> Markdown version of https://www.getunleash.io//blog/is-growthbook-open-source > For clean Markdown of any blog post, append .md to its URL. > For a site index, see https://www.getunleash.io//llms.txt. # Is GrowthBook open source? _Published 2026-09-30 by Alex Casalboni in Product._ - Yes. GrowthBook’s application core is MIT, and three enterprise directories in the same public repository and the same Docker image are under the GrowthBook Enterprise License. - Unleash is also open core, but its Enterprise code is not published. Enterprise ships as a separate image. However: - Every user on a new GrowthBook free plan is an admin. Unleash open source edition ships basic roles, so an engineer can edit flags without admin rights. - GrowthBook browser SDKs download the full targeting payload by default. Keeping rules off the client takes remote evaluation, which is Pro on GrowthBook Cloud and Enterprise when self-hosted. Unleash frontend SDKs receive evaluated flags from the Frontend API. - Self-hosted GrowthBook stores data in MongoDB, whose SSPL isn’t OSI-approved. Unleash runs on PostgreSQL. - A self-hosted GrowthBook install reports to GrowthBook-run endpoints by default, and the Unleash free edition adds a playground, an instance-wide audit log with export, and usage metrics that drive flag lifecycle. Taken together, Unleash is stronger on these points. ## The short answer Yes. GrowthBook puts three directories under the GrowthBook Enterprise License, keeps third-party components under their own licenses, and releases everything else under the “MIT Expat” license. GitHub shows the repository as NOASSERTION because the license is mixed. The core is MIT, and the enterprise directories sit in the same public repository under a commercial license. Under that license, the enterprise code may only run in production with a valid Pro or Enterprise license. Without a subscription you may modify it for development and testing. Licensed customers may modify and publish patches, and GrowthBook retains all right, title, and interest in any modifications or patches you make. The published growthbook/growthbook Docker image is one build containing both the MIT and enterprise code; the same image runs GrowthBook Cloud, and a license key unlocks the rest. That is open core. Unleash is also open core, but its Enterprise code is not published: an [AGPL-3.0 server on GitHub](https://github.com/Unleash/unleash) with no commercially licensed directories, plus an Enterprise edition shipped as a [separate Docker image](https://docs.getunleash.io/deploy/getting-started), and unlocked by a license key. GrowthBook is a NextJS front end, an ExpressJS API, and a Python stats engine in one Docker image, plus MongoDB or a MongoDB-compatible database. Its center is warehouse-native experimentation. For Unleash, it’s about feature flags. ## Basic roles on the free edition On GrowthBook’s free plans, members can only be assigned the Admin role; any other role requires Pro or Enterprise. Organizations created before that limit keep the roles they already have. You can self-host it free with unlimited users, and every one of them can delete every flag, rotate every key, and change every data source connection. On GrowthBook Cloud, roles are admin only on Starter, basic roles on Pro, and custom roles on Enterprise, and advanced permissioning starts on Pro. Cloud Starter is free for up to 3 users; Pro is $40 per seat per month for up to 30. Self-hosted GrowthBook has two tiers, free and Enterprise. There is no self-hosted Pro, so roles go from admin only to custom roles at custom pricing, and every self-hostable feature gated as Pro on Cloud is Enterprise when you self-host. That free self-hosted plan has unlimited users, flags, and experiments on one project with default environments, and the Unleash open source edition [is limited to 1 project and 2 environments, and suited to 1-4 server instances](https://docs.getunleash.io/support/oss-comparison). The Unleash open source edition ships basic roles. [Admin, Editor, and Viewer](https://docs.getunleash.io/concepts/rbac) are available in all versions, and an Editor can work on flags but can’t manage users and roles. Project roles, custom roles, and user groups are Enterprise. SCIM and custom SSO are Enterprise on both products. **Use case**: a platform team wants eight engineers shipping flags and two people who only read. On a new GrowthBook free organization, all ten are admins, or the team talks to sales. On Unleash open source, eight are **Editors** and two are **Viewers**. ## Evaluated results in the browser GrowthBook’s default is local evaluation. The client SDK fetches the entire feature payload: all feature rules, targeting conditions, experiment configurations, and variations. Targeting logic and unused variations are visible in the client. Local evaluation is free on every plan and is the right mode for a backend, where the payload stays on your servers. Saved Group ID lists ship inside that payload too, so an email allowlist in a targeting rule reaches every visitor unless you pay for hashing. Keeping rules off a browser or mobile client means remote evaluation: the client sends attributes and receives evaluated values. You turn it on explicitly with `remoteEval: true` in the JavaScript SDK and in the SDK connection. Remote evaluation is Pro and Enterprise on GrowthBook Cloud and Enterprise only when self-hosted. The GrowthBook Proxy itself is free on every plan, but the SDK connection setting that makes it evaluate remotely is the paid part. Cloud customers also run their own proxy, edge worker, or custom evaluator; the debug endpoint on a self-hosted API is for development. The other paid