I am designing a web app for a client who wants to keep some of his business rules private, we have an NDA. In a nutshell, customers use the app to book a service, and employees use it to keep track of bookings. Since the front end is public (and untrustworthy), all of the decisions that are determined by business rules have to happen on the server.

Now, if I use a very nice GPLv3 licensed module, then that SPA has to be licensed under a compatible license, like MIT, because the app (including the module) is being distributed to everyone who visits the site. That's fine, it isn't possible to hide anything on the front end anyways. I don't contribute enough back to the community, and I would love to release an example of a production grade SPA as open source. It would be a great way to start a blog.

The server would implement a publicly defined API, and the front end would work with any server that implements the API. I would include a simple server with the GPL licensed app so that it can be run by anyone. The server doesn't depend on the client, because could it could be replaced with curl.

What I am wondering is, in this scenario, could I keep my client's unique business rules private in a server app without violating the rules or intentions of the GPL?

  • 2
    Would it theoretically be possible to described the business rules of the customer with a configuration file?
    – Philipp
    Jan 17, 2014 at 16:42
  • Yes, but I wonder, when does a config file become code? When it starts expressing logical relations between data types? When it looks like a DSL?
    – Dan Ross
    Jan 17, 2014 at 16:48
  • Counter-example: You are using a GPL-licensed programming language interpreter for running the code of your website. Do you need to open-source the code you run in it? No. So why would you need to do the same with the DSL code interpreted by your framework?
    – Philipp
    Jan 17, 2014 at 17:10
  • Oh, right. I could open source the system that interprets the config file and distribute it. That would be really cool if I could isolate everything covered by the NDA to a single config file. Thank you! :D
    – Dan Ross
    Jan 17, 2014 at 17:17

2 Answers 2


Yes, you can keep your client's business rules private and no, you don't need to distribute the server side code.

If the server side services were using the GPL'd library, you would fall into a particular exception that doesn't consider hosting a web service as distribution.
Start with this question from the FSF FAQ.

A company is running a modified version of a GPL'ed program on a web site. Does the GPL say they must release their modified sources?
The GPL permits anyone to make a modified version and use it without ever distributing it to others. What this company is doing is a special case of that. Therefore, the company does not have to release the modified sources.

emphasis added

If it's the web app (the SPA in this case) that includes the GPL'd library, then it's important to remember that the web app has a separate license from the web services that are being provided. Since all of the confidential business rules are on the server, there is no risk of disclosure via GPL. The client license doesn't necessarily pertain to the server license.

Nothing within the spirit of the GPL would impose the GPL license upon the server just because a client is GPL'd.

Finally, if you're concerned that the API offered through the services may disclose something of a confidential nature, then wrap those services with a facade that obfuscates what is actually happening.

  • I saw that too, but I think the author is assuming that the GPL'ed program is server side. In my case it is a client side JS module, so I am distributing a copy of it to everyone who uses the site.
    – Dan Ross
    Jan 17, 2014 at 16:45
  • What? The confidential business rules are going into JavaScript that's being distributed? If that's the case, then the GPL requirements for distribution don't really matter from a confidentiality point of view. Poking into JavaScript is trivial.
    – user53019
    Jan 17, 2014 at 16:47
  • No, the business rules will only be in server side code. The GPL'ed module that I want to use is on the client side. It's raptor editor.
    – Dan Ross
    Jan 17, 2014 at 16:48
  • If it's only the SPA that would be affected by the GPL, then I don't understand your question. Nothing within even the spirit of the GPL would try force distribution of the non-GPL'd server side code. If you're worried that the API might expose something, then write a facade in front of the confidential stuff and obfuscate it that way.
    – user53019
    Jan 17, 2014 at 17:03
  • I was worried that the client and the server might be considered a single program, but I think you're right. Even if this was a desktop environment, the client and the server would be separate applications covered by different licenses. I spent so long looking at the GPL that my brain turned to mush.
    – Dan Ross
    Jan 17, 2014 at 17:08

You could export all confidential business rules to a configuration file which is interpreted by your server-sided framework. That way you could license the framework under GPL, while the business rules can be kept confidential. The business rules likely only apply to your one customer, and anyone else will likely want to replace them with their own business rules, so you are doing them a favor by giving them an obvious place to do so.

But keep in mind that this will make your software a lot more complex than just hardcoding the business rules. One could argue that it will pay off by making maintainance easier, but depending on how complex the business rules are, the opposite might be a case due to the inner plattform effect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.