Licensing clarification for using the official diagrams.net Embed service in an internal enterprise application

[louise165]

Hi draw.io team,
We would like to clarify the licensing requirements for our use of the official diagrams.net Embed service in an internal enterprise application.
Our implementation

• Our application embeds https://embed.diagrams.net via an iframe and communicates with it using the official Embed API.
• We do not include, modify, self-host, or redistribute any draw.io/mxGraph source code or related packages.
• The draw.io editor is rendered and operated by diagrams.net.
• Our application only stores the diagram XML created by users and sends it back to the embedded editor when a diagram is reopened.
• AWS and Google Cloud icons/stencils are not stored, hosted, bundled, or redistributed by our application. They are provided by diagrams.net within the embedded editor.

Our planned use
The application is currently used internally within our company. We are also planning to transfer our application's source code to affiliated companies. Each affiliated company would deploy and operate the application independently for its own internal use, while continuing to access the official embed.diagrams.net service via iframe.
We would appreciate confirmation on the following:

1. Is using embed.diagrams.net via iframe in an internal enterprise application permitted under the applicable diagrams.net terms?
2. After our application is transferred to affiliated companies, may each company independently deploy the application and continue using embed.diagrams.net in the same manner?
3. Does either of the above scenarios require any additional commercial license, permission, attribution, notice, or other licensing arrangement from draw.io/diagrams.net?
4. Since the AWS and Google Cloud icons/stencils are provided directly by diagrams.net and are not stored or redistributed by our application, are there any additional draw.io/diagrams.net licensing requirements regarding their use within diagrams created through the embedded editor?

We are seeking clarification for our internal legal and compliance review before proceeding with the transfer to our affiliated companies.

Thank you for your assistance.

[draw-io-triage-bot[bot]]

The published terms for draw.io's hosted services are the draw.io Terms of Use (v1.2, 28 September 2026). The source code and the shape libraries are covered by the README. Below is what those documents say on each of your points. This is not a formal confirmation from draw.io Ltd. If your legal team needs one in writing, use the contact address in section 15 of the Terms of Use.

1. Internal use via iframe. Section 3 grants a free-of-charge, non-exclusive, non-transferable, revocable licence to use the Applications to create, edit, view and share diagrams "for personal or business purposes". Section 2 lists app.diagrams.net "and the hosted services that support them"; embed.diagrams.net is not named separately. The embed mode documentation describes embedding the editor in your own application through an iframe, and says the mode is only supported on embed.diagrams.net.
2. Affiliates deploying the application. The Terms say nothing specific about affiliates or about who operates the host application. Your code contains no draw.io code, so passing it on does not involve the Apache License 2.0. The section 3 licence is non-transferable, so it does not go along with your code; each affiliate would use embed.diagrams.net under the Terms itself.
3. Additional licence, attribution or notice. The Terms set no fee, commercial licence, attribution or notice requirement for using the hosted editor. The limits that do apply are the acceptable use rules in section 6, which include not misrepresenting any affiliation with draw.io Ltd, and section 7: the Terms give no right to use the draw.io or diagrams.net names, logos or branding.
4. AWS and Google Cloud icons. Section 4 says your diagrams belong to you and draw.io Ltd claims no ownership of them. The README restricts draw.io's icon sets and stencil libraries only for use as assets in Atlassian products or the Atlassian Marketplace, and states that the restriction does not apply to end-user diagram output. It also notes that some icons were originally created by third-party copyright holders, which is the case for the AWS and Google Cloud sets. If your review covers how those icons are shown, Amazon's and Google's own icon guidelines are the ones to check.

Also relevant for a compliance review: under sections 9 and 10 the hosted services are provided as is. They may be changed, suspended or discontinued, and support response times are not guaranteed unless agreed separately in writing. If your organisation would rather not depend on a hosted service, the editor can be self-hosted, for example with the Docker image, and opened with embed=1 (see the maintainer's comment in #3566). In that case you would be hosting draw.io code yourself, so the Apache License 2.0 would apply to it.

Notes for maintainers

Licensing question about using embed.diagrams.net from an internal app, and passing the host app's source on to affiliates who would each deploy it. The reply only reports what the published documents say (Terms of Use v1.2 sections 2 to 10, README License section). It says plainly that it is not a formal confirmation and points to the section 15 contact for a written one.

Worth knowing: Terms of Use section 2 names app.diagrams.net "and the hosted services that support them" but does not list embed.diagrams.net on its own. If that is meant to be covered explicitly, the Terms could name it. The support page says the free web app has no support desk, so the reply points to the Terms contact address and not the service desk. The self-hosting pointer follows the maintainer's comment in #3566.

_{Automated first response by the draw.io triage bot.}