RHEXA Licensing

RHEXA is source-available. You can read, run, change and share the code. Who you are and what you use it for decides whether that is free or needs a license.

In short: free for personal use, teaching, research and charitable purposes. Companies, public bodies and paid work need a commercial license after a 30-day evaluation.

1. Which license applies to what

The MIT, Apache and GPL parts stay free for everyone, and this page does not limit the rights they grant. The commercial license covers only the code that Martin Janda wrote on top of them. Your statutory rights, for example under sections 69d and 69e of the German Copyright Act, also stay unaffected. Versions of the RhexaBridge module published before engine build 20261021 were designated MIT and remain MIT-licensed.

2. Free use (no key needed)

Under the RHEXA Noncommercial License 1.0.0 you may use RHEXA free of charge for noncommercial purposes, in particular:

• Personal use: hobby projects, self-study, CTF competitions (prize money is fine), private research that benefits public knowledge.
• Education and research: pupils, students, teachers; schools, universities and public research organizations for teaching, study and research, including grant-funded and third-party-funded research.
• Charitable and environmental organizations for their charitable activities.

You may change RHEXA and share it, with or without changes, under the same terms. When you share it, pass on the license text or its URL and the Required Notice: line.

3. Use that needs a commercial license

You need a commercial license whenever RHEXA is used for or on behalf of a business, a public body, or paid work. This includes:

• any company or other organization pursuing commercial purposes, of any size, in any country, including internal use (security teams, red/blue teams, product security, QA);
• freelancers, consultants, penetration testers, incident responders and auditors working for clients, even as sole traders;
• vulnerability research for bug bounties or other rewards;
• public authorities and other public-sector bodies: ministries, agencies, courts, police, military, intelligence services, public CERTs, and companies they control. Universities and public research organizations are exempt when they use RHEXA for teaching and research;
• contractors using RHEXA on behalf of any of the above;
• offering RHEXA, or a service substantially based on it, for a fee.

Not sure? Write to martin@janda.io. The answer is free and comes without obligation.

4. 30-day evaluation

Companies and public bodies may evaluate RHEXA under the PolyForm Free Trial License 1.0.0 for fewer than 32 consecutive calendar days. We communicate this as 30 days. During the evaluation you may use and change RHEXA to decide whether it fits, but you may not distribute it. Afterwards, get a license key or stop using RHEXA.

No registration is required. RHEXA shows a short license notice at start-up. Without a key it does not stop working and does not send any data. Working without a key does not mean that commercial use without a license is permitted.

5. What a commercial license includes

• A signed offline license key (Ed25519) that names the licensee, plan, number of users and term. There is no online activation, no telemetry and no phone-home.
• The right to use RHEXA, including the RhexaBridge engine module, for the licensee's business purposes and for services to its clients, for the term of the license.
• All updates released during the term.
• Security updates for each major version for at least five years after its first release (support period under the EU Cyber Resilience Act; the end date is stated for each version on this page, see support periods).
• E-mail support on a best-effort basis (target response: 2 business days).
• A software bill of materials (SBOM, CycloneDX) for each release on request.
• An invoice with the correct VAT treatment for EU and non-EU customers.

Licenses are sold to businesses and public bodies only, not to consumers.

Prices (net, plus VAT where applicable; the quotation is binding):

Multi-year terms are available on request.

Support periods

No major version has been released yet. The end date of security updates will be listed here when each major version is first released.

6. How to request a license

Send an e-mail to martin@janda.io with:

1. legal name and address of the licensee (organization, country);
2. VAT ID (EU) or tax/registration number;
3. plan and number of users;
4. desired start and term (12, 24 or 36 months);
5. a technical contact for the key.

You will receive a quotation and the license agreement. After payment you receive the key by e-mail; install it with rhexa license --install <file>. Before any sale we check sanctions lists, and we cannot license parties subject to EU or UN sanctions.

7. Responsible use

All licenses require lawful use: analyze only software you are entitled to examine. Do not circumvent technical protection measures, and do not use RHEXA for unauthorized access. See DISCLAIMER.md.

8. Contributions

RHEXA currently does not accept external code contributions. Bug reports, feature requests and documentation hints are welcome. Contributions will later require a contributor license agreement, so that the dual-licensing model remains possible.

9. Contact and legal information

Martin Janda · Am Weißen Berg 5, 61476 Kronberg (Taunus) · Germany · martin@janda.io · Imprint · Privacy · Security: see SECURITY.md

RHEXA is an independent project. It is not affiliated with, sponsored or endorsed by the National Security Agency, the Ghidra project or morluto (REA). "Ghidra" is used only to describe the origin of the engine code.