Jusletter IT

Software as a Service (SaaS) is a service model where software is hosted centrally allowing the customer to access the soft-ware (only) over the Internet, e.g. via web browser. SaaS is based on application service providing (ASP) but takes advantage of the vast web development and deployment of the past two decades. ¹

The GNU General Public License, version 3 (GPLv3)² is a free, copyleft license for software and other works. Free means that the licensor grants the licensee the right to distribute copies and/or to create derivative works thereof. In addition, if the licensor creates derivative works for third parties, he is obliged to offer them the source code.³

If you develop software licensed under GPLv3 and offer it as SaaS, does this mean that each customer is entitled to receive the source code of the software and change it?

A licensee is entitled to receive the source code under GPLv3 if the software was «conveyed». To convey means any kind of propagation that enables other parties to make or receive copies. Consequently, mere interaction with a user through a computer network, with no transfer of a copy of the software, is not conveying.⁴ Any propagation of the software that at the same time does not fulfill the definition of «to convey» is permissible without further license obligations.⁵

A customer that accesses a software application under SaaS does not make or receive a copy of the software. The software code remains on the SaaS server. The customer‘s computer might make a temporary (cache) copy of parts of the software application, in which case, however, it is qualified (merely) as ephemeral copy that is legally permissible (art. 24a Copyright Act). Or the access to an application under SaaS is qualified as enjoyment of the work, which cannot be prohibited.⁶

The GNU Affero General Public license, version 3 (AGPLv3)⁷ is a modified version of the (ordinary) GPLv3. In its preamble, AGPLv3 claims that «[GPL] permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.» (i.e. ASP loophole). AGPLv3 has been released to close the loophole perceived when offering software under GPL over a computer network as described above. This loophole is closed in section 13 AGPLv3, which foresees that if the SaaS provider modifies the GPL software, such modified version must prominently offer all users interacting with it remotely through a computer network an opportunity to receive the corresponding source code.

Hence, the answer to the initial question is therefore no, under GPLv3 the SaaS supplier is not obliged to provide the software code to its customers, provided that the customers neither receive nor make a copy of the software. In my opinion, only relying on a contractual obligation for prohibiting the customers from making copies of the software is insufficient. I also recommend implementing technical measures to prevent copying of the software from the SaaS server.

If on the other hand you wish to establish a strong copyleft for software applications offered over a computer network, then you should license the code under AGPLv3.

Daniel Ronzani