Self-hosting
The same software as on nisd2.eu, on your own servers. The source is open to licensees: you get the repository, the container image and every future update, for any number of organisations and users, paid once.
- Read access to the repository with the platform's complete source
- The container image for Docker, amd64 and arm64, with a software bill of materials (SBOM) and provenance
- Every new version and every security patch for as long as we maintain the software, at no further charge. Applying them is your job
- Written support for installation, operation and updates, usually answered within one working day
- The right to read the code and adapt it for your own operation
- Any number of organisations and users, no seats
- No licence key, no activation, nothing phoning home
Self-host licence: €20,000 net, one-time. Perpetual, any number of organisations and users, every update included for as long as we maintain the software.
You apply updates yourself: pull the new image, the migration runs at start. We do not reach into your installation from outside.
Setup on your infrastructure by us, if you want it: €500 net, one-time. It needs a Docker host or a virtual machine, not a NAS.
By invoice, 30 days to pay. VAT follows your VAT number: in Germany with German VAT; in other EU states with a VAT number confirmed in the EU register without German VAT (reverse charge); outside the EU without German VAT.
Up to version v0.2.12 the software was published under AGPL-3.0; those versions remain free. Under AGPL a licence sold a right everyone already had, and organisations that must keep their documents in-house wanted a licence they could pay for and put through procurement.
The fee funds maintenance, security work and our duties under the Cyber Resilience Act. And it turns anonymous downloads into named contract partners we can reach when a vulnerability is found.
If you cannot afford the fee, say a welfare organisation, a municipality or an association, write to us. At our discretion we also grant licences free of charge; the content of the licence is the same.
- Non-exclusive, perpetual, for any number of organisations and users. For the licensee's own operation and that of its affiliated companies; a service provider it engages may run the software for it. Transferable to a legal successor who continues the business.
- The right of use arises with payment and is fully performed with it. We may end maintenance (updates, support) with twelve months' notice; the right of use stays.
- No passing on, sublicensing or publishing of the source, the image or access credentials. No operation as a service for third parties; a separate licence exists for service providers. Copyright and licence notices stay, including the one in the user interface. The name and logo are used only there and to refer to the software.
- We inform licensees about vulnerabilities we fix no later than with the patch, and about actively exploited ones without undue delay. Licensees report vulnerabilities to us at security@nisd2.eu; reports to authorities are unaffected.
- The data model and the schemas stay open (code MIT, content CC BY 4.0), course content under CC BY 4.0, third-party components under their own licences.
- You receive the full licence text with the offer; it is also in the repository (LICENSE).
The data structures the platform works with stay published at github.com/NISD2: the GRC data model, the Article 23 notification schema and the supplier questionnaire, code under MIT and content under CC BY 4.0.