Licences & acknowledgements

Ironfang builds on open-source software and on public invoice standards. This page lists what Ironfang uses, the licence each is offered under, the notices its authors ask to be kept, and where its source code is published. It covers the engines that validate invoices for Ironfang Finance, the code Ironfang Analytics sends to browsers, and the code and font this website sends to yours. Other services will be added as their review is completed.

Acknowledgements

Ironfang Finance is an application of the European standard on electronic invoicing, EN 16931-1:2017 and CEN/TS 16931-2:2017. Its use of that publication, including the rule texts it shows in validation results and rule explanations, is made with the permission of CEN and DIN as the owners of the copyright. CEN and DIN assume no liability with regard to the use of the content and the use of such derivative applications, and give no express or implied warranties for any use of them. In case of doubt, consult the publications of DIN (EN 16931-1:2017-06, CEN/TS 16931-2:2017-06), which provide the official text of the European standard.

This statement follows the conditions under which DIN permits the free use of these parts of the standard, as published in FeRD's disclaimer and rights of use.

The EN 16931 validation artefacts are licensed under the European Union Public Licence (EUPL) version 1.2. Their exact source, and how the copies Ironfang runs were produced from it, are set out under Source code and changes.

Names such as Peppol, XRechnung, ZUGFeRD, Factur-X, PHIVE, Saxon and veraPDF identify the standards and software Ironfang uses. Their owners have not certified, endorsed or reviewed Ironfang or its services, and none of them warrants the results Ironfang gives for your invoices.

Invoice standards and validation rules

Ironfang Finance checks invoices by executing the official rule sets of each standard, unchanged. These are the rules and schemas it runs, the exact releases, and where their source is published.

Validation engine software

The Java libraries inside the engines that validate invoices for Ironfang Finance: the Peppol validator (every generation still serving a release), the XML worker for XRechnung and ZUGFeRD / Factur-X XML, and the PDF inspector. Every library is the unmodified artefact published on Maven Central. The engine notices file lists all 76 jars with their hashes and reproduces every licence and notice file they carry; each jar's source is its -sources.jar on Maven Central.

Ironfang Analytics

Ironfang Analytics ships two pieces of browser code: the recorder, which customers load on their own websites, and the replay player on replay.ironfang.uk. Every release of each (recorder 0.1.0 to 0.3.0, player 0.1.0 to 0.2.0) bundles the same open-source packages, unmodified. Each file begins with a notice naming them; the analytics notices file reproduces their licences in full.

This website

ironfang.uk sends your browser the code of 28 open-source packages, bundled and minified, and the DM Sans typeface. The list below is produced from the build itself, so it matches what is served. The website notices file reproduces each package's licence and the typeface's licence in full.

• React (react 19.2.8, react-dom 19.2.8, scheduler 0.27.0, use-sync-external-store 1.6.0): MIT. Meta Platforms, Inc. and affiliates.
• TanStack Router and Start (@tanstack/history 1.162.1, @tanstack/react-router 1.170.32, @tanstack/react-start 1.168.49, @tanstack/react-start-client 1.168.30, @tanstack/react-store 0.9.3, @tanstack/router-core 1.171.27, @tanstack/start-client-core 1.170.27, @tanstack/store 0.9.3): MIT. Tanner Linsley.
• OpenTelemetry for JavaScript (@opentelemetry/api 1.9.1, @opentelemetry/core 2.11.0, @opentelemetry/exporter-trace-otlp-http 0.222.0, @opentelemetry/otlp-exporter-base 0.222.0, @opentelemetry/otlp-transformer 0.222.0, @opentelemetry/resources 2.11.0, @opentelemetry/sdk-trace 2.11.0, @opentelemetry/sdk-trace-base 2.11.0, @opentelemetry/sdk-trace-web 2.11.0, @opentelemetry/semantic-conventions 1.43.0): Apache-2.0. The OpenTelemetry Authors.
• Zod (zod 4.5.1): MIT. Colin McDonnell.
• Seroval (seroval 1.6.4, seroval-plugins 1.6.4): MIT. Alexis Munsayac.
• class-variance-authority (class-variance-authority 0.7.1): Apache-2.0. Joe Bell.
• clsx (clsx 2.1.1): MIT. Luke Edwards.
• cookie-es (cookie-es 3.1.1): MIT. Pooya Parsa; Roman Shtylman; Douglas Christopher Wilson; Nathan Friedly.

