Under the GPL, modifying a program and running it privately, including inside a company, does not require releasing your changes. The duty to provide source starts when you convey copies to others. The AGPL adds a separate rule for network users, which is why the two licenses get confused.
What the GNU FAQ says
The GNU FAQ states that the GPL permits making a modified version and using it privately, and that a company can do this as well. Running a modified GPL web service on your own servers is therefore not distribution, so the source duty does not arise from that alone.
Two boundary points from the same FAQ:
- Using copies inside one organization is not distribution.
- Handing copies to outside contractors for use off site is distribution.
How the AGPL differs
AGPL section 13 applies if you modify the program and run the modified version so that users interact with it remotely over a network. You must then prominently offer those users a chance to receive the Corresponding Source, at no charge, from a network server. The obligation applies only when you modify.
If you run an unmodified AGPL program, section 13 is not triggered by that fact, though other terms still apply.
Where teams go wrong
- Treating a SaaS deployment as distribution. For GPL code, it is not by itself. For AGPL code with modifications, a different rule applies.
- Forgetting the contractor case. Sending a build to a vendor for use on their premises is a hand over of copies.
- Shipping the same code in an appliance or container for customers. That is conveying, and the source duty applies.
- Ignoring sub-components. An AGPL library inside your service can trigger section 13 for a modified copy.
A decision path
- Is the code GPL family or AGPL?
- Do you modify it?
- Do you give copies to anyone outside your organization?
- Do users interact with the modified version over a network (AGPL only)?
If the answer to step 3 is yes, plan source delivery. If step 4 is yes for AGPL code, plan the source offer.
An SBOM makes step 1 answerable at scale. Safeguard's dependency scanning and SBOM generation produce the component list, and the free scan is a way to see yours. Reading the license for the exact component is still your call.
Quick check
Do I owe source if I run a modified GPL tool only inside my company?
According to the GNU FAQ, no. Internal use within one organization is not distribution.
What if the tool is AGPL and I modified it?
Then section 13 asks you to offer the source to users who interact with it over a network.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
