Open Source & Third-Party Software
Transparency, compliance, and our commitment to the communities that power our work. This document outlines the open-source and third-party components used across That Is A Q's product ecosystem.
Our Open Source Philosophy
That Is A Q recognizes that modern software development stands on the shoulders of a vast, collaborative community. We actively use, test, and contribute to open-source projects. Our commitment includes:
We maintain a centralized software bill of materials (SBOM) for all client deliveries and internal tools to ensure full traceability and licensing compliance.
Dependency Registry
Below is a curated list of core open-source and third-party libraries integrated into our standard development stack. For the complete machine-readable SBOM, contact our engineering team.
| Package / Tool | Category | License | Usage Context |
|---|---|---|---|
| React | Frontend Framework | MIT | UI components, SPA architecture |
| Next.js | Full-Stack Framework | MIT | Server-side rendering, routing, API routes |
| Node.js | Runtime Environment | BSL 1.1 | Backend services, build tooling |
| PostgreSQL | Database | PostgreSQL | Primary relational data store |
| Tailwind CSS | Utility CSS Framework | MIT | Responsive styling system |
| Stripe.js | Third-Party SDK | Commercial | Secure payment processing |
| Docker | Containerization | Apache 2.0 | Development & deployment environments |
| Playwright | Testing Framework | Apache 2.0 | E2E testing automation |
| ESLint | Linting / Code Quality | MIT | Static analysis & formatting |
| AWS SDK | Cloud Services | Apache 2.0 | Storage, compute, and networking APIs |
Compliance & Attribution Policy
All open-source components used in That Is A Q projects are tracked against the OSI Open Source Definition. We enforce the following compliance standards:
- Automated license scanning via CI/CD pipelines on every commit
- Mandatory attribution files (
NOTICE,CREDITS.md) bundled with client deliveries - Strict prohibition of non-permissive or copyleft licenses unless explicitly approved by legal & client
- Quarterly SBOM audits and dependency vulnerability assessments
- Transparent disclosure of all third-party services integrated into client products
If you are a maintainer of an open-source project used by us and believe attribution is missing or incorrect, please open a ticket via our compliance portal.
Security & Vulnerability Management
Security is treated as a first-class citizen in our dependency management workflow. We utilize automated tools and manual review processes to mitigate risks:
High (CVSS 7.0–8.9): Patches within 5 business days
Medium/Low: Addressed in standard release cycles
We participate in coordinated vulnerability disclosure (CVD) programs and encourage responsible reporting. If you discover a security issue in any of our published open-source tools, please email security@thatisaq.com.
Contribution Guidelines
We welcome contributions to the open-source projects we maintain and use. Whether it's a bug fix, feature request, documentation improvement, or translation, all contributions must adhere to:
- Our Contributor License Agreement (CLA) for external maintainers
- Consistent code style enforced via pre-commit hooks and CI checks
- Clear, concise commit messages following Conventional Commits spec
- Respectful collaboration aligned with our Code of Conduct
To get started, review our GitHub organization templates, fork the repository, and submit a pull request. Our engineering team will triage and merge approved changes within one sprint cycle.
Need Licensing or Compliance Documentation?
For official SBOM exports, license verification reports, or enterprise compliance agreements, please reach out to our legal & operations team:
Email: compliance@thatisaq.com
Portal: oss.thatisaq.com/registry