Oracle has no contractual audit right over GPL MySQL, yet it opens MySQL claims through 4 discovery paths and prices them against a $5,350 per server list
Community Edition under the GPL carries no audit clause, so Oracle cannot compel a MySQL review the way it can under an OMA. It gets in anyway: download telemetry tied to a corporate account, commercial binary names in your CMDB, LMS scripts already inside the estate for Database or Java, and support tickets that name the edition. Because the claim is priced at $5,350 to $16,050 per server per year for Enterprise Edition plus 22% support arrears, the defense is evidentiary, not legal, and it has to exist before the letter arrives.
Prepared by Redress Compliance · August 17, 2026 · Oracle advisory. MySQL and LMS engagements 2024 to 2026.
Executive summary
The GPL gives Oracle no audit right, so every MySQL claim you will ever see is bootstrapped from an artifact you handed over: a download, a support ticket, a package name, or a script run under a different contract.
That means MySQL exposure is not a legal question about entitlement scope, it is an evidence question about what your estate self-reports and who at Oracle already has it.
Oracle's cheapest entry point is the download log, and it is authenticated: every Enterprise Edition trial from eDelivery and every OTN developer download binds a named person and corporate email to a license grant that is development-only.
The Java enforcement wave ran on exactly this telemetry, and the same account infrastructure serves MySQL Enterprise Edition trials, MOS customer downloads, and the 30-day Cluster CGE trial.
MySQL enters scope silently in Database and Java audits because LMS scripts inventory installed binaries, running processes, and configuration files across the host, not just the product named in the letter.
Assume that if an LMS letter names Oracle Database or WebLogic and MySQL runs anywhere on the same hosts or connects to those applications, MySQL is in the collection whether or not it is in the notice.
The financial exposure is not the subscription, it is the subscription plus backdated support plus the ISV distribution question, and OEM has no published price list at all.
Enterprise Edition lists at $5,350 for 1 to 4 sockets and $10,700 for 5-plus, support runs at 22% per year, and if Oracle characterizes your product as distributing MySQL, pricing moves to a negotiated OEM deal where you have no published anchor to argue against.
The four discovery paths, and what each one can actually prove
Oracle has no contractual audit right over Community Edition. What it has is four evidence streams that, in combination, are enough to justify a phone call and a spreadsheet. The first is download telemetry.
Every Enterprise Edition binary comes through one of three authenticated doors: Customer Download from My Oracle Support, Trial Download from Oracle eDelivery (the 30-day Cluster CGE trial runs here).
And Developer Download from Oracle Technical Resources under the OTN license, which authorizes access only for development, prototyping, and learning unless you already hold a commercial license through an OMA and ordering document.
Each door records a corporate email domain and, frequently, an account already mapped to your Oracle customer number. The second is binary naming in your own inventory.
The commercial artifacts are self-identifying: mysql-shell-commercial, mysql-enterprise-9.4.0_el9_x86_64_bundle.tar, the enterprise audit and TDE plugin names.
Those strings sit in CMDB records, container manifests, Dockerfiles, Ansible playbooks, and RPM databases, and they surface in tooling sweeps you paid for. The third is LMS script output collected under a different contract.
If Oracle is auditing your Database or Java estate under a real audit clause, the scripts do not politely stop at the MySQL boundary. The fourth is the support ticket trail, where an engineer names the edition, quotes a build string, or attaches a config file in an SR filed against another product.
| Discovery path | Artifact Oracle holds | Evidentiary strength | Document that neutralizes it |
|---|---|---|---|
| Download telemetry (OTN, eDelivery, MOS) | Authenticated account, corporate domain, timestamp, product and build | Proves acquisition, not deployment or duration | Developer attestation register: named user, project, non-production host, deletion date |
| Commercial binary naming in CMDB or container manifests | Package strings such as mysql-shell-commercial or mysql-enterprise bundles | Strongest path. Proves a paid-only artifact exists on a host you own | Removal ticket with change number, plus post-removal package scan showing community builds only |
| LMS script sweep run under a Database or Java audit clause | Host-level installed-package output collected lawfully under another agreement | Proves presence on scanned hosts only. Scope is bounded by the clause it was run under | Written scope limitation letter filed at audit kickoff, restricting output use to the audited product |
| Support ticket trail | SR text, attached my.cnf, build strings, engineer notes | Weak alone. Proves an employee said something, not what runs in production | SR closure note correcting the record, plus your own edition inventory dated the same week |
Read the middle column carefully, because it is where buyers misread the game. Oracle does not need to prove breach.
