For most copyleft licenses, the duty to share source starts when you distribute copies, not when you use the software. The line is drawn between your own organization and everyone else. Contractors, customers and browsers that receive your code are on the other side of it.
What counts as internal
The GNU FAQ says copies used within one organization are not distribution, and a company can modify GPL software and run it privately. A build server, an internal dashboard or a data pipeline running modified GPL tools falls here.
What counts as distribution
- Giving copies to outside contractors for off site use. The FAQ treats this as distribution.
- Shipping an installer, an appliance image or a container to customers.
- Delivering code to the client side. The Mozilla FAQ states that sending JavaScript to a client counts as distribution under the MPL. Whether other licenses treat web delivery the same way is a question for the specific license text.
Where network use changes the rule
AGPL section 13 asks a modifier who lets users interact remotely over a network to offer them the source of the modified version. Without modification, that section does not apply. SSPL goes further for services, asking for the source of the wider service stack when you offer the program as a service. See the SSPL post.
A table in words
- Modified GPL tool, internal only: no source duty from that use.
- Same tool, sent to a contractor: distribution.
- Modified AGPL service for outside users: source offer.
- Unmodified AGPL service: section 13 not triggered by that alone.
- SSPL component offered as a service: section 13 applies.
Keep a distribution map
Many problems come from not knowing what leaves the building. Keep a short map per product: artifacts shipped, who receives them, and which of those contain copyleft components. Update it with every new delivery channel, such as a mobile app, a browser extension or a partner SDK.
How an SBOM helps
An SBOM tied to each shipped artifact answers the question of what a recipient receives. Safeguard's SBOM and dependency scanning can generate one per project; the free scan shows the output. The distribution call itself rests with counsel.
Quick check
Is giving a build to a contractor internal use?
The GNU FAQ treats handing copies to outside contractors for off site use as distribution.
Does running unmodified AGPL software trigger section 13?
Section 13 applies when you modify the program. Other terms of the license still apply.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
