ClauLock
Copyright (c) 2026 Jesús E. Viera

This product is released under a split licensing model. Different parts of
this repository are covered by different licenses. The full text of each
license is included in the repository root.

================================================================================
Part A — Apache License, Version 2.0 (see LICENSE-APACHE)
================================================================================

The following paths are licensed under the Apache License, Version 2.0. These
components define the cryptographic properties, the on-disk vault format, and
the Claude Code hook protocol that implement the never-reveal invariant. They
are published under a permissive license so that third parties can audit and
re-use the security primitives independently of the rest of the product.

  crates/clsec-crypto/**       XChaCha20-Poly1305 + Argon2id + key hierarchy
  crates/clsec-vault/**        .clsec-vault portable file format
  plugin/hooks/**              PreToolUse / PostToolUse Claude Code hooks
  tests/leak_test.sh           Never-reveal invariant CI check
  LICENSE-APACHE               Full license text

================================================================================
Part B — Business Source License 1.1 (see LICENSE-BSL)
================================================================================

Everything else in this repository is licensed under the Business Source
License 1.1, with a Change Date of 2030-05-01 and a Change License of the
Apache License, Version 2.0. After the Change Date, the BSL portions of this
repository will automatically convert to Apache-2.0.

Covered paths (non-exhaustive; any file in these trees not explicitly listed
in Part A is BSL-covered):

  crates/clsec-cli/**
  crates/clsec-daemon/**
  crates/clsec-exec/**
  crates/clsec-scrub/**
  crates/clsec-keystore/**
  crates/clsec-proto/**
  crates/clsec-ipc/**
  crates/clsec-mcp/**
  ui/**
  site/**
  packaging/**
  scripts/**
  docs/**
  .github/**
  Cargo.toml
  Cargo.lock
  README.md
  SECURITY.md
  BRAND.md
  CLA.md

The Additional Use Grant in LICENSE-BSL permits any non-production use and
permits production use inside your own organization. It does NOT permit
offering the Licensed Work as a commercial hosted or managed service that
competes with ClauLock's paid offerings.

================================================================================
Part C — Proprietary components (NOT in this repository)
================================================================================

ClauLock Pro and Enterprise features are distributed from a separate, private
repository under a proprietary End User License Agreement. They are NOT open
source, NOT source-available, and are NOT covered by Part A or Part B above.
These components include, without limitation:

  - License key verification (ed25519, offline)
  - Billing service and Stripe webhook handlers
  - Hosted vault sync server (E2EE)
  - Policy engine (YAML-driven approval rules)
  - Breach detection integrations (GitHub secret scanning, HIBP, etc.)
  - SOC 2 / HIPAA audit exports
  - PKCS#11 / YubiKey / AWS KMS KDF adapters
  - Tamper-evident hash-chain audit log
  - Enterprise Companion UI components (team vaults, SSO, SCIM)

Binaries compiled with enterprise features enabled are covered by the EULA
distributed with them.

================================================================================
Trademarks
================================================================================

"ClauLock", "clsec", "clsecd", and the ClauLock logo are trademarks of
Jesús E. Viera. Neither the Apache-2.0 nor the BSL license grants trademark
rights. See BRAND.md for the current trademark policy, including what
downstream forks and redistributions may and may not call themselves.

================================================================================
Third-party software
================================================================================

This product depends on third-party Rust crates and JavaScript packages
listed in Cargo.lock and ui/package-lock.json. Each of those dependencies is
distributed under its own license. See the SBOM attached to each release
(format: CycloneDX) for the authoritative inventory and license mapping.

================================================================================
Contact
================================================================================

Legal and licensing questions: legal@claulock.com
Security reports: see SECURITY.md
