Sources
Public source register
One entry per external source Atalaya queries: what it is for, under what licence, and its status. This register is the compliance contract; the public subset is published here, with no secrets and no tenant data.
Source
| Source | Purpose | Licence | Status |
|---|---|---|---|
| SearXNG (searxng) | web discovery (primary) | AGPL-3.0 (SearXNG). Self-hosted use does not distribute the software; the metasearch results carry the underlying engines' own terms. | Implemented |
| Brave Search API (brave) | web discovery (fallback + freshness) | Brave Search API Terms of Service. | Implemented |
| SecurityWeek RSS | ciberseguridad prensa | content © SecurityWeek; we consume headlines + links and link back, never republish. | Implemented |
| The Hacker News RSS | ciberseguridad prensa | content © The Hacker News; we link and summarise, never republish. | Implemented |
| CSO Online RSS | ciberseguridad prensa | content © CSO Online (IDG); we link and summarise, never republish. | Implemented |
| Google News RSS | nota de prensa producto IA (ES/EU/LATAM) | Google News RSS feed terms; we consume headlines + links only. | Implemented |
| LinkedIn jobs | ofertas "LLM/AI engineer" | LinkedIn User Agreement + Professional Community Policies. | Implemented |
| Indeed | ofertas "LLM/AI engineer" | Indeed Terms of Service; we consume job listings for prospecting, not for resale. | Implemented |
| BORME (boe.es) | BORME diario | BORME/BOE — Ley 37/2007 reutilización de la información del sector público; attribution boe.es required (PRD §10 L-5). | Implemented |
| Futurepedia | directorio herramientas IA | Futurepedia terms of use; we consume the directory listing, not its content wholesale. | Implemented |
| WhatsMyName (whatsmyname) | identidad — verificación de handle (solo verificación) | the upstream dataset is community-maintained under the repository's own licence (WebBreacher/WhatsMyName; a non-SPDX "Other" declaration — no SPDX id to cite). Each probe reads a site's own public page and remains subje… | Implemented |
| holehe (holehe) | verificación de email — registro en sitios | holehe (github.com/megadose/holehe) is GPL-3.0. Atalaya re-implements the documented approach in Go (no GPL code is copied) against each site's own public endpoint, under that site's terms. | Implemented |
| Hunter Email Verifier (hunter) | verificación de email (free) | Hunter.io API Terms of Service. The free tier is the §5.1 "Hunter free (verificación)" surface. | Implemented |
| GitHub Search API (github) | Radar de Herramientas — herramientas/frameworks (§7) | GitHub REST API Terms of Service; the results carry each repository's OWN licence, which the radar classifies (⚠️ GPL/AGPL/ sustainable-use → internal-only; permissive → candidato a pipeline). | Implemented |
| OpenRouter (DeepSeek family) (openrouter) | LLM scoring + radar (PRD §2.5, §8) | OpenRouter API Terms of Service; the served completions come from the DeepSeek family (the model's own terms apply to the completions). Atalaya submits its OWN prompts and consumes the completions — no model weights are… | In use |
| h8mail / brechas (h8mail, brechas) | verificación de email — EXCLUIDO | n/a (not used). | Excluded by design |
Tools in use
The inventory of the platform's own stack, with its licence: permissive (embeddable) or internal-only (never distributed).
| Source | Purpose | Licence |
|---|---|---|
| Go toolchain | the núcleo — every service is a Go binary (PRD §8 "Núcleo Go"). | BSD-3-Clause (permissive). |
| PostgreSQL | base de datos por tenant + control plane (PRD §8). | PostgreSQL License (permissive). |
| NATS server | bus asíncrono (docs/PATTERNS.md §2.5; PRD §8). | Apache-2.0 (permissive). |
| robfig/cron/v3 | scheduling del núcleo Go (docs/PATTERNS.md §9 deps-matrix; PRD §7 capacidad «scheduling»). | MIT (permissive). |
| jackc/pgx/v5 | driver PostgreSQL (docs/PATTERNS.md §9 deps-matrix). | MIT (permissive). |
| Chromium headless | render de reels (PRD §6.5). | BSD-3-Clause (permissive). |
| SearXNG | metabuscador autohospedado (PRD §5.1; instancia propia). | AGPL-3.0 (⚠️ internal-only — self-hosted, never distributed: Atalaya does not embed or redistribute SearXNG in the SaaS). |
| Remotion | motor de vídeo programático (PRD §6.5, R-6, D-012). | Remotion Free License (⚠️ internal-only — a source-available vendor licence, NOT OSI-permissive: a Company License is required if the render is ever sold as a service, PRD §6.5, R-6, D-012). |
| the operator's internal automation console | the operator's internal automation console (PRD §8 "solo consola interna"; PRD R-6 "nunca embebible"). | sustainable-use (⚠️ internal-only — "nunca embebible en el SaaS", PRD §8, R-6). |
Full register and the source of this page: docs/data-sources.md.