Open source
The core is AGPL-3.0. Everything that runs inside a customer's site or code is Apache-2.0.
AGPL-3.0 core
The api, worker, scheduler, ingest and the compose stack are AGPL-3.0. Run it on your own hardware, read the source, modify it. If you serve a modified version to others over a network, AGPL asks you to publish those changes.
Apache-2.0 at the edges
The messenger widget, the protocol package, the SDKs and the API clients are Apache-2.0, so a customer embedding the widget in a proprietary site takes on no AGPL obligation for that site.
Commercial features
Enterprise extensions such as SSO/SAML, SCIM and audit export live under ee/ and carry their own license. The core never imports them, so the OSS image builds with ee/ deleted.
The managed cloud
The cloud control plane that provisions managed cells is not open source. Self-hosting is the reference deployment; the cloud runs the same image.