Software License Audit
Term 64 of 68 in the ERPStack technical glossary
What is Software License Audit?
A Software License Audit is a compliance review where a software vendor (SAP, Oracle, Salesforce) audits a customer's actual system usage against their contracted license terms — often resulting in six-figure true-up invoices for unlicensed usage.
Software License Audit at a glance
- Two surfaces
- 1 commercial seat-entitlement check and 1 open-source obligation check over the dependency tree
- Evidence
- 1 SBOM per build listing 100% of direct and transitive packages, not a once-a-year snapshot
- Automation
- A GitHub Actions gate that fails the pipeline on a disallowed licence, at merge rather than at release
- Common gap
- Copyleft pulled in 3 levels deep by a dependency nobody chose directly
- Built with
- GitHub Actions generating an SBOM across a TypeScript 5.9, Next.js 16 and Node.js dependency tree, with Semgrep SAST beside it and results retained per build
- Numbers that matter
- 1 SBOM per build; 3 levels deep is where copyleft hides; 0 disallowed licences merged; 2 exposures, commercial seats and open-source terms
- Two exposures
- Seat entitlements in Salesforce, Oracle NetSuite or Microsoft Dynamics 365, and open-source obligations
- Toolchain
- GitHub Actions, Semgrep SAST and dependency scanning across the Node.js tree
- Vendor surface
- Seat and module entitlements at SAP S/4HANA, Oracle NetSuite, Microsoft Dynamics 365, Salesforce, Epicor ERP, Sage X3, Odoo and Zoho Creator — 8 estates and 8 different definitions of a named user.
- What starts a review
- 3 events dominate: a merger, a renewal at the end of a 3-year term, and a headcount jump of 20% or more since the contract was signed.
How Software License Audit works in production
The ERPStack approach to Software License Audit
We help clients build License Audit Risk Assessments during the discovery phase, quantifying their current license exposure vs. the cost of a custom replacement — typically showing 3-year savings of $2M+ for mid-market companies.
Frequently asked questions about Software License Audit
What does a Software License Audit actually examine?
Two different things that share a name. A commercial License Audit checks whether your seat and processor entitlements match actual deployment, which is a contractual exposure. An open-source License Audit checks the obligations attached to every package in the dependency tree — attribution, source availability, copyleft reach. The second is usually the surprise, because transitive dependencies are pulled in automatically and rarely reviewed.
How do you keep a License Audit from becoming an annual panic?
Run it continuously. A License Audit that happens once a year discovers problems after they have shipped, when removing a package means reworking features. Generating a software bill of materials on every build and failing the pipeline on a disallowed licence turns the same check into a 30-second gate at merge time. The cost of removing an offending dependency at that point is close to zero.
Why does licence exposure matter for a shipped ERP?
Because obligations travel with distribution. If a License Audit finds a copyleft component inside software delivered to a customer, the remedy may be publishing source you intended to keep private, or replacing the component under time pressure during a deal. Enterprise buyers increasingly ask for a bill of materials during procurement, so the artefact is worth having before it is requested.
What does ERPStack do about licensing on delivered code?
We keep the dependency surface small and reviewable, generate a bill of materials as part of the build, and gate merges on licence policy in GitHub Actions. Because clients own the repository outright, a License Audit performed later runs against the same artefacts we used — there is no vendor black box in the middle whose contents nobody outside the vendor can enumerate.