1. Overview
Cloud Spectra is built almost entirely on trusted, widely-deployed open-source software, running in the customer's own AWS account. Every component is used under its open-source license; Cloud Spectra's own code is proprietary and is not a derivative of any of them -- they run as separate processes or are dynamically linked. This page summarizes the major components; the full machine-readable inventory and license texts ship on the appliance and are available on request.
2. Component summary
| Component | Role | License | Version | Notes |
|---|---|---|---|---|
| Debian GNU/Linux | Base OS | Various (DFSG-free) | — | Debian, unmodified. |
| Linux kernel | OS kernel | GPL-2.0 | — | Unmodified. |
| nftables | Firewall / NAT | GPL-2.0 | — | Used via the standard nft CLI; unmodified. |
| Suricata | IDS/IPS engine | GPL-2.0 | 8.0.6 | Unmodified, runs as a separate process. |
| Squid | Forward proxy / TLS inspection | GPL-2.0 | 7.6 | Unmodified. |
| ClamAV | Antivirus | GPL-2.0 | 1.5.3 | Unmodified. |
| c-icap | ICAP server (antivirus scan path) | LGPL-2.1 | 0.6.5 | Unmodified, runs as a separate c-icap daemon; Squid talks to it over the ICAP network protocol. |
| c-icap-modules (srv_clamav) | ClamAV ICAP scan module | GPL-2.0 | 0.5.7 | Built from the exact unmodified upstream source and loaded by the separate c-icap daemon; dynamically links libclamav (GPL-2.0), never linked into Cloud Spectra's proprietary code. Corresponding source is available on request. |
| HAProxy | Load balancer / TLS termination | GPL-2.0 / LGPL | 3.4.0 | Unmodified. |
| OpenVPN, WireGuard tools | VPN tunneling | GPL-2.0 | 2.7.5 | Unmodified. |
| nDPI (ntop) | L7 App-ID engine | LGPL-3.0 | 5.0 | Dynamically linked as a separate .so by the Cloud Spectra App-ID daemon; never linked into other GPL software. |
| Grafana | Dashboards | AGPL-3.0 | 13.1.0 | Shipped unmodified as a separate process. AGPLv3 permits commercial use; its network-source clause applies only to modified versions, so no Cloud Spectra source disclosure is required. Grafana's own source is available on request. |
| Prometheus, Prometheus Node Exporter | Monitoring | Apache-2.0 | Debian-packaged | Shipped unmodified as separate processes -- Prometheus on the gateway master, Node Exporter on every instance -- for the built-in fleet monitoring stack. Apache-2.0 permits commercial use with no Cloud Spectra source disclosure required; upstream source is available at the linked forks. |
| Emerging Threats (ET) Open, UT1 (Universite Toulouse) URL categories | Threat intelligence | BSD-3-Clause / CC BY-SA 4.0 | — | Baked into the appliance image; each feed's redistribution terms are satisfied. (CC0 / public-domain feeds such as Feodo Tracker and SSLBL carry no attribution duty and are intentionally not listed.) |
| vLLM, PyTorch, Hugging Face Transformers (AI tier only) | LLM serving | Apache-2.0 (vLLM, HF Transformers), BSD-3 (PyTorch) | 0.24.0 / 2.12.1 / 5.13.0 | Used unmodified on AI-tier instances. |
| NVIDIA GPU driver + CUDA runtime (AI tier only) | GPU compute | NVIDIA proprietary EULA | 610.43.03 | Used unmodified on NVIDIA GPU instances. The NVIDIA/CUDA license is included on the AI image. |
| Go standard library and module dependencies | Cloud Spectra application runtime | BSD-3 / MIT / Apache-2.0 (permissive) | 1.25.1 | Full dependency list ships with the appliance package. |
| Angular and npm dependencies | Dashboard frontend | MIT / Apache-2.0 (permissive) | 22.0.5 | Full dependency list ships with the appliance package. |
| ElasticApps tier -- bundled stateful OSS applications (one activated per instance) | ||||
| ClickHouse | Columnar analytics database | Apache-2.0 | 25.8.28.1-lts | Shipped unmodified as a selectable ElasticApps app. |
| OpenSearch | Search & log analytics | Apache-2.0 | 3.7.0 | Shipped unmodified as a selectable ElasticApps app. |
| Neo4j Community | Graph database | GPL-3.0 | 2026.05.0 | Shipped unmodified as a separate process; corresponding source at the pinned tag in our fork. |
| PostgreSQL | Relational database | PostgreSQL License | 18.4 | Shipped unmodified as a selectable ElasticApps app. |
| Trino | Distributed SQL query engine | Apache-2.0 | 482 | Shipped unmodified as a selectable ElasticApps app. |
| JupyterLab | Data-science notebooks | BSD-3-Clause | 4.6.1 | Shipped unmodified as a selectable ElasticApps app. |
| Valkey | In-memory cache / key-value store | BSD-3-Clause | 9.1.0 | Shipped unmodified as a selectable ElasticApps app. |
| Qdrant | Vector database | Apache-2.0 | 1.18.2 | Shipped unmodified as a selectable ElasticApps app. |
| MinIO | S3-compatible object storage | AGPL-3.0 | 2025-10-15T17-29-55Z | Shipped unmodified as a separate process; AGPLv3 corresponding source at the pinned tag in our fork; the network-source clause is satisfied via the in-app open-source-licenses page. |
3. Corresponding source
For any GPL, LGPL, or AGPL component, Cloud Spectra will provide or point to the Corresponding Source at no charge for at least three years from the date of the relevant product release, as required by those licenses. To request source, email opensource@cloudspectra.ai and mention the component name and the appliance version.
4. Attribution notices
URL category lists included in the appliance threat intelligence are provided by Universite Toulouse Capitole under the CC BY-SA 4.0 license. Attribution: "URL category lists by Universite Toulouse Capitole, CC BY-SA 4.0."
5. Disclaimer
This is a plain-language summary intended to help customers understand how
open-source software is used in the Cloud Spectra appliance. It is not the licenses themselves.
The authoritative license texts and SBOM ship with the product. If there is any discrepancy between
this summary and the license texts, the license texts govern.