https://rhodecode.com/blog/113/rhodecode-goes-open-source-unified-security-for-git-svn-mercurial

(I've only skimmed but looks like AGPLv3 and a proprietary 'enterprise' version, presumably an asymmetric CLA.)

(Rhodecode is what Kallithea forked awhile back.)