1. Overview
Cloud Spectra is built almost entirely on trusted, widely-deployed open-source software, running in the customer's own AWS account. Every component is used under its open-source license; Cloud Spectra's own code is proprietary and is not a derivative of any of them -- they run as separate processes or are dynamically linked. This page summarizes the major components; the full machine-readable inventory and license texts ship on the appliance and are available on request.
2. Component summary
| Component | Role | License | Version | Notes |
|---|---|---|---|---|
| Debian GNU/Linux | Base OS | Various (DFSG-free) | — | Debian, unmodified. |
| Linux kernel | OS kernel | GPL-2.0 | 7.1.4 | Modified: mainline 7.1.4 with a CloudSpectra kernel-hardening patch and build configuration. Complete corresponding source (mainline 7.1.4 plus the CloudSpectra patch and kernel config) is provided at no charge on request per section 3. |
| nftables | Firewall / NAT | GPL-2.0 | 1.1.3 | Debian package, shipped unmodified; corresponding source mirrored at the pinned tag in our fork. |
| Suricata | IDS/IPS engine | GPL-2.0 | 8.0.6 | Unmodified, runs as a separate process. |
| Squid | Forward proxy / TLS inspection | GPL-2.0 | 7.6 | Unmodified. |
| ClamAV | Antivirus | GPL-2.0 | 1.5.3 | Unmodified. |
| c-icap | ICAP server (antivirus scan path) | LGPL-2.1 | 0.6.5 | Unmodified, runs as a separate c-icap daemon; Squid talks to it over the ICAP network protocol. |
| c-icap-modules (srv_clamav) | ClamAV ICAP scan module | GPL-2.0 | 0.5.7 | Built from the exact unmodified upstream source and loaded by the separate c-icap daemon; dynamically links libclamav (GPL-2.0), never linked into Cloud Spectra's proprietary code. Corresponding source is available on request. |
| HAProxy | Load balancer / TLS termination | GPL-2.0 / LGPL | 3.4.0 | Unmodified. |
| OpenVPN, WireGuard tools | VPN tunneling | GPL-2.0 | 2.7.5 | Unmodified. |
| wolfSSL / wolfCrypt (FIPS deployments only) | FIPS-approved crypto engine | GPL-3.0 | FIPS-Ready | Optional; only present when a FIPS tunnel is selected. Supplies the FIPS-approved primitives (AES-256-GCM / ECC P-256 / SHA-256) to the wolfGuard tunnel as a separate kernel module (libwolfssl.ko) or userspace library (libwolfssl.so); never linked into Cloud Spectra's proprietary code. FIPS-Ready is the free, publishable build; FIPS-Validated requires the customer's own wolfSSL commercial license. Corresponding source at the linked fork and per section 3. |
| wolfGuard, wolfCrypt wireguard-go port (FIPS deployments only) | FIPS-mode encrypted tunnel | GPL-2.0 | — | Optional; only present when a FIPS tunnel is selected. A separate out-of-tree kernel module (wolfguard.ko, DKMS-built) or a userspace wireguard-go process; used only across the wg network interface, never linked into Cloud Spectra's code. It substitutes FIPS-approved algorithms for WireGuard's defaults, so it is not wire-compatible with stock WireGuard (both endpoints run wolfGuard). Depends on wolfCrypt (above). Corresponding source at the linked forks and per section 3. |
| nDPI (ntop) | L7 App-ID engine | LGPL-3.0 | 5.0 | Dynamically linked as a separate .so by the Cloud Spectra App-ID daemon; never linked into other GPL software. |
| Grafana | Dashboards | AGPL-3.0 | 13.1.0 | Shipped unmodified as a separate process. AGPLv3 permits commercial use; its network-source clause applies only to modified versions, so no Cloud Spectra source disclosure is required. Grafana's own source is available on request. |
| Prometheus, Prometheus Node Exporter | Monitoring | Apache-2.0 | Debian-packaged | Shipped unmodified as separate processes -- Prometheus on the gateway master, Node Exporter on every instance -- for the built-in fleet monitoring stack. Apache-2.0 permits commercial use with no Cloud Spectra source disclosure required; upstream source is available at the linked forks. |