It needs enough signal to justify a soft commercial approach: a friendly note from a MySQL specialist asking to "align on your open-source estate." That approach costs Oracle almost nothing and, in our experience.
Converts at a far higher rate than a formal audit letter, because there is no defined process for you to push back against.
The practical consequence is that the rebuttal column has to exist before the approach, not after. A removal ticket dated three weeks after Oracle's email reads as concealment. The same ticket dated eleven months earlier reads as governance.
Our breakdown of the enterprise tools that quietly trigger a subscription lists the specific package names worth standing scans against.
Why the absence of an audit clause makes MySQL harder to defend, not easier
The instinct is understandable: no clause, no obligation, no exposure. In practice the missing clause removes your procedural leverage rather than Oracle's. Under an OMA, the audit right is also an audit constraint. Oracle owes you notice, typically 45 days.
The review has a named scope, a defined product set, and an end state, a final report you can dispute in writing. You get to review scripts before they run, negotiate collection methodology, insist that output be used only for the audited product, and escalate when LMS drifts outside the boundary.
Those are real handles, and the good outcomes in Oracle audit defense are built almost entirely on them.
Strip the clause out and none of that machinery exists. A MySQL approach is an unbounded commercial conversation. There is no notice period because there is no formal start.
There is no agreed scope, so every question can widen: first the production estate, then dev and test, then container images, then the SaaS platform your subsidiary ships to customers.
There is no defined end state, so the discussion continues until you sign something or Oracle loses interest, and Oracle has more patience than your CFO. There is no dispute mechanism because there is no report to dispute.
And critically, there is no obligation on either side, which sounds symmetrical but is not: you are the party with an unquantified liability and a renewal calendar.
This is why the buyers who open with "you have no right to audit us" concede faster than the ones handed a formal audit letter. That statement is legally correct and tactically empty.
It ends the legal argument and hands Oracle the commercial one, and the commercial argument is where the $5,350 to $16,050 per server per year list price plus 22% support arrears gets applied to a host count that nobody in your organization can currently prove.
Treat the approach as an audit you are administering yourself: impose the notice, define the scope in writing before you answer anything, name a single response owner, and set your own end state. The discipline the OMA would have forced on Oracle is discipline you now have to supply.
Oracle Audit Defense Strategy
The strategic approach for Oracle audit defense across LMS, license verification, and contractual response. Beyond the tactical playbook.
Get the white paper →The real trigger is not scale, it is a signature: what Oracle looks for before it calls
Oracle does not detect MySQL. It has no agent in your estate, no phone-home in Community Edition, and no contractual right to look. What it detects is a mismatch: a commercial signal that exists in Oracle's own records paired with the absence of a matching order in Oracle's own contract database.
That mismatch is the product. It is cheap to find, it is documentary, and it converts into a priced claim without anyone from Oracle ever touching your network.
Everything else you worry about (server counts, replica topologies, whether the DBA turned on a plugin) is downstream of whether that first mismatch exists.
Run the comparison that Oracle's own targeting logic runs. Account A is a $0 lifetime revenue company that authenticated three times against Oracle Technical Resources and pulled Enterprise Edition binaries under the Limited Development license.
Account B runs 400 Community Edition servers, has never created an Oracle account, and has never resolved an oracle.com download endpoint.
Account A is the better target by a wide margin, not because it is bigger, but because it produced a document with a date, a corporate email domain, and an accepted license agreement whose terms are development-only. Account B produced nothing. There is no letter you can write against nothing.
This inverts the usual compliance instinct, and in twenty-five years I have watched it burn buyers repeatedly. Teams pour effort into hardening the production estate: standard builds, CMDB hygiene, plugin lockdown, a policy memo about Enterprise features.
Meanwhile the actual evidence was created eighteen months earlier on a developer laptop, by an engineer who wanted MySQL Enterprise Backup for a weekend proof of concept and clicked through the OTR agreement with a work address. The 400-server estate is defensible on the GPL.
The laptop is the exhibit. Oracle does not need the estate to be commercial.
