Open-Source Software Notices

Version 2026-10 — Effective October 9, 2026

The Ploid platform (the "Services") is built with, and operated alongside, a large body of open-source software. Ploid AI Biotech, S.L. gratefully acknowledges the authors, maintainers, and communities behind these projects.

This document lists the principal third-party open-source components incorporated into or operated as part of the Services, together with their licenses. It is referenced from Section 9 of our End User License Agreement.

Each component listed here is the property of its respective copyright holders and is used under the terms of its own license. Nothing in this document grants you any right in those components beyond the rights their own licenses provide, and nothing here modifies those licenses. Where a license requires that its full text or copyright notice accompany the software, that text is available from the component's official project or on request (see the end of this document).

Scope and completeness. This is a good-faith, curated list of the primary components, and it does not enumerate every transitive dependency. The one part that is enumerated in full is the scientific analysis environment of Section 7: every component its container image installs by name is listed with its license in the Sandbox Software Inventory. A complete, machine-generated bill of materials (SBOM) for a given release, including transitive dependencies, is available on request from the contact below.

1. Summary of licenses in use

The components below are distributed under, among others, the following licenses:

• Permissive: MIT, BSD-2-Clause, BSD-3-Clause, ISC, Apache-2.0, the Python Software Foundation License (PSF-2.0), the PostgreSQL License, the Zlib license, and the SIL Open Font License (OFL-1.1).
• Weak copyleft: Mozilla Public License 2.0 (MPL-2.0), GNU Lesser General Public License (LGPL-2.1 / LGPL-3.0), the Artistic License 2.0 used by much of Bioconductor, and the GPL-with-classpath-exception used by the OpenJDK runtime.
• Strong copyleft: GNU General Public License (GPL-2.0 / GPL-3.0) and, for certain infrastructure components, referenced external components, and one document-processing library in the analysis sandbox, the GNU Affero General Public License (AGPL-3.0). See Sections 9 and 10.
• Source-available / open-core: the Redis Source Available License and Server Side Public License (Redis), and enterprise-edition terms bundled alongside an open core (SAML Jackson). See Section 11. Every scientific analysis program the Services run is open source, under an OSI-approved license.
• Content licenses on reference data. Separately from software licenses, public biological databases that analyses may query publish their data under terms of their own — Creative Commons licences (CC0, CC BY 4.0, CC BY-SA 3.0 and 4.0) or a provider's data-use policy. These attach to data, not code, and can require attribution from whoever publishes derived results. Reaching a database from a sandbox does not license its data; its publisher's terms govern use. See Section 12.
• Public domain: the NCBI tools produced by the U.S. Government (BLAST+, SRA Toolkit) are not under copyright.

2. Web application libraries (JavaScript / TypeScript)

Used across the Ploid web application and administration and evaluation front-ends. Related package families are grouped for brevity; every package in a grouped family shares the stated license.

Build tooling (used to build the front-ends; not shipped to the browser): Tailwind CSS, @tailwindcss/postcss and tw-animate-css (MIT); Biome (MIT OR Apache-2.0); TypeScript (Apache-2.0); DefinitelyTyped type stubs, @types/* (MIT).

3. Backend service libraries (Go)

Used across the core, compute, and database-migration services.

4. Backend service libraries (Python)

Used across the AI agent, conversion, MCP, and evaluation services.

Build/dev tooling (not shipped in runtime images): Ruff, pytest (MIT), pytest-asyncio, typeshed stubs (Apache-2.0). Python packages are installed with the uv package manager (Apache-2.0 OR MIT).

5. Workflow engine and plugin framework (JVM)

The compute tier executes scientific pipelines with the Nextflow workflow engine, extended by a first-party container-resolver plugin.

6. Bundled and vendored server software

Independent third-party programs deployed and operated as part of the platform on Ploid's own infrastructure. They are used unmodified except for configuration.

7. Scientific analysis tools and computing environments

The compute tier runs bioinformatics and statistical-genetics pipelines. The container images used for analysis bundle a large set of independent scientific programs and language packages, each invoked as a separate executable within a pipeline or loaded by the language runtime that installed it, and each governed by its own license.

Every one of these components is listed individually, with its license, in the Sandbox Software Inventory. That appendix covers all 204 components the analysis image installs by name — 25 command-line tools, 2 vendored analysis programs, 111 R packages and 66 Python packages — and its licenses are read from the built image rather than compiled by hand. The summary below is only an orientation to it.

Command-line tools. GATK (Apache-2.0); samtools, tabix, seqtk, fastp, BWA (MIT); bcftools (dual MIT or GPL-3.0); MAFFT (BSD-3-Clause); Trimmomatic, FastQC, PLINK 1.9 and 2, VCFtools, bedtools, FastTree, HMMER, Prodigal, MMseqs2, DIAMOND, Foldseek, CD-HIT, KIPEs, MYB_annotator (GPL-2.0 / GPL-3.0, in various versions); IQ-TREE (GPL-2.0-or-later); NCBI BLAST+ and SRA Toolkit (U.S. Government public domain, NCBI). The R language and its runtime are GPL-2.0-or-later. Every command-line tool in the image is open source.

