Open source and licensing your code to AI companies
You can only license code your company owns. Open-source dependencies keep their own licenses, code written for clients usually belongs to the client, and contractor code is yours only if the contract assigned it. Strip or list everything else before a buyer sees a file tree.
What do you actually own in your repositories?
Run the audit a buyer's lawyer will run, before they run it. In a typical startup monorepo the code splits into four piles:
| What it is | Usually owned by | Can you license it? |
|---|---|---|
| Code employees wrote under an IP assignment | The company | Yes |
| Contractor code | The company if the contract assigned it; otherwise the contractor | Only with a signed assignment |
| Installed or vendored open-source packages | Their authors, under their licenses | No; exclude it |
| Code built for a client under an MSA | Often the client | Only if the contract leaves it with you |
Commit history, pull request threads and issue trackers follow the same logic. A review comment by your staff engineer on your product is the company's. A thread where a client's team argued about their own spec may contain material you agreed to keep confidential.
Do open-source licenses block a deal?
Not on their own. Your dependencies were never yours to grant, so they simply stay out of scope. The practical step is to remove node_modules, vendor/, lockfile-installed packages and generated code from whatever you prepare, and to keep a list of anything copied in by hand.
Two cases need care:
- Copied snippets. A function pasted from a GPL project into your file is not yours to relicense. Search for license headers and attribution comments inside your own source.
- Your own public repos. If you released a package under MIT or Apache 2.0, anyone already has rights to it. What a buyer pays for is the private material: the internal history, the reviews and the issues that were never published.
What about employees and contractors?
Most US startups have employees sign an invention assignment agreement on day one. Contractors are the gap. Pull the signed agreement for every contractor whose commits sit in the repos you plan to include, and check whether it assigns IP or only licenses it. If one is missing, leave that work out or get a written assignment now.
Licensing versus selling the IP
Under a license the buyer may use copies for a named purpose, typically training, while title stays with you. Selling the IP moves title, and your own rights end there unless the deal licenses them back. Most AI data deals for operating companies are licenses. Wound-down companies sometimes sell outright, which raises the question of who has authority to sign. The longer note on licensing versus selling covers the trade-offs.
Who else may have a claim?
- Lenders. Venture debt is often secured on all assets, IP included. A lien can mean the lender has to consent.
- Investors. Some financing documents need board or investor approval to dispose of material assets.
- Acquirers. If you sold part of the business, the purchase agreement may have taken the code with it.
- Wind-down assignees. In an assignment for the benefit of creditors, the assignee holds the assets, not the founders.
General information, not legal advice; your own counsel should mark up any agreement first.
Short answers
Can I license a repo that has node_modules or a vendor folder checked in?
You can license the parts you wrote. Strip the vendored and generated directories before anything leaves your hands, or list them so the buyer can exclude them. Packages you installed keep their own licenses and were never yours to grant.
Does the GPL stop me licensing my own code?
No. The GPL governs code its authors released under it. If your private code merely depends on a GPL library, your own files are still yours. If you copied GPL code into your files, those passages are not yours to license on new terms, so flag them.
We open-sourced part of our product. Is that worth anything?
The public code itself is already available to anyone under its license, so a buyer has little reason to pay for it. The private history around it (internal reviews, issues that never went public, unreleased branches) is a different matter.
A contractor wrote half the backend. Do we own it?
Only if the contract assigned the IP to the company. Many contractor agreements do, some only grant a license, and some say nothing. Find the signed agreement for every contractor whose commits you want to include.
Who holds the code after a shutdown?
Usually the company until it is dissolved, but a lender with a security interest, an assignee for the benefit of creditors, or an acquirer of some assets may hold rights. Check before you talk to any buyer. See selling a shut-down startup's code.
Do buyers want our secrets and API keys removed?
Yes, and you should remove them anyway. Rotate any key that was ever committed, scrub it from history, and assume the buyer will scan for anything you missed.
Get a quote
ZIP, contact, then eight multiple-choice questions about the repos. Your answers get held up against every buyer's published rules, and the matches come back to you by email, by name.
No code, repo URLs, exports or samples here, please. Answers only; we do not want your data.
We run an introduction service, and a buyer you end up signing with may pay us for the introduction. You are not charged.
Answers in. The next moves:
- Each answer is compared with the published conditions of every buyer on this site.
- You get a short email: the fitting buyers by name, each with its reason, or a plain "no match today".
- A buyer only learns of you after you approve it, by name, in a reply. Your address is used for this request and then left alone.