What is the BSL (Business Source License) — and why does it keep showing up?

If you've shipped infrastructure code in the last few years, you've probably hit a BSL header at the top of a file and wondered: am I allowed to use this in my product? Short answer: yes — for almost everyone. Here's the longer answer.

What BSL actually is

The Business Source License (BSL or BUSL-1.1) is a source-available license created by MariaDB in 2013. The source code is publicly available — you can read it, audit it, fork it for personal use, contribute back. But there's an additional restriction layered on top: you can't use the software for a "production" use that competes with the original company's commercial offering.

The competitive restriction expires after a "change date" (typically 4 years from each version's release), at which point the version automatically converts to a true open source license like Apache 2.0 or MPL 2.0. So BSL is best described as "delayed open source" — the code becomes properly OSS, just on a timer.

Why companies adopt BSL

Permissive licenses (MIT, Apache) maximize adoption but allow downstream extraction: AWS can take MongoDB or Elasticsearch, package it as a managed service, and out-compete the original maintainer without contributing back. This is the "strip-mining" problem that drove the wave of relicensings between 2018-2024.

BSL gives commercial teams a middle ground: keep the source public for trust, audit, and contribution — but block hyperscalers from selling competing managed services. After 4 years the restriction lifts, so the long-term commons isn't permanently restricted.

Who uses BSL?

• —HashiCorp (Terraform, Vault, Consul, Nomad, Boundary) — moved from MPL 2.0 in 2023
• —Sentry — moved from Apache 2.0 in 2019, then to FSL in 2024
• —CockroachDB — BSL since launch
• —MariaDB MaxScale
• —Couchbase Server

Is BSL "open source"?

No — not by the OSI's Open Source Definition. The competitive restriction violates the "no discrimination against fields of endeavor" clause. It's better described as "source-available" or, optimistically, "delayed open source." Some commentators and Hacker News threads have spent enormous energy litigating this; for practical purposes, just call it BSL.

Practical guidance

If you're building a product that uses a BSL-licensed dependency: read your specific version's BSL terms (they vary slightly by company), and ask yourself whether your product directly competes with the original vendor's commercial offering. For 99% of teams the answer is no — you can use Terraform inside your Heroku-style PaaS without issue. For the 1% (you're literally building "hosted Terraform-as-a-service"), you have a problem.

Open Source Startups monitors every license change in our directory. If a project you depend on relicenses to BSL — or anything else — you'll see it on our /alerts feed within 24 hours.