Language-level scientific package sets. The 77 CRAN and 29 Bioconductor R packages are predominantly copyleft — GNU licenses and Bioconductor's Artistic-2.0 — with a substantial MIT minority. The 66 Python packages are predominantly permissive (BSD, MIT, Apache-2.0); the strongly copyleft ones are the pingouin statistics library, eight sequence-analysis and phylogenetics libraries (GPL-3.0) and pymupdf (AGPL-3.0, see Section 9). Five further R packages are compiled into the image from source repositories rather than from CRAN or Bioconductor. All are used unmodified.

Vendored analysis programs. The sandbox image clones a small number of analysis programs from their source repositories and invokes each as a standalone program, pinned to an exact upstream commit. Ploid modifies no component of this image, so nothing in it carries a modified-work obligation. Section A2 of the appendix lists them.

Pretrained model weights. No pretrained model weights are contained in any Ploid image, and Ploid does not redistribute any. Where an analysis needs a pretrained model, it is retrieved from its publisher into the customer's own sandbox at the customer's direction — the same posture as a package the customer installs at run time.

Reference and annotation data queried at run time. Analyses may query public biological databases — Reactome, ChEMBL, Gene Ontology, Ensembl, UCSC and NCBI among them. These are data sources rather than software, and several carry attribution terms independent of the license on the client library used to reach them. Reactome, ChEMBL and Gene Ontology content carries attribution requirements. Ploid does not redistribute any of this content and does not hold data licenses on customers' behalf; a customer publishing derived results is responsible for the attribution those terms require, and Section 12 gives the statements those licenses call for. The per-source table is in Section A7 of the appendix.

R and Python packages installed at run time. Sandboxes can install additional packages from CRAN, Bioconductor and PyPI into the customer's own sandbox at the customer's direction. Such packages are retrieved from the upstream repository, are not redistributed by Ploid and are not contained in any Ploid image; each remains subject to its own license. This includes the Reactome pathway stack, which is deliberately not shipped in the sandbox image on account of its size: ReactomePA (GPL-2.0) and the reactome.db annotation database (CC BY 4.0).

Completeness. The appendix lists what the image installs by name. Several hundred further packages are pulled in automatically as dependencies of those components; those are not individually enumerated, and the complete list with resolved versions and licenses for a given release is available in the generated SBOM on request.

8. Container base images, operating-system packages and tools

The Services run in Linux containers built on the following base images and system components.

Base images. Alpine Linux (MIT for musl libc; bundles BusyBox under GPL-2.0-only); Debian "slim" images used for the Python and Node.js builds (an aggregate of many licenses); the official Node.js (MIT), Go (BSD-3-Clause), Python (PSF-2.0), Eclipse Temurin / OpenJDK (GPL-2.0-with-classpath-exception), Amazon AWS CLI, and Docker CLI (Apache-2.0) images.

System packages and tools (installed via apk/apt or downloaded during the build), grouped by license:

• MIT / permissive: tini, jq, libuv, libxml2, fontconfig, HarfBuzz, Mesa and X11 client libraries, ncurses; the Info-ZIP unzip; the curl license (curl, libcurl); Zlib; zstd, HDF5, cmake (BSD); xz/liblzma (0BSD); bun (MIT); the uv installer (Apache-2.0 OR MIT).
• Apache-2.0: gosu, OpenSSL 3, puppeteer-core.
• Weak copyleft (LGPL / MPL): glibc, FriBidi, bubblewrap (LGPL); Pango, gdk-pixbuf, Cairo (LGPL, Cairo also MPL-1.1); the Mozilla CA certificate bundle in ca-certificates (MPL-2.0); LibreOffice Writer and Impress, run headless as an independent subprocess to render uploaded Word, PowerPoint and OpenDocument files as PDF for in-app preview (MPL-2.0, with bundled components under LGPL-3.0-or-later).
• Strong copyleft (GPL): git, iptables (GPL-2.0-only); procps, slirp4netns, the build-essential toolchain (GCC, GPL-with-exception); bash, wget (GPL-3.0-or-later); GNU Scientific Library and GLPK (GPL-3.0-or-later); libgit2 (GPL-2.0-with-linking-exception).
• Fonts and rendering: the Liberation fonts (OFL-1.1), Carlito and Caladea (OFL-1.1), DejaVu (Bitstream Vera), FreeType (FTL / GPL); Chromium used for server-side diagram and PDF rendering (BSD-3-Clause, with additional bundled components); the Mermaid CLI and KaTeX (MIT).

