Open source
Open where it counts, and closed where it still is
The honest version of this page is shorter than the usual one. The server your pod runs on is not ours, most of what we did write is public, and the web app you are looking at right now is not. Each of those is a separate fact and they are listed separately below.
The pod server is not ours
Your pod is served by Community Solid Server, the Solid community's reference implementation, under the MIT licence. We deploy it, bridge it to a DID you control, and put an interface on it. We did not reimplement Solid and we do not intend to — a second implementation of a specification is a liability, not a moat.
What we wrote, and published
Public repositories relevant to anyone auditing pod. Licence and language read from the GitHub API on 2026-08-12; nothing here is a paraphrase of a plan.
The did:solidus method specification — how the identifier your pod is addressed by is created, resolved and updated.
The chain node: consensus, the DID registry, and credential anchoring.
The TypeScript SDK — DID resolution, credential issuance and verification, chain client.
A DIF Universal Resolver driver, so a did:solidus identifier resolves from infrastructure that is not ours.
Test vectors, so an independent implementation can check itself against the same expected outputs we do.
The Python SDK.
What is not open
This web application. The pod frontend and its backend live in a private repository and are not published, so the interface you are using cannot be audited by reading it. The parts that decide what your pod does — the server, the access-control model, the identifier — are all public; the parts that decide how it looks are not.
There is no dated commitment to open it. Saying "soon" would be a promise with nobody accountable for it.
On open standards, without the flourish
Solid is a W3C-community specification for personal data stores, and it is the reason a different application can read your pod without asking us. That is a property of the protocol, not a favour we grant. What we have not done is prove it: the Solid conformance suite has not been run against our deployment, so we say Solid-compatible and never Solid-conformant.