It needs one artifact suggesting a commercial edition entered the building, and then it asks you to prove the negative across everything else, which is exactly the conversation described in MySQL Community vs Enterprise: when free MySQL becomes a paid Oracle subscription.
For ISVs the signature moves outside your infrastructure entirely, which is why so many software vendors are exposed without a single Oracle account in their name. The signal is a public product download page listing MySQL as a prerequisite.
It is a docker-compose.yml in a public repository pulling a MySQL image alongside your application container.
It is an installation guide with a section titled "Database requirements." Oracle's stated advisory position treats optional components, recommended dependencies, and auto-installed databases as distribution requiring OEM coverage.
And has pressed the same reading against SaaS operators running MySQL in their own infrastructure on behalf of customers.
That characterization is aggressive and it is not settled law, so treat it as a negotiating posture rather than a legal conclusion.
The practical consequence is unpleasant regardless: your marketing site, your solution architects, and your documentation team are authoring your licensing exposure, and none of them know it.
There is a second-order effect worth naming. Because the signature is public, it is also permanent and third-party discoverable.
A partner's reference architecture, a conference deck, a job posting asking for "MySQL Enterprise Monitor experience," a Stack Overflow answer from a named employee referencing an Enterprise-only feature: each is a durable artifact outside your control.
Contrast this with an Oracle Database or Java estate, where discovery still generally requires either script output you agreed to run or a support contract that already exists.
MySQL claims are built from open sources plus Oracle's own account logs, which is why they arrive as a confident assertion rather than a request to measure.
The strategic implication follows directly. The buyer-side control that matters here is not deployment hygiene, it is signal hygiene, and its cost is close to zero if you do it before contact.
Centralize and gate Oracle account creation so no engineer can accept an OTR development license under a corporate domain without approval. Scrub public documentation so MySQL appears as a customer-supplied dependency rather than a bundled or auto-installed one.
Instrument outbound DNS for oracle.com and mysql.com download hosts, and know what your own logs say before Oracle tells you what its logs say. Do this after the letter arrives and every change looks like spoliation. Do it eighteen months earlier and there is simply no mismatch to price.
Pricing the claim: what Oracle asks for and what the numbers actually support
| Edition and socket tier | List, per server, per year | Where the claim inflates |
|---|---|---|
| Standard Edition, 1 to 4 sockets | $2,140 to $6,420 | SE2 caps at 4 sockets and 2 machines per replication group; a third replica pushes the whole group to Enterprise |
| Standard Edition, 5+ sockets | $4,280 to $12,840 | Tier doubles on socket count alone, independent of cores or workload |
| Enterprise Edition, 1 to 4 sockets | $5,350 to $16,050 | The default edition in every Oracle demand letter, even where only one Enterprise feature is alleged |
| Enterprise Edition, 5+ sockets | $10,700 to $32,100 | Virtual guests reporting 8 vCPUs get argued into this tier despite occupying no physical sockets |
| Cluster CGE, 1 to 4 sockets | $10,700 to $32,100 | Applied wherever NDB or clustering language appears in your own documentation |
| Cluster CGE, 5+ sockets | $21,400 to $64,200 | Rarely enforceable, frequently quoted as an opening anchor |
| Support uplift | 22% of license, per year | Backdated across the alleged use period; Matching Service Levels then pulls every other license of the product into support |
Read the table as two different documents. The socket ladder and the 22% support rate are published, consistent, and enforceable once you concede that a commercial edition was in use. Everything in the right-hand column is a construction, and constructions are negotiable.
The most expensive single move is silence on the vCPU-to-socket question: Oracle's own definition ties a socket to a physical slot housing a chip, so a guest reporting 8 vCPUs on a 2-socket host is a 1-to-4-socket server, not a 5-plus server.
That distinction alone is the difference between $5,350 and $10,700 per server before arrears.
The second construction to break is arrears. Oracle will price backdated support from the earliest download timestamp it holds, then apply Matching Service Levels so that supporting one MySQL license drags every MySQL instance you own into a supported, priced state.
Neither the start date nor the scope is automatic. Push the clock to the date of documented production use, not the date a developer accepted an OTR license, and refuse a company-wide Matching Service Levels sweep as the price of settling a narrow finding.
Also model your topology before you consolidate: dense multi-socket hosts price higher per server, so collapsing 12 small MySQL servers onto three 8-socket boxes can raise total cost even as server count falls.
