Legal FAQ - Free-Tier Quota & BUSL-1.1 Additional Use Grant

Operational behaviour (limits, counters, delays) is documented in 30_QUOTA_ENFORCEMENT_FLOW1.md. This page covers only the legal aspects of offering Stella Ops as a service or embedding it into another product while the free-tier limits are in place.

Plugin developers: See PLUGIN_DEVELOPER_FAQ.mdfor plugin-specific licensing questions.

MSPs and SaaS providers: See SAAS_MSP_GUIDANCE.mdfor detailed hosting scenarios.

1 ? Does enforcing a quota violate BUSL-1.1?

No. BUSL-1.1 permits usage controls and requires production use to remain within the Additional Use Grant (3 environments, 999 new hash scans per 24 hours, and no SaaS/hosted third-party service). Quota enforcement documents compliance.

The Stella Ops quota:

• Is enforced solely at the service layer (Valkey counters, Redis-compatible).
• Never disables functionality; it introduces time delays only after the free allocation is exhausted.
• Can be bypassed by rebuilding from source, but production use outside the Additional Use Grant requires a commercial license.

2 ? Can I redistribute Stella Ops with the quota removed?

Yes, provided you:

1. Include the LICENSE and NOTICE files with your distribution, and
2. Mark modified files with prominent change notices.

Recipients are still bound by BUSL-1.1 and the Additional Use Grant; production use outside the grant requires a commercial license.

3 ? Embedding in a proprietary appliance

You may ship Stella Ops inside a hardware or virtual appliance under BUSL-1.1. You must include LICENSE and NOTICE and preserve attribution notices. Production use must remain within the Additional Use Grant unless a commercial license is obtained. Proprietary integration code does not have to be disclosed.

4 ? SaaS redistribution

The BUSL-1.1 Additional Use Grant prohibits providing Stella Ops as a hosted or managed service to third parties. SaaS/hosted use requires a commercial license.

5 � Is e-mail collection for the JWT legal?

• Purpose limitation (GDPR Art. 5-1 b): address is used only to deliver the JWT or optional release notes.
• Data minimisation (Art. 5-1 c): no name, IP or marketing preferences are required; a blank e-mail body suffices.
• Storage limitation (Art. 5-1 e): addresses are deleted or hashed after <= 7 days unless the sender opts into updates.

Hence the token workflow adheres to GDPR principles.

See Also

• PLUGIN_DEVELOPER_FAQ.md- Plugin development and distribution questions
• SAAS_MSP_GUIDANCE.md- SaaS and MSP hosting scenarios
• ENFORCEMENT_TELEMETRY_POLICY.md- Audit and telemetry details
• COMPLIANCE_ATTESTATION_FORM.md- Self-attestation process
• LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md - Full addendum text

6 - Change-log