Open Source Acknowledgements
Aquil — ISO 27001 ISMS Management Service
Last updated: 2026-04-07
Aquil is built on the shoulders of the open source community. This page acknowledges the open source software that makes Aquil possible and sets out the licenses under which we use it.
We are grateful to the maintainers and contributors of every project listed here.
Overview
Aquil's production software is composed of:
- Proprietary Aquil code, owned and maintained by Sokigo AB.
- Open source libraries and components, used under their respective licenses.
The open source components we use are licensed under permissive licenses (primarily MIT, Apache-2.0, ISC and BSD variants) together with a small number of weak-copyleft (MPL-2.0, LGPL-3.0) components. Aquil does not include any strong-copyleft components such as GPL or AGPL in its production stack.
License summary
| License | Where it applies |
|---|---|
| MIT | Most JavaScript and TypeScript libraries |
| Apache-2.0 | Large frameworks and cloud SDKs |
| ISC | Utility libraries |
| BSD-2-Clause / BSD-3-Clause | Cryptography and parsing libraries |
| MPL-2.0 | A small number of file-level copyleft components, used unmodified |
| LGPL-3.0 | The libvips image processing library, used via the sharp binding and dynamically linked |
| 0BSD, Unlicense, BlueOak-1.0.0, CC-BY-4.0 | Misc. utilities and data |
A detailed, per-package listing is available on request from infosec@sokigo.com.
Notices for specific components
libvips (LGPL-3.0-or-later)
Aquil uses the sharp Node.js binding, which links dynamically to the libvips image processing library. libvips is distributed under the LGPL-3.0-or-later license. Sokigo uses libvips unmodified.
As required by the LGPL, you may obtain the source code for libvips from its official repository, and you are free to replace the copy bundled with Aquil with a compatible version of libvips on your own infrastructure.
Mozilla Public License 2.0 components
Aquil uses a small number of components licensed under the Mozilla Public License 2.0. These are used unmodified. Source code for each MPL-2.0 component is available from its upstream project as identified in the component's own metadata. Should Sokigo modify any MPL-2.0 file, we will make the modified source available for that file in accordance with MPL-2.0 § 3.1.
Dual-licensed components
Where a component is available under more than one license, Sokigo elects the most permissive option permitted by the upstream licensor:
- jszip — available under MIT or GPL-3.0-or-later. Used under the MIT license.
- pizzip — available under MIT or GPL-3.0. Used under the MIT license.
- sharp — available under Apache-2.0 (with the LGPL-3.0
libvipsdynamic link described above).
Aquil is not open source
The Aquil application itself is proprietary software owned by Sokigo AB. It is licensed to customers under the Aquil Master Subscription Agreement, not under any open source license. Only the third-party components listed on this page are open source.
Contact
If you are the author of an open source component used by Aquil and you have a question about how it is attributed here — or you believe its license terms are not being met — please contact infosec@sokigo.com and we will respond promptly.
[End of Open Source Acknowledgements]