Skip to main content
Overlay uses a split license model: The root repository files LICENSE.md, TRADEMARKS.md, and NOTICE.md remain the authoritative bundled legal files for source distributions.

​
Core Product License

The core product is licensed as AGPL-3.0-or-later unless a more specific package manifest or written agreement says otherwise. Core product surfaces include:
  • src/
  • convex/
  • workers/
  • overlay-desktop/
  • overlay-mobile/
  • overlay-chrome/, except explicitly Apache-licensed contract packages under overlay-chrome/packages/
For the official license terms, see the GNU AGPLv3 text and the SPDX identifier AGPL-3.0-or-later.

​
Apache Ecosystem Packages

Workspace packages under packages/* are licensed as Apache-2.0. The Chrome extension contracts package at overlay-chrome/packages/overlay-extension-contracts is also Apache-licensed. For the official license terms, see the Apache License 2.0 text and the SPDX identifier Apache-2.0.

​
Commercial License

Enterprises that want to build proprietary products on top of the AGPL core, avoid AGPL reciprocity obligations, buy support, or use managed private deployment terms should use a separate commercial license from LayerNorm Inc. Commercial licensing contact: [email protected]

​
Self-Hosting Notes

Self-hosting is allowed under the applicable license for the surface you use. Keep copyright, license, and notice files with the distribution. Modified deployments should be prepared to meet the source-availability obligations that apply to AGPL-covered code. Modified distributions must not use Overlay branding as their own product branding. Use a distinct name and visual identity unless LayerNorm Inc. gives written trademark permission. This document is implementation guidance for the repo, not legal advice. Confirm public release and enterprise distribution terms with counsel before launch.

​
Verification

Run:
The check verifies first-party license metadata, required legal docs, and runtime dependency license declarations in package-lock.json. Risky dependency licenses must be documented in scripts/license-allowlist.json with a reason.