path keeps client-side evaluation. Encrypted endpoints protect the payload in transit, but a browser must hold the key, and hashing obscures attribute values, not the rules. Both are Pro on Cloud and Enterprise when self-hosted. In Unleash, frontend SDKs [fetch enabled flags for a context](https://docs.getunleash.io/get-started/unleash-overview), and the payload is evaluated flags and variants. Evaluation happens in Unleash Edge, or in the Unleash server via the Frontend API directly. A direct Frontend API call [sends the Unleash context to the Unleash server](https://docs.getunleash.io/deploy/hosting-options). By using Unleash Edge, you can keep that context off the central server. [Frontend tokens](https://docs.getunleash.io/concepts/api-tokens-and-client-keys) are not secrets and are safe to expose client-side, because they can only read enabled flags for a context, register the app, and send metrics. Unleash Enterprise Edge is the supported option, and open source Edge is in long-term support until [December 31, 2026](https://docs.getunleash.io/support/availability). **Use case**: a fintech opens a new pricing page to accounts above a revenue threshold. On GrowthBook’s free default, the threshold and the unused variations are readable in the browser. On Unleash, the browser receives the enabled flag and nothing about why. ## PostgreSQL and the server license The GrowthBook application is MIT outside three Enterprise-licensed directories. Its Compose quick start uses the mongo image for dev or staging and offers a Helm chart for Kubernetes. The production guide recommends a managed service, with MongoDB Atlas first and FerretDB third, or a self-managed replica set with three nodes. MongoDB’s licence is SSPL (Server Side Public License), which [has not been approved by the OSI](https://www.mongodb.com/legal/licensing/server-side-public-license/faq), software under it [is not considered open source](https://opensource.org/blog/the-sspl-is-not-an-open-source-license). MongoDB’s FAQ treats the sharing obligation as applying when you offer the database as a service to others, so running it for your own GrowthBook install does not by itself create that duty. GrowthBook’s documented fully open path is FerretDB, which converts MongoDB wire-protocol queries to SQL and uses PostgreSQL as the storage engine, for organizations that require a 100% open source stack without proprietary database dependencies. The GrowthBook app is MIT (outside three enterprise directories), but the database it needs is not, unless you add a translation layer. With Unleash, the documented install [runs PostgreSQL 15 or newer](https://docs.getunleash.io/deploy/getting-started), and PostgreSQL is the only datastore, under the OSI-approved PostgreSQL License. The Unleash server is [AGPL-3.0](https://docs.getunleash.io/support/availability), and official Docker images are Apache 2.0. Enterprise is unlocked with a license key. Running either product unmodified creates no duty to publish source. MIT allows a closed fork. AGPL-3.0’s source-offer duty applies when you modify the server and let others use it over a network, which is why the Unleash license fits a team that wants hosted forks to stay open. On GitHub stars, as of October 2026, [Unleash](https://github.com/Unleash/unleash) has about 13.9K and GrowthBook about 8.5K. **Use case**: a security reviewer wants a bill of materials with only OSI-approved licenses. With Unleash, that’s AGPL-3.0 and PostgreSQL. With GrowthBook, it’s MIT, plus the GrowthBook Enterprise License code in the same image, plus an SSPL database or a FerretDB layer in front of PostgreSQL. ## What a self-hosted install sends home A self-hosted GrowthBook install reaches **cdn.growthbook.io** for its own flags, and **t.growthbook.io** and **us-east-1.gb-ingest.com** for telemetry. Usage telemetry is on unless you set DISABLE\_TELEMETRY to true, and it collects a hashed org and user identifier, IP address, and user agent. The back end ships with a public client SDK key for its own in-app feature flags. A Enterprise install checks with GrowthBook’s license server daily and sends a hash of every user’s email, the git SHA and date of the installation, and the list of data source types, event trackers, and SDK languages in use; firewalled installs must allow two anycast addresses. If the license server is unreachable for seven days, Enterprise features turn off. Air-gapped keys exist, but you ask sales for one, and they expire with a 14-day grace period. A self-hosted Unleash instance sends a version check with [an anonymous instance ID and usage counts](https://docs.getunleash.io/privacy-and-compliance/data-privacy): the number of flags, projects, environments, users, groups, and roles. It collects no personally identifiable information, and `CHECK_VERSION=false` turns off both the version check and the usage counts. An Unleash Enterprise [license key](https://docs.getunleash.io/deploy/license-keys) encodes seat count and contract duration, is installed locally, and puts the instance into read-only mode when it expires. There is no license server to reach. **Use case**: a regulated team runs its flag server in a VPC with no outbound internet. On GrowthBook, the team sets DISABLE\_TELEMETRY, then still has the in-app CDN fetch and, if the install is licensed, the license server or an air-gapped key. On Unleash, `CHECK_VERSION=false` makes the instance self-contained, and the license works offline. ## A playground in the free edition The Unleash [Playground](https://docs.getunleash.io/concepts/playground) is part of the Admin UI in every edition and has an accompanying API. You paste an Unleash context, pick environments and projects, and