| Emerging Threats (ET) Open, UT1 (Universite Toulouse) URL categories | Threat intelligence | BSD-3-Clause / CC BY-SA 4.0 | — | Baked into the appliance image; each feed's redistribution terms are satisfied. (CC0 / public-domain feeds such as Feodo Tracker and SSLBL carry no attribution duty and are intentionally not listed.) |
| vLLM, PyTorch, Hugging Face Transformers (AI tier only) | LLM serving | Apache-2.0 (vLLM, HF Transformers), BSD-3 (PyTorch) | 0.24.0 / 2.12.1 / 5.13.0 | Used unmodified on AI-tier instances. |
| NVIDIA GPU driver + CUDA runtime (AI tier only) | GPU compute | NVIDIA proprietary EULA | 610.43.03 | Used unmodified on NVIDIA GPU instances. The NVIDIA/CUDA license is included on the AI image. |
| Go standard library and module dependencies | Cloud Spectra application runtime | BSD-3 / MIT / Apache-2.0 (permissive) | 1.25.1 | Full dependency list ships with the appliance package. |
| Angular and npm dependencies | Dashboard frontend | MIT / Apache-2.0 (permissive) | 22.0.5 | Full dependency list ships with the appliance package. |
| ElasticApps tier -- bundled stateful OSS applications (one activated per instance) | ||||
| ClickHouse | Columnar analytics database | Apache-2.0 | 25.8.28.1-lts | Shipped unmodified as a selectable ElasticApps app. |
| OpenSearch | Search & log analytics | Apache-2.0 | 3.7.0 | Shipped unmodified as a selectable ElasticApps app. |
| Neo4j Community | Graph database | GPL-3.0 | 2026.05.0 | Shipped unmodified as a separate process; corresponding source at the pinned tag in our fork. |
| PostgreSQL | Relational database | PostgreSQL License | 18.4 | Shipped unmodified as a selectable ElasticApps app. |
| Trino | Distributed SQL query engine | Apache-2.0 | 482 | Shipped unmodified as a selectable ElasticApps app. |
| JupyterLab | Data-science notebooks | BSD-3-Clause | 4.6.1 | Shipped unmodified as a selectable ElasticApps app. |
| Valkey | In-memory cache / key-value store | BSD-3-Clause | 9.1.0 | Shipped unmodified as a selectable ElasticApps app. |
| Qdrant | Vector database | Apache-2.0 | 1.18.2 | Shipped unmodified as a selectable ElasticApps app. |
| MinIO | S3-compatible object storage | AGPL-3.0 | 2025-10-15T17-29-55Z | Shipped unmodified as a separate process; AGPLv3 corresponding source at the pinned tag in our fork; the network-source clause is satisfied via the in-app open-source-licenses page. |
3. Corresponding source
For any GPL, LGPL, or AGPL component, Cloud Spectra will provide or point to the Corresponding Source at no charge for at least three years from the date of the relevant product release, as required by those licenses. To request source, email opensource@cloudspectra.ai and mention the component name and the appliance version.
Source code written offer (GPLv2 Section 3(b)). Cloud Spectra’s products contain software components licensed under the GNU General Public License version 2 (GPLv2) and other copyleft licenses, including a Linux kernel modified by Cloud Spectra (a kernel-hardening patch and build configuration). In accordance with GPLv2 Section 3(b), Cloud Spectra LLC hereby offers to provide the complete, machine-readable corresponding source code for these components to any third party who requests it. This offer is valid for three (3) years from the date you received the product. To obtain the source code, email opensource@cloudspectra.ai with the component name and the product version; digital fulfilment is provided free of charge.
4. Attribution notices
URL category lists included in the appliance threat intelligence are provided by Universite Toulouse Capitole under the CC BY-SA 4.0 license. Attribution: "URL category lists by Universite Toulouse Capitole, CC BY-SA 4.0."