to grant both licenses? | Evidence of authorship or assignment for all code |
| What about outside contributors? | A CLA or equivalent, since the DCO only certifies the right to submit under the stated license |
| Are dependencies compatible with the commercial option? | A dependency review that flags copyleft inside the dual licensed code |
| Where are commercial terms? | One agreed document, versioned |
The third row matters most. If your dual licensed code includes a component under a license that restricts how you can relicense the combination, the commercial option may not be available as you assumed. Run an inventory of the dependencies inside the dual licensed component and check each license.
The contributor problem
Offering a commercial license needs the right to grant it for every line. Code from outside contributors under the open source license alone may not give you that right. This is why projects that plan to dual license often use a CLA, as covered in CLA or DCO. Raise this with counsel before you accept outside code, not after.
Keep evidence together
Put the license texts, the SPDX expression, the contributor mechanism, the dependency review and the inventory date in one folder. The post on a license evidence index for a data room shows a layout.
Safeguard's SBOM and dependency scanning list the components inside each build, which gives you the dependency review input. The legal structure itself is a matter for your counsel.
Quick check
Does OR in an SPDX expression mean we can pick whichever license we like?
OR means the recipient may choose one of the listed licenses. When you are the licensor, you are the one offering that choice to others.
Can we write our commercial license in an SBOM?
Yes, by referencing it with a LicenseRef identifier and describing it, since it is not on the SPDX list.
Sources
Last reviewed: 19 October 2026.
