Investors usually ask five things about open source: what you use, under which licenses, whether any copyleft code ships to customers, how you track it, and who approves exceptions. Answer with a dated inventory and a short written policy. This post is general information, not legal advice.
The five questions, in plain words
Diligence lists vary, but the same themes keep coming back. Treat the list below as a rehearsal sheet rather than a standard.
| Question | What a good answer contains |
|---|---|
| What open source do you use? | A component inventory, direct and transitive, generated from your lockfiles or an SBOM |
| Under which licenses? | One license per component, expressed as an SPDX identifier where possible |
| Does any copyleft code reach customers? | A yes or no, plus the list of components and how they are used |
| How do you track this? | The tool or process, how often it runs, and where results are stored |
| Who decides exceptions? | A named role and a log of past decisions |
Why the inventory comes first
You cannot answer licensing questions until you know what is in the product. The NTIA minimum elements document describes an SBOM as a record that supports inventory, vulnerability and license management, with seven baseline data fields: supplier name, component name, version, other unique identifiers, dependency relationship, author of SBOM data and timestamp. License is not one of those seven fields, so you add it yourself. The SPDX specification gives you a place for it: a concluded license field and a declared license field per package.
Say what is shipped and what is not
Investors care most about code that goes to customers or runs in your hosted product. A test runner or linter that never leaves a developer laptop is a different conversation from a library bundled into your mobile app. Split the inventory into shipped, hosted only and build only. The related post on build time or shipped licenses explains the split.
Be ready for copyleft questions
Copyleft means a license that asks you to share source or keep the same terms when you distribute a work that includes the covered code. The GPL text defines conveying as propagation that lets other parties make or receive copies, and it says mere interaction with a user over a network, with no transfer of a copy, is not conveying. The AGPL adds a network clause: if you modify the program, users interacting with it remotely must be offered the source of your modified version. So the honest answer to a copyleft question names the license, whether you modified it, and whether it is distributed or only hosted.
Show your process, not only your list
A list is a snapshot. Investors also want to see that it stays current. Point to the check that runs on pull requests, the place results are kept, and the exception log. The post on a three tier license policy shows a simple structure.
Try it yourself
Open the demo and look at how a dependency inventory lists components with their versions and licenses, then think about which rows an investor would ask about.
Click through it at your own pace, or open it full screen.
Safeguard can help with the inventory step. SBOM and dependency scanning list direct and transitive components, and there is a free scan at gold.safeguard.sh/scan if you want a first list to review. Your counsel still decides what the licenses mean for your business.
Quick check
Do investors expect zero copyleft?
Not necessarily. They expect you to know where it is and how it is used. Copyleft in an internal tool is different from copyleft in a shipped binary.
Is the license field part of the minimum SBOM elements?
No. The NTIA minimum elements list seven fields and license is not among them, so add it as an extra field.
Sources
- NTIA, The Minimum Elements For a Software Bill of Materials
- SPDX 2.3.1, package information
- Open Source Initiative, GPL 3.0 text
- Open Source Initiative, AGPL 3.0 text
Last reviewed: 19 October 2026.
