MongoDB SSPL risk review.

Why the MongoDB SSPL still needs a review

MongoDB moved to the Server Side Public License in 2018, which makes it the earliest of the major source available moves. Years on, the exposure is easy to forget precisely because the change is old. Teams adopted MongoDB, the license shifted under them, and the deployment kept running. A MongoDB SSPL risk review brings that quiet exposure back into view and tells you, in plain terms, whether your current use sits inside the obligations the Server Side Public License creates. Source available is not the same as open source, and the Server Side Public License is not approved by the Open Source Initiative.

Where the sharpest exposure sits

The Server Side Public License attaches conditions to offering the program itself as a service to third parties. The sharpest exposure is therefore for organizations that expose MongoDB as a managed or hosted service to outside parties rather than using it as an internal datastore. Internal production use sits in a different posture. The review clarifies which posture you are actually in, because the difference between the two is the difference between a contained question and an open ended one. We also flag any embedded or resold scenarios, where MongoDB ships inside a product you distribute.

What the review covers

We map every MongoDB instance and every component that depends on it, direct and transitive. We document the version, the license state, and the deployment pattern for each. We then size the exposure and lay out the options, from staying on a commercial agreement to migrating toward a permissively licensed alternative. The output is a defensible record you can take to a vendor, an auditor, or your board. The review is confidential and buyer side. We are paid only by you, so the findings serve your decision alone.

Where this fits

A MongoDB SSPL risk review is one engagement within our full set of open source license risk services. To understand the wider database licensing picture, including Redis and Elastic, see our pillar on the Redis and Elastic database license changes. For the underlying pattern across vendors, read about relicensing exposure, and to define the term itself, see our glossary entry on the source available license. Worked examples are in our case studies.