A trap covered in detail in how Oracle prices MySQL Enterprise Edition on the per-server metric.
What defensible open-source use looks like on paper
A MySQL claim ends when you hand over artifacts, not arguments. Oracle cannot compel a Community Edition review, so the conversation runs on whatever evidence each side can produce, and the side with dated, sourced files controls it.
The pack that closes the discussion has five components: provenance of the binaries, a package inventory that shows no commercial strings, an absence of Oracle account download history, proof that no Enterprise-only feature is enabled, and for managed cloud MySQL.
The provider contract that removes Oracle from the chain entirely.
Build it while nothing is happening. Assembling provenance retroactively across 200 hosts after a letter arrives is where most of the negotiating room gets spent, and it is the same failure pattern we document in every exposure has one artifact that clears it, and most of them expire.
File by file, with a named owner for each: package manifests from rpm -qa, dpkg -l, or the container image SBOM, showing mysql-community-server or the distro-maintained mysql-server and no -commercial or -enterprise suffix (platform engineering).
Repository configuration and mirror URLs proving the source was a distro repo, MySQL's own community yum/apt channels, or an internal Artifactory mirror rather than eDelivery or My Oracle Support (build and release).
An attestation from IT that no corporate-domain account holds MOS or eDelivery MySQL download history, ideally backed by a checked list of Oracle account holders (identity and access management).
Output of SHOW PLUGINS and SHOW VARIABLES across the fleet demonstrating no audit plugin, no TDE keyring, no firewall, no Enterprise Backup and no Enterprise Monitor agent, cross-checked against the feature list in the MySQL Enterprise tools that quietly trigger a subscription requirement (database engineering).
And for RDS, Azure Database for MySQL, or Cloud SQL, the executed provider agreement plus instance inventory, because the license flows from the hyperscaler and Oracle is not a party (procurement).
Refresh the whole pack quarterly and timestamp it.
Evidence base: the patterns we see repeat across engagements
The 5-plus-socket band doubles to $10,700 to $32,100, and support arrears accrue at roughly 22% of license per year.
MySQL.com routes EE through My Oracle Support, eDelivery trial, and OTN developer, each requiring an Oracle account tied to a company identity.
Five patterns recur. First, download telemetry as a trigger is documented Oracle practice, not speculation: Oracle monitors who pulls software and patches, and the Java campaigns ran substantially on download traces before any letter went out. The same telemetry now points at MySQL.
Second, LMS scripts already deployed for Database or Java collect MySQL evidence in passing, which is why MySQL shows up as an active target in engagements rather than a theoretical one.
Third, the three-door architecture on MySQL.com means every Enterprise binary in your estate has a named human and a corporate domain behind it, and the OTN developer license permits development and prototyping only.
Fourth, Enterprise bundles self-report: the -commercial and -enterprise package strings sit in your own CMDB, so a discovery tool you paid for becomes Oracle's inventory.
Fifth, ISVs consistently find OEM economics turn unattractive at commercial scale, and with no published OEM price list there is no benchmark to test the quote against, which is why OEM negotiations belong beside the metrics work in how Oracle prices MySQL Enterprise Edition.
Separate the documented from the asserted. List prices, socket metrics, the SE2 four-socket and two-machine replication ceilings, Matching Service Levels, and the three download channels are Oracle's own published terms.
Oracle's expansive reading of distribution, that an optional component, a recommended dependency, or MySQL running inside your SaaS platform triggers OEM coverage per copy, is advisory-firm characterization of enforcement behavior. It has not been adjudicated.
Treat it as a negotiating position Oracle will assert with confidence and no case law behind it, and price your resistance accordingly.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
Your first five moves
- Sweep every host and image for commercial package strings this quarter. Infrastructure engineering owns it, the artifact is a dated inventory of every RPM, DEB, tarball, and container layer matching mysql-commercial or mysql-enterprise, and it neutralizes the CMDB path by proving you know what Oracle would find before Oracle finds it.
- Pull download history for every corporate domain, then freeze the tap. Identity and procurement jointly own it: enumerate all Oracle SSO, Oracle Technical Resources (OTN), My Oracle Support, and eDelivery accounts registered under your domains, list what each one pulled and when, and put new Oracle downloads behind a named approver, because a 30-day Cluster CGE trial and a development-only OTN download both leave the same authenticated corporate fingerprint.