9. Copyleft components and how they are used

Some components above are licensed under copyleft terms (LGPL, GPL, AGPL). To the best of Ploid's understanding, these are used in ways consistent with those licenses:

• Operated, not distributed. The Services are provided as a hosted, software-as-a-service offering. Ploid does not distribute copies of these components to users. GPL and LGPL obligations that are triggered by distribution of the software are generally not triggered by operating it as a network service.
• Unmodified programs and dynamic linking. Copyleft programs (for example the Ory identity stack, PostgreSQL, LibreOffice, and the bioinformatics tools in Section 7) are used unmodified and are invoked as independent programs. Copyleft system libraries (for example glibc and other LGPL libraries) are dynamically linked in the manner their licenses contemplate.
• AGPL and network use. The one license that can extend obligations to network interaction is the AGPL, which does so through its Section 13. That section applies where a party makes a modified version of the program available to users interacting with it remotely over a network. Ploid modifies no AGPL-licensed component, and offers no AGPL-licensed component to users as a service in its own right. One AGPL-licensed library, PyMuPDF (dual-licensed by its publisher under AGPL-3.0 or an Artifex commercial license, and used by Ploid under the AGPL), is installed in the analysis sandbox image, where it is available unmodified to code a customer chooses to run in their own sandbox; it is listed in the sandbox software inventory. Redis is used under its non-AGPL license options (see Section 11). Certain external observability backends that are AGPL-licensed (Grafana, Grafana Mimir) are referenced only as external endpoints for Ploid's internal operational telemetry; they are not part of the Services delivered to users and are not distributed by Ploid.

This section states Ploid's good-faith understanding and is subject to confirmation by counsel; it is not a legal opinion.

10. html2text (GPL-3.0)

The html2text Python library (GPL-3.0-or-later) is used server-side by an internal service to convert fetched HTML to text. It is used unmodified as an independent library within a hosted service and is not distributed to users. Its source is available from its official project.

11. Software under source-available or open-core licenses

Two infrastructure components are not distributed under a standard permissive or copyleft open-source license, and are used subject to their own specific terms:

• Redis 8.4 is tri-licensed and may be used under the Redis Source Available License 2 (RSALv2), the Server Side Public License (SSPLv1), or AGPL-3.0-only. Ploid uses Redis unmodified as a cache and data store under these terms.
• BoxyHQ SAML Jackson is distributed as an open-source core (Apache-2.0) alongside enterprise-edition components governed by separate commercial licenses. Ploid uses it subject to the applicable terms for the features it enables.

No other component of the Services falls outside a standard open-source license. Every scientific analysis program the Services run is open source.

12. Required attributions and reference-data terms

Analyses running in a sandbox can query public biological databases. The license on a database is independent of the license on the client library used to reach it — the ChEMBL client library, for example, is Apache-2.0 while ChEMBL's own content is CC BY-SA 3.0. Several of these sources require attribution.

A sandbox's network allowlist decides which hosts it can reach; it grants no permission to use what they serve. Each database publishes its data under its own terms, and some are narrower than an open licence: a database may condition commercial use, embargo unpublished datasets, or require share-alike. Data a sandbox retrieves is used under its publisher's terms. The UCSC entry below covers its download server, for genome assembly data only; the UCSC Genome Browser software, which does require a commercial license, is neither installed nor used.

For the sources in the table below, Ploid does not redistribute any content, does not store it outside the sandbox that requested it, and does not hold data licenses on customers' behalf. Content is retrieved from its publisher, into the customer's own sandbox, at the customer's direction.

Reference databases the compute tier hosts are different, and are covered separately. Where a pipeline needs a reference database far too large to retrieve per run — a taxonomy, a protein or annotation database — Ploid may keep a copy in its own storage and make it readable by workflow runs. There the copy is ours and the hosting is ours, so those databases are enumerated, with the license and any attribution each one carries, in the Reference Database Notices. No database is made available to runs unless its own license permits that use, and none whose terms restrict commercial use is hosted at all.

If you publish results derived from any of these sources, hosted or retrieved, the attribution and licensing obligations are yours to meet.

The attribution statements these licenses call for:

• ChEMBL — "Data from ChEMBL, European Molecular Biology Laboratory — European Bioinformatics Institute (EMBL-EBI), used under CC BY-SA 3.0."
• Reactome — "Data from Reactome, used under CC BY 4.0."
• Gene Ontology — "Data from the Gene Ontology Consortium, used under CC BY 4.0."
• UniProt — "Data from UniProt, The UniProt Consortium, used under CC BY 4.0."
• AlphaFold DB — "Structure predictions from the AlphaFold Protein Structure Database, Google DeepMind and EMBL-EBI, used under CC BY 4.0."
• GTDB — "Taxonomy from the Genome Taxonomy Database (GTDB), used under CC BY-SA 4.0."
• SPIRE — "Data from SPIRE, European Molecular Biology Laboratory (EMBL), used under CC BY-SA 4.0."

Per-source detail, including which package in the analysis image reaches each one, is in Section A7 of the Sandbox Software Inventory.

13. External services

The Services rely on external services operated by third parties, which are not distributed by Ploid and are governed by their own terms: cloud infrastructure (compute, storage, and container registry providers) and third-party AI model providers accessed via their commercial APIs. See Section 9 of the End User License Agreement.

14. Contact and full inventory

To request the complete, machine-generated software bill of materials for a release, to obtain the full text of any license referenced here, or to report a suspected attribution error, contact:

Ploid AI Biotech, S.L. Email: legal@ploid.ai