Yes. A license inventory limited to open source gives an incomplete picture. List commercial SDKs, bought libraries and vendor components too, with the agreement reference and any redistribution limits. SPDX lets you reference licenses outside its list with LicenseRef. Not legal advice.
Why include them
Investors and acquirers ask what you depend on and under what terms. A paid analytics SDK in your mobile app or a licensed charting library in your front end has terms too, often with limits on redistribution, seat counts or use in competing products. Missing those from the inventory leaves a hole that open source scans do not reveal.
How SPDX handles non standard licenses
The SPDX license expression syntax allows a user defined license reference in the form LicenseRef followed by an identifier, optionally prefixed by a document reference. The package fields include a concluded license field that accepts a valid license expression, NONE or NOASSERTION. So a commercial component can carry a LicenseRef value that points to the agreement text you keep on file.
What to record per commercial component
| Field | Example content |
|---|---|
| Name and version | The SDK or library as shipped |
| Supplier | The company that licenses it to you |
| Agreement reference | Contract ID or LicenseRef to the stored text |
| Redistribution allowed | Yes or no, per the agreement |
| Where it ships | App, web bundle, container, internal only |
| Term and renewal date | So expiry does not surprise you |
Keep the agreement text in a controlled location and refer to it by ID. Avoid pasting commercial terms into public SBOMs.
Special cases
- Dual licensed vendor code. A vendor may offer an open source and a commercial option. Record which one you actually take. See dual licensed packages.
- Source available licenses. These are not open source by the usual definition. See is a source available license open source.
- Evaluation or trial code. Make sure trial licenses did not slip into production.
- Bought templates and fonts. Non code assets can carry limits too. See open fonts in commercial apps.
Keep two views
Internally, keep one inventory with a column for license family: open source permissive, open source copyleft, commercial, source available, unknown. For outside sharing, produce a cleaned export per audience. See SBOM versus software inventory for acquirers.
Try it yourself
Open the vulnerability management demo and note how components are tracked with attributes. The same list can carry a license family column for commercial parts.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM and dependency scanning and asset discovery help build the component list. Commercial terms live in your contracts, and counsel owns their interpretation.
Quick check
Can a LicenseRef point to a private contract?
Yes, as a reference ID. Keep the contract text in a controlled place and avoid publishing commercial terms.
Do internal only commercial tools belong in the inventory?
Track them in the internal view. Whether they appear in an outside export depends on the audience.
Sources
Last reviewed: 19 October 2026.
