Open Source Usage Policy

Prodia Systems Ltd ("Prodia") makes extensive use of open source software and contributes back where appropriate. This policy governs how open source components are introduced into the Prodia platform, how their licence obligations are discharged, and how exposure to open source within generated outputs is managed.

1. Approval and inventory

• Every third-party component introduced into Prodia repositories or model registries is recorded in a software bill of materials (SBOM) generated automatically at build time.
• Components are scanned for licence, vulnerability, malware and provenance signals before merge.
• Categorical approval is granted in advance for permissive licences (MIT, BSD-2/3, ISC, Apache-2.0). Copyleft licences (LGPL, MPL, EPL, GPL family, AGPL, SSPL, RPL) are reviewed on a case-by-case basis and may be excluded from the production codebase.

2. Licence compliance

• Notices, copyright statements and licence texts of incorporated components are made available with the Service in accordance with the relevant licences.
• Source code disclosure obligations triggered by reciprocal licences (where any such component is exceptionally permitted) are honoured.
• Patent grants, defensive termination clauses and attribution requirements are tracked per component.

3. Contributions to upstream projects

• Contributions made by Prodia personnel to upstream open source projects require approval to ensure no proprietary code, model weight, prompt, or trade secret is disclosed.
• Where a CLA or DCO is required, it is reviewed against the IP assignment regime described in the Corporate Governance statement.

4. Open source within generated outputs

• Prodia's agents are configured to prefer authoritative, licence-clean sources and to record provenance for snippets and patterns surfaced into customer repositories.
• Customers remain responsible for the licence posture of code committed to their repositories, including code proposed by Prodia. The platform surfaces detected licence signals to support that review.
• Use of generative outputs in a manner that violates an upstream open source licence is prohibited under the Acceptable Use Policy.

5. Security and maintenance

Open source components are monitored for newly disclosed vulnerabilities. Patching timelines are governed by the Security Policies and the Vulnerability Disclosure process.