Good point. I think I will do it the Atlassian way: companies who care about protecting their data will get the sources, just like with JIRA. They'll have to "go run" them themselves, but it's nothing like setting up JIRA.