Open code.
Paid convenience.
The whole codebase is AGPL-3.0 — both editions, one tree. What a license buys is what a rebuild cannot reproduce: signed baked binaries, the update channel, support, and compliance artifacts. The ladder binds signed-binary customers only; anyone may build the Enterprise edition and self-issue against their own key. The honor system cuts both ways, on purpose.
The ladder
one binary · signed licenses- The OSS build — everything a single box needs
- One root, full read/write/exec/pty surface
- Accounts, grants, sessions, API tokens
- Shares, the WebDAV mount, media previews
- Plugins, mutations ledger, signed releases
- AGPL-3.0-only, forever
- The mass-market converter: multiple roots + OIDC
- Session recording (the differentiator, not the headline)
- Trusted-proxy header verifier
- Signed build + update channel
- Pro, plus fleet management
- Full-scope ledger (who read what, when)
- LDAP verifier
- Client mTLS at the TLS handshake
- Everything: SAML, Kerberos,
["*"]entitlements - Tier caps, account and root ceilings
- On-prem self-issuance against your own key
- Support and compliance artifacts
A five-person workshop that wants the Pro set without per-seat math and procurement has its own shape: the small-business license — the whole Pro capability set, one install, one flat annual price.
| capability | wire name | oss | pro | team | ent |
|---|---|---|---|---|---|
| Multiple roots | multiple_roots | — | ✓ | ✓ | ✓ |
| Fleet management | fleet | — | — | ✓ | ✓ |
| LDAP verifier | verifier_ldap | — | — | ✓ | ✓ |
| Kerberos verifier | verifier_kerberos | — | — | — | ✓ |
| OIDC verifier | verifier_oidc | — | ✓ | ✓ | ✓ |
| SAML verifier | verifier_saml | — | — | — | ✓ |
| Proxy-header verifier | verifier_proxy | — | ✓ | ✓ | ✓ |
| Client mTLS | mtls | — | — | ✓ | ✓ |
| Session recording | session_recording | — | ✓ | ✓ | ✓ |
Ledger full scope | ledger_full_scope | — | — | ✓ | ✓ |
| Share write bit | share_write_bit | reserved | reserved | reserved | reserved |
| Enterprise support | enterprise_support | — | — | — | ✓ |
Edition-independent and fully usable in the free build: one root with the complete read/write/exec/pty surface, engine-local accounts (passkey, password+TOTP, PAM import), sessions, API tokens, the mutations-scope ledger, and plugins. "Reserved" wire names are schema-stable placeholders for capabilities no binary ships yet — no license can switch one on.
What money actually buys
the sftpgo shapeReleases ship as Ed25519-signed artifacts for x86-64 and arm64, in both editions. The shipped binary carries its own verifier — an OSS signature cannot be swapped onto an Enterprise build. License customers get the built artifacts; source remains open for everyone.
Signed releases on a known channel, with upgrade notes. Self-built installs are on their own cadence — which is the point of self-building.
Enterprise support, and the paperwork regulated environments need
from their vendors. Degradation is never a cliff: an Enterprise build
without a valid license degrades — loudly — to exactly the free
capability set and self-declares on /status.
Pricing questions
asked and answeredIf the code is AGPL, why pay at all?
Can I build the Enterprise edition myself?
enterprise
cargo feature builds it. On-prem installs can set
[license] issuer_public_key to their own key and issue
their own licenses: a deliberate, operator-managed trust decision. The
ladder of plans applies to licenses we sign.How do I try the paid surface?
/status. Licensing re-checks live every five minutes — a
license that lapses mid-run degrades the running install, with the
transition in the ledger, and recovers the same way.What stops a license from lying?
Are accounts and roots metered?
max_accounts,
max_roots — enforced where the mutations happen and shown
live on /status as ceilings. Existing accounts
are never evicted; a lapsed ceiling degrades extra roots read-only
rather than truncating them.