Source code and changes

No software or rule set on this page is modified. Each is used exactly as its publisher released it; Ironfang's own code runs them but does not change them. The one altered file is the typeface, served as a Latin subset as described above.

EN 16931 validation artefacts 1.3.16

The editable source is the Schematron published by CEN/TC 434 in release validation-1.3.16 (commit b6c9e06). Its two release archives carry the Schematron and a compiled form:

• en16931-ubl-1.3.16.zip, SHA-256 bafada015efbc5248bf5e05ad2191e1d9833ef96e9dd5f4bce420a747342da85
• en16931-cii-1.3.16.zip, SHA-256 1cd53cb8a84d38aedc82c0caede217da983a7934dd663f793a092fd66443c561

Ironfang runs the rules as compiled by the publishers of each specification:

• XRechnung, UBL: EN16931-UBL-validation.xsl, compiled by KoSIT, SHA-256 759f2d2e830c7fd1d5a6e8b4f61e5dbafc7a7805862c4ae1c749eeac6adde698
• XRechnung, CII: EN16931-CII-validation.xsl, compiled by KoSIT, SHA-256 0911e927f13f9ae2cdc7f973643f27bf0ad3c5da02483c04a5b8a47eb4822199
• Peppol BIS Billing 3: CEN-EN16931-UBL.xslt, compiled by OpenPeppol, SHA-256 a8a54aef3699057a3820cd2ebcac8ea3c364a6ebaf4a237e62064a5bc2877c4a

KoSIT compiles EN16931-UBL-validation.sch and EN16931-CII-validation.sch from the archives above with SchXslt 1.10.1 on Saxon-HE 12.8, as its build file for release 2026-08-31 sets out. On 25 September 2026 Ironfang compiled both files the same way and obtained KoSIT's output byte for byte, apart from the timestamp the compiler records:

java -cp Saxon-HE-12.8.jar:xmlresolver-5.3.3.jar:xmlresolver-5.3.3-data.jar \
  net.sf.saxon.Transform -s:schematron/EN16931-UBL-validation.sch \
  -xsl:'jar:file:schxslt-1.10.1.jar!/xslt/2.0/pipeline-for-svrl.xsl'

OpenPeppol compiled CEN-EN16931-UBL.xslt for Peppol BIS Billing 3 release 2026.5 from CEN-EN16931-UBL.sch, which is byte-identical to schematron/preprocessed/EN16931-UBL-validation-preprocessed.sch in the UBL archive above. The same compiled file ships in phive-rules-peppol 4.5.5 and 4.5.6. Ironfang has not reproduced OpenPeppol's compilation independently.

Other rules and software

The source of every other rule set is linked from its entry above, at the tag or commit Ironfang runs. The source of every Java library is the -sources.jar published beside it on Maven Central; the engine notices file links each one. The source of each browser package, on this website and in Ironfang Analytics, is published on npm at the version listed.

Licence texts and notices

Full licence texts and notice files, reproduced as their authors publish them. Each is plain text.

• Validation rules: the EUPL 1.2 text of the EN 16931 artefacts, the KoSIT NOTICE and licences, and the phive-rules-zugferd NOTICE and licence.
• Validation engines: all 76 Java libraries with their Maven coordinates, SHA-256 and source, and every licence and notice file they carry.
• Ironfang Analytics: the licence of every package in the recorder and the replay player, including rrweb and the Svelte runtime.
• This website: the licence of each package sent to your browser, and the SIL Open Font License of DM Sans.

The licences as published by their stewards: EUPL 1.2, Apache License 2.0, Mozilla Public License 2.0, SIL Open Font License 1.1.

Corrections

If something here is missing or wrong, please tell us through the contact form and we will correct it.