Evaluation terms & access

This page is a signpost, not a term. It says where the documents that govern your copy of SBOMFlow already are, and who to ask for the ones that are not shipped with it. It restates, grants and varies nothing, and reading it is not reading them.

The licence notice travels with your copy#

SBOMFlow is proprietary. It is deliberately not an Open Source Initiative licence, and the package metadata records that as the SPDX expression LicenseRef-Proprietary so the boundary is explicit to any tool that reads it.

The notice itself is in every copy you receive:

From an install, print it without hunting for the directory:

python -c "from importlib.metadata import distribution; print(distribution('sbomflow').read_text('licenses/LICENSE'))"

That notice is the only authority on what your copy permits. Nothing in this documentation set summarises it, and no SBOMFlow command interprets it.

An entitlement file is not the licence#

sbomflow license inspect|verify|status|install reads a signed entitlement file. That is a different object from the licence notice, and confusing the two is easy because the command shares its name:

• an entitlement is read-only status, never permission. SBOMFlow enforces no licensing: an absent, expired or revoked entitlement blocks no command, and the evidence bytes of a licensed and an unlicensed run are identical;
• installing one grants no rights and settles no legal question. It records where a delivered file lives;
• sbomflow license status on a machine with nothing installed reports no_entitlement. That is a statement about a file, not about your terms.

The command's own help carries the same pointer this page does, so the CLI and the documentation cannot come to name different places. For the delivery-to-first-run sequence see Licensing & entitlements.

Getting a copy to evaluate#

Access is invite-only while the product is in its private-tester phase. Installation & access has the request route, the digest to check before you install anything, and what that digest does and does not prove. Approved testers also receive, alongside the build, the written list of restrictions that applies to it.

Terms that are not published here#

The terms for an evaluation, a pilot or a design-partner arrangement — and the prices attached to them — are not published in this documentation. Request them from hello@sbomflow.com, saying which of the three you are considering. That address is the only public one; it is also where a security report goes.