Open-source attributions
1. Scope
This page covers third-party software shipped or served as part of our products (runtime dependencies, ML models, fonts, stylesheets, JavaScript libraries). It does not enumerate development-only tools, operating-system packages, or the hosted services we contract with — those are listed on our Subprocessors page.
Where a component ships under a permissive licence (MIT, BSD, ISC, Apache-2.0, PostgreSQL, SIL OFL-1.1), we reproduce the upstream copyright notice below and link to the full licence text maintained by the author. Where a component ships under a copyleft licence (e.g. LGPL, MPL) we disclose that fact and either dynamically link to it or provide the corresponding source on request at [email protected].
2. Application framework & web stack
- FastAPI — Copyright © Sebastián Ramírez. Licensed under the MIT Licence.
- Starlette — Copyright © Encode OSS Ltd. Licensed under the BSD-3-Clause Licence.
- Uvicorn — Copyright © Encode OSS Ltd. Licensed under the BSD-3-Clause Licence.
- Pydantic & pydantic-settings — Copyright © Samuel Colvin and contributors. Licensed under the MIT Licence.
- Jinja2 — Copyright © Pallets. Licensed under the BSD-3-Clause Licence.
- itsdangerous — Copyright © Pallets. Licensed under the BSD-3-Clause Licence.
- httpx — Copyright © Encode OSS Ltd. Licensed under the BSD-3-Clause Licence.
- python-multipart — Copyright © Andrew Dunham. Licensed under the Apache-2.0 Licence.
- Authlib — Copyright © Hsiaoming Yang. Licensed under the BSD-3-Clause Licence.
- python3-saml — Copyright © OneLogin, Inc. Licensed under the MIT Licence.
- passlib — Copyright © Assurance Technologies, LLC. Licensed under the BSD Licence.
- pyotp — Copyright © Mark Percival and contributors. Licensed under the MIT Licence.
- cryptography — Copyright © Individual contributors, The Python Cryptographic Authority. Dual-licensed under the Apache-2.0 or BSD-3-Clause licences.
-
email-validator,
phonenumbers,
python-dotenv,
python-json-logger,
concurrent-log-handler,
prometheus-client,
markdown,
nh3,
json-repair,
pysbd,
zstandard —
various authors; all shipped under permissive MIT /
BSD / Apache-2.0 licences. Full notices are reproduced
in the
NOTICEfiles accompanying the installed Python packages.
3. Retrieval, embeddings & ML runtime
- Qdrant (vector database) and qdrant-client — Copyright © Qdrant Solutions GmbH. Licensed under the Apache-2.0 Licence.
- PostgreSQL — Copyright © The PostgreSQL Global Development Group. Licensed under the PostgreSQL Licence.
- asyncpg — Copyright © MagicStack Inc. Licensed under the Apache-2.0 Licence.
- fastembed — Copyright © Qdrant. Licensed under the Apache-2.0 Licence.
- sentence-transformers — Copyright © UKPLab. Licensed under the Apache-2.0 Licence.
- flashrank — Copyright © Prithiviraj Damodaran. Licensed under the Apache-2.0 Licence.
- langchain-text-splitters — Copyright © LangChain, Inc. Licensed under the MIT Licence.
- tiktoken — Copyright © OpenAI. Licensed under the MIT Licence.
- lingua-language-detector, fast-langdetect — Apache-2.0; upstream notices retained.
- detect-secrets — Copyright © Yelp, Inc. Licensed under the Apache-2.0 Licence.
The retrieval pipeline also loads pretrained model weights at runtime. Those are distributed under their own licences and are attributed in §5 below; we do not redistribute the weights themselves — they are downloaded from Hugging Face on first boot.
4. Document parsing & ingestion
-
PyMuPDF (
pymupdf,pymupdf4llm) — Copyright © Artifex Software, Inc. Licensed under the GNU AGPL-3.0. PyMuPDF is AGPL-licensed; we use it unmodified via its public Python API only and do not redistribute modified binaries. The corresponding source for the version we deploy is available from the upstream release matching the version string pinned in ourrequirements.txt. A copy can also be obtained on written request to [email protected]. - python-docx — Copyright © Steve Canny. Licensed under the MIT Licence.
- openpyxl — Copyright © Eric Gazoni, Charlie Clark. Licensed under the MIT Licence.
- xlrd — Copyright © Stephen John Machin and contributors. Licensed under the BSD-3-Clause Licence.
5. Third-party model weights
- BAAI/bge-reranker-v2-m3 — the cross-encoder reranker model weights produced by the Beijing Academy of Artificial Intelligence. The weights are distributed under the MIT Licence on Hugging Face. The model is loaded from its upstream repository at runtime; we do not redistribute the weights.
- BAAI/bge-small-en-v1.5 and related multilingual embedding models — MIT-licensed, fetched from Hugging Face on demand.
- Any hosted models we use are called over their vendors' own APIs under paid or enterprise terms; no model weights are shipped with our product and no open-source licence attaches. The authoritative list of vendors is maintained on the Subprocessors page.
6. API clients for paid services
- openai — Copyright © OpenAI. Licensed under the Apache-2.0 Licence.
- google-genai, google-api-python-client, google-auth-oauthlib, google-auth-httplib2 — Copyright © Google LLC. Licensed under the Apache-2.0 Licence.
- cohere — Copyright © Cohere Inc. Licensed under the MIT Licence.
- stripe (optional fallback provider; Paddle is our default Merchant of Record) — Copyright © Stripe, Inc. Licensed under the MIT Licence.
- resend — Copyright © Resend, Inc. Licensed under the MIT Licence.
- aiosmtplib — Copyright © Cole Maclean. Licensed under the MIT Licence.
- boto3 & botocore — Copyright © Amazon.com, Inc. Licensed under the Apache-2.0 Licence.
- msal (Microsoft Authentication Library) — Copyright © Microsoft Corporation. Licensed under the MIT Licence.
7. Frontend: styles, scripts, fonts, icons
- Tailwind CSS — Copyright © Tailwind Labs Inc. Licensed under the MIT Licence.
- Alpine.js — Copyright © Caleb Porzio and contributors. Licensed under the MIT Licence.
- Inter (typeface) — Copyright © The Inter Project Authors ([email protected]). Licensed under the SIL Open Font Licence 1.1.
- Heroicons — Copyright © Tailwind Labs Inc. Licensed under the MIT Licence.
8. How to obtain source or licence text
Every component above is installed from its upstream package registry (PyPI, npm, Hugging Face, the operating system distribution, or a CDN). The unmodified upstream source is available at the link accompanying each entry. Where a licence requires us to make the exact source corresponding to the version we deploy available — most notably the AGPL-3.0 PyMuPDF binaries — a copy can be obtained free of charge by writing to [email protected] with the subject line "OSS source request".
We refresh this page whenever a dependency is added, removed or materially upgraded. The effective date at the top of this page reflects the most recent review.
9. Contact
Licence or attribution questions: [email protected].