Licensing clarification for draw.io integration and cloud service icons

[louise165]

Hi draw.io team,
I contacted draw.io Support regarding this question and was informed that support is not provided for free/open-source projects, so I am posting here to clarify the licensing requirements for our use case.
We have integrated the open-source draw.io editor into an internal enterprise application used for creating and editing cloud architecture diagrams. The application also uses AWS and Google Cloud service icons available in draw.io.
We are planning to transfer the application's source code, including the draw.io integration, to our affiliated companies. Each affiliated company would deploy and operate the application independently for its own internal use. The application is not an Atlassian product and is not distributed through the Atlassian Marketplace.
Could you please confirm the following:

1. Is this use of the draw.io editor permitted under the Apache License 2.0?
2. Is transferring our application source code, including the draw.io integration, to affiliated companies for their own internal deployment permitted, provided that we comply with the applicable license requirements?
3. Are there any additional attribution, copyright notice, or other requirements that we need to comply with?
4. For AWS and Google Cloud service icons included in the draw.io libraries, are these icons governed by the respective third-party providers' terms, or are there any additional draw.io licensing requirements that apply to our use and transfer scenario?

We would appreciate your clarification, as we need to document the applicable licensing requirements before proceeding with the internal source code transfer.
Thank you.

[draw-io-triage-bot[bot]]

This summarises what the licence files in this repository say. It isn't legal advice, and only the maintainers can give a binding answer on draw.io's behalf.

1. Internal use. The editor source is under the Apache License 2.0 (LICENSE, README). Apache 2.0 places no restriction on the field of use, so an internal enterprise application is within it. The draw.io Terms of Use govern the published apps and hosted services, and state that nothing in them limits the rights Apache 2.0 grants in the source code.

2. Transfer to affiliated companies. Section 4 of Apache 2.0 allows you to redistribute the work and modified versions of it, in source or object form, as long as you meet the conditions listed there (point 3 below).

3. What to hand over with the code.

   • A copy of the Apache 2.0 LICENSE.
   • The existing copyright notices in the source file headers (for example Copyright (c) 2006-2020, JGraph Holdings Ltd and draw.io AG).
   • A prominent notice in every file you modified, stating that you changed it.
   • The other licence files under src/main/webapp: stencils/LICENSE, img/LICENSE and shapes/LICENSE (the icon terms in point 4), templates/LICENSE (Creative Commons Attribution 4.0, which requires attribution if you pass the templates on) and the licences of bundled third-party libraries, such as js/libavoid-js/LICENSE.
   • There is no NOTICE file in this repository, so there is none to carry over.
   • Apache 2.0 grants no trademark rights. Per the Trademark section of the README, don't brand the application with the draw.io name or logo or present it as affiliated with draw.io.

4. AWS and Google Cloud icons. The draw.io terms for the icon sets and stencil libraries are in the README and stencils/LICENSE: the icons and derivatives of them may not be used in, distributed for use with or incorporated into Atlassian products or products distributed through the Atlassian Marketplace without written permission, and diagrams created with the software (such as exported images and documents) are exempt. Your application is outside that, but keep those files with the code so the affiliates receive the same terms. The README also says some icons originate from third-party copyright holders and that draw.io has checked that their original licences permit use in this project; it doesn't restate those licences. The AWS and Google Cloud shapes are based on the providers' own architecture icon sets and carry their trademarks, so review AWS's and Google Cloud's published terms for those icons as well.

Which terms apply also depends on the version you integrated. Before 29.3.5 (January 2026) the README put the draw.io-provided icons and templates under CC BY 4.0, which requires attribution when you deliver them in an application you host; the older maintainer answers in #1981 and #5326 refer to that wording. If your copy predates 29.3.5, check the README and LICENSE files in that copy.

Notes for maintainers

Licensing question (enterprise internal app embedding the editor, source to be transferred to affiliates; AWS/GCP icons). Reporter says the support desk declined because it is a free/open-source use. The reply only summarises the repo's own files at 0f419a9 and says a binding answer can only come from the maintainers; please confirm or correct points 2 and 4 if needed.

• Terms as of 29.3.5 (commit 81a2675, 21 Jan 2026): README License section rewritten; stencils/, img/, shapes/ LICENSE files carry the Atlassian restriction with the end-user output exemption. Before that, the README put "JGraph provided icons and diagram templates" under CC BY 4.0, which is what Question about Asset licensing #1981 and License information for icons #5326 answer from.
• Inconsistency worth a look: the README says the icon sets, stencil libraries and diagram templates are under the Atlassian terms, but src/main/webapp/templates/LICENSE is still the full CC BY 4.0 text (not touched in 29.3.5). The reply tells the reporter to keep it with the templates.
• No root NOTICE file; minified bundles carry no JGraph copyright header, only the unminified sources do.
• No drawio.com docs page covers redistribution or third-party icon terms; the Terms of Use page only says it doesn't limit the Apache 2.0 rights.

_{Automated first response by the draw.io triage bot.}

[louise165]

Thank you for the detailed response. I would like to clarify one important point regarding our implementation, as our integration does not actually redistribute or self-host the draw.io source code.
Our internal application embeds the official diagrams.net Embed service (https://embed.diagrams.net) via an iframe and communicates with it through the official Embed API.
We do not include, modify, self-host, or redistribute any draw.io/mxGraph source code or related packages. The editor is rendered and operated entirely by diagrams.net. Our application only stores the diagram XML created by users and sends it back to the embedded editor when the diagram is reopened.
Similarly, AWS and Google Cloud icons/stencils are not stored, hosted, bundled, or redistributed by our application. They are provided directly by diagrams.net within the embedded editor.
Our application may later be transferred to affiliated companies, which would deploy the application independently but continue to access the same official embed.diagrams.net service via iframe.
Given this implementation, could a maintainer please confirm:

1. Whether embedding embed.diagrams.net in an internal enterprise application in this manner is permitted under the applicable diagrams.net Terms of Use;
2. Whether affiliated companies may continue using the official Embed service after receiving and independently deploying our application, without any additional draw.io licensing requirements;
3. Whether any attribution, notice, commercial license, or other requirements apply to this Embed-service usage;
4. Since the AWS/GCP icons are provided directly by diagrams.net and are not redistributed by our application, whether there are any additional draw.io requirements regarding their use within diagrams created through the embedded editor.

We would appreciate confirmation from a maintainer, as we need to document the applicable licensing requirements for our internal compliance review.
Thank you.