Open Source Licenses
Last updated: 06/12/2026
PlotCipher is built with the open-source software listed below. We're grateful to the maintainers of these projects. Each package is used under the terms of its respective license; click the project URL for the full license text.
The inventory below is maintained manually and refreshed on each release. A full SBOM (Software Bill of Materials) is available to enterprise customers under NDA via mark@tryplotcipher.com.
Frontend (Next.js)
| Package | Version | License | Purpose |
|---|---|---|---|
| next ↗ | 16.2.0 | MIT | React framework / App Router |
| react ↗ | 19.2.4 | MIT | UI library |
| react-dom ↗ | 19.2.4 | MIT | React DOM renderer |
| next-auth ↗ | 4.24.13 | ISC | Authentication |
| mapbox-gl ↗ | 3.20.0 | Proprietary | Map rendering (commercial license) |
| react-map-gl ↗ | 8.1.0 | MIT | React bindings for Mapbox |
| lucide-react ↗ | 0.577.0 | ISC | Icon set |
| @react-pdf/renderer ↗ | 4.5.1 | MIT | PDF generation |
| bcrypt ↗ | 5.1.1 | MIT | Password hashing (Node) |
| tailwindcss ↗ | 4.x | MIT | CSS framework |
| typescript ↗ | 5.x | Apache-2.0 | Language tooling |
| eslint ↗ | 9.x | MIT | Linting |
Backend (FastAPI)
| Package | Version | License | Purpose |
|---|---|---|---|
| fastapi ↗ | 0.115.0 | MIT | Web framework |
| uvicorn ↗ | 0.30.6 | BSD-3 | ASGI server |
| gunicorn ↗ | 23.0.0 | MIT | WSGI process manager |
| sqlalchemy ↗ | 2.0.36 | MIT | ORM / SQL toolkit |
| asyncpg ↗ | 0.30.0 | Apache-2.0 | Async Postgres driver |
| psycopg2-binary ↗ | 2.9.10 | LGPL-3 | Sync Postgres driver |
| pandas ↗ | 2.2.3 | BSD-3 | Tabular data |
| geopandas ↗ | 1.0.1 | BSD-3 | Geospatial dataframes |
| shapely ↗ | 2.0.6 | BSD-3 | Geometry library |
| pyarrow ↗ | 18.1.0 | Apache-2.0 | Parquet I/O |
| pydantic ↗ | 2.10.3 | MIT | Data validation |
| bcrypt ↗ | 4.2.0 | Apache-2.0 | Password hashing (Python) |
| stripe ↗ | 11.4.1 | MIT | Stripe API client |
| openai ↗ | 1.57.0 | Apache-2.0 | OpenAI API client |
| python-dotenv ↗ | 1.0.1 | BSD-3 | Env-var loading |
License compliance
We comply with the attribution, copy-of-license, and source-availability requirements of every package above. For LGPL-licensed components, we link dynamically and do not modify the library source. Any GPL-licensed component would be flagged here; currently none ship in the Service.
Mapbox notice
Mapbox GL JS is used under a commercial license; the JS bundle is open source under Mapbox's terms of service, and access to map tiles is governed by our Mapbox commercial agreement.
Reporting
If you believe a license is incorrectly attributed or missing, email mark@tryplotcipher.com.