see which flags would be enabled and which variant each would return. Detailed evaluation results show how every strategy, constraint, and segment evaluated, a diff view compares a flag across environments, and results respect stickiness. GrowthBook’s feature value simulation is a paid feature, not included on the free Cloud or self-hosted plan. **Use case**: before enabling a gradual rollout for British users, an engineer pastes a context with the country set to “UK” and sees the flag evaluate to false in production but true in development. The detailed results point at a segment constraint with the wrong case. ## An instance-wide audit log without a license key GrowthBook includes flag change history and a per-flag audit log on its free Cloud and self-hosted plans. The organization-wide audit log is viewable on the free plan, and exporting audit logs is an Enterprise feature, on both Cloud and self-hosted. The Unleash [Event Log](https://docs.getunleash.io/concepts/events) covers every event in an instance, filters by date range, event type, project, flag, and user, and exports the filtered events shown on screen as CSV or JSON. Each event records who made the change, when, and the before and after state. The open source edition includes it as a basic audit log; IP address data and the Event Timeline are Enterprise. **Use case**: a compliance reviewer asks who disabled the production kill switch in March and wants a file for the evidence folder. On GrowthBook’s free edition, the reviewer can browse the organization-wide log but cannot export a file. On Unleash open source, an admin filters the Event Log by flag and date, then exports the events shown on screen. ## Usage metrics come back to the server GrowthBook’s feature evaluation diagnostics query SDK evaluation events stored in your data warehouse. You wire an `onFeatureUsage` callback into your analytics pipeline, land the events in the warehouse, and add a Feature Usage Query to the data source. Self-hosted GrowthBook plans are bring-your-own-warehouse. Unleash SDKs [send usage metrics to Unleash](https://docs.getunleash.io/get-started/unleash-overview) through the Client and Frontend APIs, while backend SDKs keep evaluation and user data inside your process. Those metrics drive the [feature flag lifecycle](https://docs.getunleash.io/concepts/feature-flags): a flag moves from _Define_ to _Develop_ when metrics arrive from a non-production environment, to _Production_ when users are exposed, and flags in _Cleanup_ that haven’t been used for seven days get an archive suggestion. No extra data store is involved. **Use case**: a team with no warehouse wants to confirm a flag is dead before deleting the code behind it. On GrowthBook, the answer lives in a warehouse table the team has to build first. On Unleash, the built-in lifecycle stage and archive suggestion answer that. ## Try it yourself The Unleash open source edition takes a PostgreSQL container and one Unleash container. Follow the [documented install](https://docs.getunleash.io/deploy/getting-started), or read [how the open source edition compares to Enterprise](https://docs.getunleash.io/support/oss-comparison) before you pick a tier. The open source edition is designed for small-scale deployments and we recommend Enterprise for production. ## FAQs ### Is GrowthBook open source? Yes. The application core is MIT, and three enterprise directories in the same repository and Docker image are under the GrowthBook Enterprise License. Unleash is also open core, but its Enterprise code is not published. Unleash has an AGPL-3.0 server and a separate license-key Enterprise image. ### What license does GrowthBook use? MIT (“Expat”) for everything outside the three enterprise folders, which are under the GrowthBook Enterprise License. Without a subscription, modification is limited to development and testing. Licensed customers may modify and publish patches, and GrowthBook keeps the rights to them. ### Are GrowthBook’s free-plan users all admins? Yes, on organizations created since GrowthBook limited free plans to the Admin role. Roles are admin only on Cloud Starter and on the free self-hosted plan; basic roles start at Pro on Cloud, and self-hosted has no Pro, so the next step is Enterprise. Unleash open source ships Admin, Editor, and Viewer, so an engineer edits flags without admin rights. ### Do GrowthBook browser SDKs download targeting rules? By default, yes. Local evaluation sends the full payload to the client, including targeting conditions, unused variations, and saved group values. Remote evaluation keeps rules on the server, but it’s Pro on Cloud and Enterprise when self-hosted, while Unleash frontend SDKs receive evaluated flags in every edition via the Frontend API. ### Is MongoDB’s license open source? No. The SSPL has not been approved by the OSI, and the OSI holds that it is not an open source license. GrowthBook’s fully open path is FerretDB with PostgreSQL as the storage engine. Unleash runs on PostgreSQL directly. ### Is Unleash open source? Yes. The Unleash server is AGPL-3.0 and the official Docker images and SDKs are Apache 2.0. Enterprise ships as a separate image unlocked with a license key that works offline. ### Why choose Unleash over GrowthBook? For feature flags, Unleash open source edition gives you basic roles, evaluated results in the browser, a PostgreSQL-only stack, an install you can stop reporting with one setting (`CHECK_VERSION=false`), a playground, an instance-wide audit log with export, and usage metrics that drive flag lifecycle, all without a license key. GrowthBook gates several of those behind Pro or Enterprise, and its center is warehouse-native experimentation.