Evaluation · open core
Version control is the load-bearing wall. Adopting a young one is a bet on the vendor unless the bet is structured so that the vendor failing is survivable. This page is that structure — six ways this project could fail you, and what stands between each one and your repositories.
01The company shuts down
The engine, CLI, SDKs, and specification are Apache-2.0, and your repositories are files on disk in a documented, content-addressed format — not rows in someone else's database. `tovio serve`, in that same Apache CLI, serves them to your team with no vendor in the loop.
02The licence gets worse
A grant already made on a released version cannot be withdrawn. A future relicense would apply to future versions, and the last permissive release stays permissive — which is what makes a credible fork possible rather than theoretical.
03The price goes up
No engine capability is gated behind a subscription check. Per-file encryption, capability tokens, change identity, and binary handling are in the Apache-2.0 core, and running that core on your own infrastructure is a supported configuration rather than a downgrade.
04You want to leave
History import from Git exists, and a Git bridge is built for the other direction. The exit path is a documented feature, not an undocumented export button.
05You need to verify a claim, not trust it
Serialization is canonical and validated against a published conformance corpus, so an independent implementation can be checked byte-for-byte against the specification rather than against this binary.
06Nobody maintains it
Governance, contribution, and security-disclosure processes are written down and public. That does not guarantee a community appears — but it means there is something to join rather than a wall.
Where the line is
tovio serve, in the Apache-2.0 CLI.The Forge is a commercial product, and this site does not call it open source. The licensing page states the terms; on-premiseshows what each layer is for.
How it is funded
A project that will not say how it makes money is asking you to assume it never has to. This one is funded three ways, all of them visible:
Repository data is not sold; service processing remains governed by the privacy policy.
Publication statusThe source is not published at a public destination yet.
The public repository destination has not been accepted, so this site does not advertise a clone URL it cannot stand behind. The licences above are the licences the code carries; the publication step is tracked with the rest of the remaining release work. A page that linked a repository before that gate passed would be the first thing on this site you could not trust.
The specification and the conformance corpus exist so that “trust us” is never the argument.