# Business Source License 1.1

## Parameters

**Licensor:** Keygraph, Inc.

**Licensed Work:** Shannon  
The Licensed Work is (c) 2024 - 2025 Keygraph, Inc.

**Additional Use Grant:** You may make use of the Licensed Work, provided that you may not use the Licensed Work for a Restricted Commercial Service.

A "Restricted Commercial Service" includes any of the following:

1. **Commercial Penetration Testing Services**: Offering penetration testing, security auditing, or vulnerability assessment services to third parties (other than your employees and contractors) where Shannon is used as part of the service delivery.

2. **Hosted Shannon Platform**: Operating a managed service or hosted platform that allows third parties (other than your employees and contractors) to access Shannon's functionality, APIs, or penetration testing capabilities through that managed service.

3. **Compliance and Audit Services**: Using Shannon to provide compliance audits, regulatory security assessments, or certification services (such as SOC2, PCI-DSS, ISO 27001, HIPAA, or similar frameworks) to third parties as a commercial offering.

4. **GRC Platform Integration**: Bundling, integrating, or embedding Shannon into a Governance, Risk, and Compliance (GRC) platform, security platform, or similar product that is sold, licensed, or provided as a service to third parties.

**Permitted Use:** For the avoidance of doubt, the following scenarios are explicitly permitted under this license and do not constitute a "Restricted Commercial Service":

- Using Shannon to test your own applications, infrastructure, or systems in any environment (development, staging, production)
- Using Shannon within your organization for internal security testing by your employees and contractors
- Academic research, security research, or educational purposes
- Contributing to Shannon's development or creating derivative works for your own use
- Using Shannon to learn penetration testing or security research skills
- Testing applications you are developing or maintaining, whether commercial or non-commercial
- Internal security teams using Shannon for their organization's security program

**Not Permitted:** For the avoidance of doubt, the following scenarios are not permitted under this license:

- Security consulting firms using Shannon to deliver penetration testing services to clients
- Managed security service providers (MSSPs) using Shannon as part of their service offerings
- Offering "Pentesting-as-a-Service" powered by Shannon
- Including Shannon in a commercial security scanning or testing product sold to customers
- Building a multi-tenant Shannon platform that customers can access
- Using Shannon to generate compliance reports or certifications that you sell to third parties

**Change Date:** 4 years after release

**Change License:** Apache License, Version 2.0

---

## Notice

The Business Source License (this document, or the "License") is not an Open Source license. However, the Licensed Work will eventually be made available under an Open Source License, as stated in this License.

License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.  
"Business Source License" is a trademark of MariaDB Corporation Ab.

---

## Terms

The Licensor hereby grants you the right to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work. The Licensor may make an Additional Use Grant, above, permitting limited production use.

Effective on the Change Date, or the fourth anniversary of the first publicly available distribution of a specific version of the Licensed Work under this License, whichever comes first, the Licensor hereby grants you rights under the terms of the Change License, and the rights granted in the paragraph above terminate.

If your use of the Licensed Work does not comply with the requirements currently in effect as described in this License, you must purchase a commercial license from the Licensor, its affiliated entities, or authorized resellers, or you must refrain from using the Licensed Work.

All copies of the original and modified Licensed Work, and derivative works of the Licensed Work, are subject to this License. This License applies separately for each version of the Licensed Work and the Change Date may vary for each version of the Licensed Work released by Licensor.

You must conspicuously display this License on each original or modified copy of the Licensed Work. If you receive the Licensed Work in original or modified form from a third party, the terms and conditions set forth in this License apply to your use of that work.

Any use of the Licensed Work in violation of this License will automatically terminate your rights under this License for the current and all other versions of the Licensed Work.

This License does not grant you any right in any trademark or logo of Licensor or its affiliates (provided that you may use a trademark or logo of Licensor as expressly required by this License).

TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

MariaDB hereby grants you permission to use this License's text to license your works, and to refer to it using the trademark "Business Source License", as long as you comply with the Covenants of Licensor below.

---

## Covenants of Licensor

In consideration of the right to use this License's text and the "Business Source License" name and trademark, Licensor covenants to MariaDB, and to all other recipients of the licensed work to be provided by Licensor:

1. To specify as the Change License the GPL Version 2.0 or any later version, or a license that is compatible with GPL Version 2.0 or a later version, where "compatible" means that software provided under the Change License can be included in a program with software provided under GPL Version 2.0 or a later version. Licensor may specify additional Change Licenses without limitation.

2. To either: (a) specify an additional grant of rights to use that does not impose any additional restriction on the right granted in this License, as the Additional Use Grant; or (b) insert the text "None".

3. To specify a Change Date.

4. Not to modify this License in any other way.

---

## Questions?

Not sure your use case is covered by this license? Email [legal@keygraph.io](mailto:legal@keygraph.io).
**Shannon Pro** is our commercial edition with **unlimited commercial use**.