- Read your own support tickets before Oracle quotes them back at you. Service management owns the extraction of every case, chat log, and email where a staff member wrote Enterprise Edition, MySQL Enterprise Backup, TDE, audit plugin, or firewall, and the artifact is a reconciliation showing each edition reference either matched to a live subscription or corrected as a naming error, which is the only way to blunt the ticket-trail path.
- Audit your product docs, install scripts, and Dockerfiles for distribution language. Product management and engineering own it, and the deliverable is a review of any text or automation that bundles, auto-installs, or recommends MySQL alongside your shipped software, since Oracle reads optional components and auto-installed dependencies as redistribution requiring OEM coverage, priced with no published list, as covered in when free MySQL becomes a paid subscription.
- Route every Oracle contact to one named owner with a no-data-without-scope rule. Legal or the SAM lead owns the mailbox, the artifact is a written intake protocol requiring the contractual basis, the entitlement in scope, and the requested data set in writing before any response, and it removes the informal soft-audit conversation that most Oracle exposure actually starts with.
Frequently asked questions
Can Oracle legally audit MySQL Community Edition?
Not through a contract, because the GPL contains no audit clause and grants no inspection right. Oracle can only ask, and any data you provide is voluntary.
What Oracle can do is act on evidence it already holds, such as download records tied to your corporate domain or LMS script output collected under a separate Oracle Database or Java audit clause, and open a commercial discussion from there.
How does Oracle find out we are using MySQL commercially?
Four ways in practice.
Authenticated downloads of Enterprise Edition from OTN, eDelivery trials, or My Oracle Support that bind a named corporate account to a development-only or trial license; commercial binary names such as mysql-shell-commercial appearing in CMDBs, package inventories, and container manifests.
LMS scripts run during an Oracle Database or Java audit that inventory all installed binaries and processes on the host; and support tickets or sales correspondence in which someone names the edition.
Does downloading MySQL Enterprise Edition for testing create a license liability?
The download itself is permitted under Oracle's development license, which authorizes learning, developing, and prototyping only.
The liability arises if those binaries reach a production or production-support system, because the license does not cover that use and Oracle holds the download record with a name and date attached.
Treat every Enterprise Edition download as a dated evidentiary artifact and keep a log of what it was used for and when it was removed.
Is MySQL included in an Oracle Database or Java audit even if the letter does not mention it?
Assume yes. LMS collection scripts inventory installed binaries, running processes, connected applications, and configuration files on the hosts they run against, and they correlate MySQL with other Oracle products, for example WebLogic applications pointing at a MySQL backend.
If a letter names Database or Java and MySQL runs on the same estate, negotiate the script scope in writing before anything runs.
What does MySQL Enterprise Edition cost if Oracle claims we owe it?
Enterprise Edition lists at $5,350 per year for a 1-to-4-socket server and $10,700 for 5-plus sockets, with the ladder running up to $16,050 and $32,100 depending on the configuration. Standard Edition sits below at $2,140 to $6,420 for 1-to-4 sockets and Cluster CGE above.
Expect Oracle to add support at roughly 22% of license price per year and to attempt backdating across the period it believes the shortfall existed.
Do we need an Oracle license for MySQL on Amazon RDS, Azure Database, or Cloud SQL?
No. Managed MySQL from AWS, Azure, or Google is licensed through the cloud provider and does not require an Oracle subscription. That contract is one of the cleanest artifacts in a defense pack, because it removes Oracle from the licensing chain entirely for those workloads.
Keep the provider agreement and a workload inventory showing which databases sit there.
When does embedding MySQL in our product require an OEM license?
Whenever you distribute MySQL binaries with proprietary software and do not want GPL copyleft reaching your own code.
Oracle takes an expansive view here and will argue that bundling MySQL as an optional component, a recommended dependency, or an auto-installed database triggers OEM coverage for every copy shipped.
There is no published OEM price list, so the negotiation starts without a public anchor, which is why you want the distribution question settled before Oracle raises it.
How to Negotiate an Oracle ULA: No Price List, Just Your Business Case
There is no price list: the ULA fee is a story built from your estate and your growth. Give conservative growth answers, keep the product list narrow, model the breakeven yourself, and negotiate the certification exit before you sign.
