Use of OSM in closed, commercial software

I would suggest you to contact the 'legal-talk' mailing list and ask your question there (subscription required but you can then easily unsubscribe when you get your answer). The present Help site is more destinated to new contributors and your question involves legal expertise which is a rare commodity here.

Also, you will have to clarify one point in your question : are you going to use the OSM map tiles only ? or the data directly ? This is important since the OSM data is licensed under ODbl but map tiles can be licensed differently (the main rendered map available at osm.org is released under cc-by-sa). Check the Legal FAQ to understand the different licenses in OSM environment.

Development of closed software is possible, except that your closed licence MUST include a restriction in its scope so that the OSM data itself remains open and accessible. In other words, open the access to the OSM database used in your application.

This does not mean that you cannot feature for your application another separate database containing closed data.

But if your application allows modifiying the OSM data (and sends them to OSM), that part should remain open, up to the documentation of OSM API's it uses to connect to OSM and with all the requirements needed so that your users WILL HAVE TO create an account and accept the Contributor terms if they wish to submit modifications or additions.

The same users should also have a separate access to their account on OSM, even if the application creates the account for them. Each user of your app should be identifiable in OSM for the data they submit to OSM via your application, and should be able to read themselves the comments and messages sent to them, without needing an extra privilege (so the email of subscription, and the OSM password should be left known to them).

All the data they will submit to OSM through your application will be licenced under ODbL, per their personal acceptance of the OSM Contributor terms. You must expose the OBdL licence and the Controbutor Terms to them and make sure they can read it before accepting them. They are not required to accept these terms, but then their usage of OSM data in your application will be readonly (but enve in this case, they should know the OBdL licence so that their reuse of displayed/printed data will be conforming to the licence).

If your application prints maps or data extracted or derived from OSM, or generates PDFs, or generates other a derived database, the copyright, attribution, and mention of the licence (ODBL for derived data, or CC-BY-SA for maps rendered by OSM with Mapnik) MUST be present in the generated documents, even if you add also other closed data in the document, covered by separate IP rights.

In addition, your application should also abey the rules dictated for the usage of external tile renderers (but you can and probably should also host your own tile renderer in your application environment to avoid abusing rules of usage, notably if your application has many users).

There exists several open frameworks to mix open and closed layers on the same page. See Leaflet and OpenLayers for example (for display in a browser, or in a browser component embedded in your application).

Think of it as if you were creating and publishing a newspaper or book : the photos included, coming from press agencies or independant photographs, or citations, are explicitly giving the necessary attributions, even if the newspaper or book is for sale; but the newspaper cannot restrict or add more rights to these photos, which may also be obtained independantly of your newspaper or book.

The only tolerance is the strict personal and local use, but this excludes use of data by multiple people in an organisation. The licences MUST be respected as soon as each one will decide to share this information to someone else which is not in its close family and home (that person is held responsable of telling them what they can or cannot do about these revealed information).

For example, it is perfectly legal to create a website that uses the LeafLet or OpenLayers framework to superpose on the same page maps from OSM and maps from Google. For that, you need a (closed) licence from Google and the (open) CC-BY-CA licence from OSM for its rendered tiles server. These maps are distributed to your web application separately, and separately identifiable in their own licences. And in both cases you must respect the terms and usage rules of each server.

Google will block the free delivery to your application if you exceed a given threshold of usage (and Google will want you to pay) and Google will not allow you to redistribute his images.

For OSM rendered tiles, your application may be blocked temporarily for abuses if you exceed the reasonnable usages but OSM will not allow you get get more rights pay paying, but the images themselves that you have in your cache remain under CC-BY-SA licence.

These restrictions will be true if you use tiles rendered by others from OSM data (such as MapQuest) : consult the usage terms of these services.

If you want to be avoid being blocked in the case of OSM rendered tiles, you should install your own tiles renderer for your users. In that case your tiles server will download data updates from its database, and these data will remain under ODBL licences, but your renderer can create tiles distributed under CC-BY-SA, or under closed licence, provided that these rendered images are not reused to regenerate a new database from them (but you should still credit OSM attribution for the data used by your renderer to avoid problems later with your users : it's best to let them know rom where the map comes, to avoid them generating a new derived database and release it to others under closed licence).

Your application code may remain closed but not the APIs it uses to retreive or submit either data covered by ODBL and OSM Contributor Terms, or maps covered by CC-BY-SA.

Your users are not required to accept the OSM Contributor Terms if your application just expose them the CC-BY-SA rendered maps or ODBL data without them modifying these data sent to OSM.

But your closed application can allow these same users to modify your own separate database which does not contain any OSM data.

Be careful also to geolocalisations made using Nominatim (this is derived data covered by ODBL): if these geolocalisations are made to be inserted massively in a database, you're creating a new derived database covered by ODBL. In this case, you'll need to separate this gelolocalisation data in a database separated from the database used for your other private data.

The level of integration between these databases may be an issue depending on usage. If in doubt about this, or which licence to use between CC-BY-SA for rendered images and ODBL for data, consult the legal team of OSM, notably if you'll advertize your application to the public and not in a closed group of users — notably if you sell this application to other groups of users or organisations and want to make demos for your presales needs or advertizing, or want to make a part of your application visible to the public on the web : you won't be allowed to mix closed and open data in a web API of your application without a clear separation between these data and proper attributions (ideally the APIs should be distinct).

One example: you want to sell your closed data under your own terms and build an API for them. Your API exposes unique identifiers for your data but not the data themselves. The OSM data may contain extra "ref:countrycode:yourapplication=*" attributes to reference your external closed data, but then you'll need to publish an open licence for open usage of your unique identifiers inserted in this "ref:*" attribute. Otherwise, even these refs are incompatible with OSM data.

And in all cases, you must obey the laws that are applicable to you and to those hosting your web application on their servers or colocation area and to the contents exposed by your application (regarding IP rights, personal rights, copyrights, author's moral rights, and privacy of your users of those that you may include in your exposed database, for example phone numbers, people names, their contact addresses, their own photos, even if they are in another country, according to international treaties and conventions ratified by laws of your country...). For these concerns, OSM will not help you, consult a lawyer.