Running GPL software inside your organisation does not oblige you to release it, and the GNU FAQ says that holds for modified versions used privately, including on a website. The AGPL differs: it requires offering source to users who interact with a modified version over a network. This is educational, not legal advice.
Internal use is not distribution
The GNU GPL FAQ says that making and using copies within one organisation is not distribution. A company can install a modified version through its own facilities without releasing it outside. Giving copies to contractors for off-site use does count as distribution, so be careful there.
Modified and private
The FAQ says the GPL does not require you to release a modified version. You may use modifications privately. If you do release the program to the public, the GPL requires you to make the modified source available under the GPL.
Websites and SaaS
For a program under the GPL, the FAQ says a company running a modified version on a website does not have to release its modified sources, since private use is allowed. This is sometimes called the SaaS loophole.
The AGPL closes it. Per the FAQ, it requires that modified versions offer all users interacting with them over a computer network an opportunity to receive the source. If you run a modified AGPL program as a service, plan to publish your changes.
Combining with proprietary code
The FAQ is blunt: you cannot incorporate GPL covered software in a proprietary system. If the two are combined so they work as effectively one program, the whole program must be released under the GPL. Separate programs, such as an editor and a shell, can ship side by side, but the arrangement must be described accurately.
Where the line sits between "one program" and "separate programs" is a legal judgement. Linking style, process boundaries and data exchange all play a part. Ask counsel before relying on an architecture argument.
A decision guide
- Unmodified GPL tool used internally: usually no release duty, but check the license text.
- Modified GPL tool used internally: no release duty under the FAQ.
- Product you ship that contains GPL code: source and license duties apply.
- Modified AGPL program run as a service: offer source to network users.
- GPL library linked into a proprietary app you ship: a combined work question for counsel.
What engineering should have in place
- An inventory of components and their licenses. Without it you cannot answer any of the questions above.
- A policy on which licenses may enter which kinds of projects, with a review path for exceptions.
- A check in the pull request flow that flags new copyleft dependencies before they merge.
Safeguard's SBOM and dependency scanning and policies and gates can inventory components and flag license categories you have chosen to review. Try the free scan at gold.safeguard.sh/scan.
Quick check
If we modify GPL code for internal tools, must we publish it?
Per the GNU FAQ, no. The duty to provide source arises when you distribute.
Does the AGPL treat a hosted service differently?
Yes. It requires offering source to users who interact with a modified version over a network.
Sources
Last reviewed: 19 October 2026.
