Can I use TOVIO commercially?

Yes. The engine, CLI, bindings, SDKs, editor and desktop edges, plugin SDK, and the specification are Apache-2.0, which permits commercial use, modification, and distribution — including inside a closed-source product.

What Apache-2.0 asks of you

These conditions bite when you redistribute the software or a derivative work. Using it internally, without distributing it, triggers none of them.

• Give recipients a copy of the licence (section 4a).
• Cause any modified files to carry prominent notices stating that you changed them (section 4b). Note the shape of this: it applies to any file you modified. There is no significance threshold in the text, and a changelog entry is not what the clause asks for — the notice goes on the files.
• Retain the copyright, patent, trademark, and attribution notices from the source form of the work, except those that do not pertain to any part of what you distribute (section 4c).
• Reproduce the relevant contents of a NOTICE file, if the work includes one (section 4d). Where that file exists, its attribution notices must travel with your distribution — in your own NOTICE file, in your source or documentation, or wherever third-party notices normally appear in your product.

You may add your own copyright statement to your modifications and licence those modifications on your own terms, as long as your use of the original still complies.

The patent grant, and its one condition

Apache-2.0 carries an express patent licence (section 3) — perpetual, worldwide, royalty-free, and irrevocable — over the claims a contributor necessarily infringes with their own contribution. That grant is one of the stated reasons the licence was chosen for a cryptographic project, where an implicit grant would not be enough for most legal reviewers.

It has a defensive termination clause: if you institute patent litigation alleging that the work or a contribution within it infringes, your patent licences under Apache-2.0 for that work terminate on the date the litigation is filed. Copyright permissions are unaffected.

No copyleft

There is no reciprocal-licensing obligation on your own code, and no requirement to publish anything you build. Copyleft licences were considered for the core and rejected in favour of permissive terms with first-class alternative implementations.

Where the line is

The Forge — the collaboration platform — is a proprietary commercial product, not Apache-2.0, and only the project distributes its binaries or operates it as a service. Running the Forge in production is a commercial arrangement. Using the CLI, the engine, the SDKs, and the built-in tovio serve server commercially is not.

The name is separate from the code

The licence governs the software, not the name. Apache-2.0 section 6 expressly grants no trademark rights, and the commercial licence grants none either. See the trademark article.

Before you commit to it in production

These are product-maturity facts rather than licensing ones, and for most procurement decisions they matter more than the licence does:

• No public release has been accepted or tagged yet. The project is pre-1.0 and in active development.
• The independent third-party security audit of the cryptography and permission model has not happened yet. It is a stated precondition for declaring anything Stable, and until it completes, unaudited claims are marked as such.
• Platform support floors are declared but not certified. Every target carries a stated minimum, and a certification flag that is not yet set.

The authoritative text

The LICENSE overview and the full LICENSE-APACHE text in the repository govern. This article is a plain-language summary written by the project, not legal advice, and it is not a substitute for your own counsel's reading.