Three repositories
| Repository | What it is | Notes |
|---|---|---|
vericto-engine | The rule engine: it parses each statement and evaluates it against the rules. Rust. | PostgreSQL with pg_query (libpg_query, Postgres's own parser); MySQL, SQL Server and Oracle with sqlparser-rs. |
vericto-proxy | The TCP proxy that sits between your application and the database. Rust. | PostgreSQL and MySQL protocols. The Docker image ships LICENSE, NOTICE and THIRD_PARTY_LICENSES. |
vericto-cli | The CLI for pre-commit and CI. Rust; also on npm as @vericto/vericto-cli. | A thin client: it sends the SQL to the Vericto API, which evaluates it with your workspace rules. It does not work offline. |
Each repository's license is its LICENSE file: vericto-engine, vericto-proxy and vericto-cli. The dashboard and the API at app.vericto.com are not public.
What the Elastic License 2.0 allows
The ELv2 is a source-available license, not an OSI-approved open-source license. In short, and without replacing its text:
- You can use, copy, modify and distribute the code, including inside your company and in production.
- You cannot offer it to third parties as a hosted or managed service that gives them access to a substantial set of its features.
- You cannot circumvent the license key functionality or remove the license or copyright notices.
To offer Vericto as a managed service there is a commercial license: write to enterprise@vericto.com.
Copyright 2026 Vericto S.A.S. The governing text is the LICENSE file in each repository.
Contributing and reporting
- The engine and the proxy accept community pull requests: each repository has its CONTRIBUTING.md and a code of conduct.
- Vulnerabilities are reported privately, as each repository's SECURITY.md describes, or to security@vericto.com.
- Every CLI release publishes SHA-256 checksums and, since v1.5.1, Sigstore build attestations.